Custom heap with random offset of allocated chunks- Goal: Exploit binary- Chunks may overlap- Offsets can be predicted (custom PRNG)- Leak heap address- Leak image base address- Overwrite function pointer with system- Trigger system("/bin/sh")