1. Using fsb, modify the vtable (rip should be 0x4009cb)
- (1) Create a pointer to point to the stack address where the stream is stored.
- (2) Modify the 1 byte of the stream address to point to vtable.
2. Using fsb, modify the return address of the stack to main
3. Using fsb, modify the stream address to fake_vtable

Original writeup (https://blog.jsec.xyz/ctf-write-up/2021/01/03/TetCTF-babyformat-write-up.html).