Use when a memory corruption, type confusion, UAF, or logic bug already exists and must become leak/write/exec; or when choosing leak-first vs write-first, heap vs JS object vs kernel struct, sandbox escape pricing. Triggers include Chinese prompts like 原语、利用链、堆溢出、UAF、类型混淆、先泄漏还是先写、提权、沙箱逃逸、怎么把洞变成利用、pwn 思路. Not for understanding an unknown binary from scratch.
