how to get the full attack exp

[QQYYHH]

Hi, I would like to ask how to get the full attack exp.

After running task reports-clean einstein-nowrite-config nginx-eval-custom db-add-reports db-analyze-reports db-analyze-candidates, I got the following output:

**************** (SEC-SENSITIVE SYSCALL) execve: arg 1/3, app+bt 1/1, report 1/1
========================================
Setting config to have rewrites (excluding backtrace): {"rewrites": [{"type": "vptr_qword", "application": "nginx", "syscall": "execve", "syscall_arg_num": 0, "address": 140733197103936, "expected_vals": [160, 224, 56, 0, 255, 127, 0, 0], "ptr_depth": 0, "write_vuln_count": 1}]}
Setting testcase: binary_upgrade.t
Core: /root/einstein/apps/nginx-1.23.0/.tmp/binary_upgrade/core-1.72011
Testing (SEC-SENSITIVE SYSCALL) execve: arg 1/3, app+bt 1/1, report 1/1, iflow 1/1
Stopping all servers...
***** Running nginx benchmark...
binary_upgrade.t .. 1/6 Rewrite successful! Found: '/root/einstein/apps/nginx-1.23.0/.tmp/binary_upgrade/einstein.73404.73404.out:einstein_rewrite.cpp:108: REWRITE_EVAL_FINISHED:SUCCESS: Successfully verified all rewrites!
'
Killing nginx tests and server...
Terminated

How do I get the full attack script, such as what payload and configuration needs to be constructed to trigger the exploit? Because I want to reproduce the Data-Only Attack found by EINSTEIN directly on the original program (without libdft)