format-strings.md (315B)
1 +++ 2 title = 'Format strings' 3 +++ 4 # Format strings 5 e.g. in `printf`. 6 7 `printf` looks at registers, then stack. 8 - if user controls format string, can leak info 9 - `%P$c`: read character at position P 10 - `%n`: stores corrent length of string. use `$` and width modifiers to write data to some address 11 12 arbitrary write! 13