1. create 3 unit

2. free #2

3. free #1

4. create unit with name length 24 will overwrite one byte of freed heap chunk size

5, create 2 unit will overwrite last unit's vtable

Original writeup (https://github.com/mingi/ctf/tree/master/nuit%20du%20hack%202016/Night%20Deamonic%20Heap).