I was doing the protostar format string (3rd challenge). where we have to change the value of a variable target with format string buffer overflow. so, I came up to this medium article: HERE
So, he has described three types of attacks. the second and third ones seem hard to understand.
I want to know that he has divided the target value (0x00000000) into 2 bytes (0000) in the second method. it means that we are splitting the values into two bytes. am I right? and if I am right what is the thing he did for getting the second address of the target(0x80496f6). how could he possibly get that from the real address (0x80496f4)? all I can understand is he might have subtracted 0x2 from the real address(0x80496f4). Does the value of the target stores into two addresses? His command is :
python -c 'print "\xf4\x96\x04\x08" + "\xf6\x96\x04\x08" + "%13$hn" + "%12$hn"'