This write up provides code of the ‘two-write-where-and-what’ format string (FMS) exploitation technique and how to exploit it when located on the heap.
You can download it from the following link: https://packetstormsecurity.com/files/download/138637/twowritewhere-format.txt
Source: https://packetstormsecurity.com/files/138637/Heap-Two-Write-Where-And-Not-Format-String-FMS-Technique.html