That&#x27;s a great question! I didn&#x27;t cover this in the blog post, but there is a primitive identical to the increment-by-one presented there, which allows me to decrement-by-one as well (I&#x27;ve gone into more detail in the exploit code: <a href="https:&#x2F;&#x2F;github.com&#x2F;laginimaineb&#x2F;cve-2014-7920-7921" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;laginimaineb&#x2F;cve-2014-7920-7921</a>)