### TL;DR1. Create free chunk near the counter2. Overflow to chunksize of top chunk3. Allocate some chunk to change the terminator4. Get the keystream for printing heap content5. Create overlapped chunk by modifying the size6. Partial overwrite to forge fd to counter7. Reset counter8. Get the keystream for writing9. Use normal heap exploitation techniques to win