I was doing the protostar format string (3rd challenge). where we have to change the value of a variable target with format string buffer overflow. so, I came up to this medium article: HERE

So, he has described three types of attacks. the second and third ones seem hard to understand.

2 byte

I want to know that he has divided the target value (0x00000000) into 2 bytes (0000) in the second method. it means that we are splitting the values into two bytes. am I right? and if I am right what is the thing he did for getting the second address of the target(0x80496f6). how could he possibly get that from the real address (0x80496f4)? all I can understand is he might have subtracted 0x2 from the real address(0x80496f4). Does the value of the target stores into two addresses? His command is :

python -c 'print "\xf4\x96\x04\x08" + "\xf6\x96\x04\x08" + "%13$hn" + "%12$hn"'

1 Answer 1


The second and third methods are simply variants of the first method, using different write sizes.

The %n format specifier writes 4 bytes to the destination address. There are times where you may not want to write this many bytes as once; maybe you only want to partially overwrite a value, or more importantly, it may be too slow this way. Let's say you wanted to write the value 0xdeadbeef; in this particular case, the program has to print out 3,735,928,559 characters, which can take a while to write. It is often quicker to do several smaller writes instead of one huge write. So, the specifier can be used with a length modifier to change the number of bytes written. %hn is 2 bytes, and %hhn is one byte.

So, you can break the problem into two chunks. Let's use the address from your example, 0x80496f4, as the target where we want to write. The first 2 bytes (little endian, 0xefbe) can be written at 0x80496f4 with an %hn. Since we're going 2 bytes at a time, the next write needs to be at 0x80496f4+2, which is where 0x80496f6 comes from. Here, the next two bytes can be written with %hn, 0xadde.

Or, you can do it in 4 chunks by doing single-byte writes.

  • but why the address 0x80496f6 is assigned to target? is it not assigned to some other instruction? Commented Aug 11, 2020 at 6:03
  • No, on a 32-bit system, data is typically 4 bytes. So for data that starts at 0x80496f4, 0x80496f6 would be the "middle" of that data. It may help to hook up a debugger and look around some. Commented Aug 11, 2020 at 11:21
  • And I don't know if I should ask it but did you see what he did when was he getting minus in result? why was he adding "1" before the hex address? Commented Aug 11, 2020 at 11:48
  • If you are only able to write one byte, there's no difference between writing 0x101 and 0x01, or 0x5544 and 0x44. Commented Aug 11, 2020 at 20:20
  • I don't know if I am frustrating but I didn't understand it. Commented Aug 12, 2020 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.