> For this demo, you either need the direct physical map offset (e.g. from demo #2)

as in, demo #2 is a working exploit to get this map