Official Magic Scrolls Discussion

Official discussion thread for Magic Scrolls. Please do not post any spoilers or big hints.

Hi, I’m fairly new to this sort of challenges, and I am completely stuck on this one,if anybody could help me I would appreciate it.
I was able to overwrite either __malloc_hook or __free_hook with system/onegadgets, which is the only path to exploitation I can think of, but when they get executed the execution flow is normal, nothing happens. Am I in the right direction? Or do I have to start from scracth?