EXPLOITATION - Hacking: The Art of Exploitation - page 168

Parameter Input Type Output Type

%d

Value Decimal

%u

Value Unsigned decimal

%x Value Hexadecimal

%s

Pointer String

%n

Pointer Number of bytes written so far

The previous chapter demonstrated the use of the more common
format parameters, but neglected the less common %n format parameter.
The fmt_uncommon.c code demonstrates its use.

fmt_uncommon.c

#include <stdio.h>
#include <stdlib.h>

int main() {
int A = 5, B = 7, count_one, count_two;

// Example of a %n format string
printf("The number of bytes written up to this point X%n is being stored in
count_one, and the number of bytes up to here X%n is being stored in
count_two.\n", &count_one, &count_two);

printf("count_one: %d\n", count_one);
printf("count_two: %d\n", count_two);

// Stack example
printf("A is %d and is at %08x. B is %x.\n", A, &A, B);

exit(0);
}

This program uses two %n format parameters in its printf() statement.
The following is the output of the program's compilation and execution.

reader@hacking:~/booksrc $ gcc fmt_uncommon.c
reader@hacking:~/booksrc $ ./a.out
The number of bytes written up to this point X is being stored in count_one, and the number of
bytes up to here X is being stored in count_two.
count_one: 46
count_two: 113
A is 5 and is at bffff7f4. B is 7.
reader@hacking:~/booksrc $

The %n format parameter is unique in that it writes data without display-
ing anything, as opposed to reading and then displaying data. When a format
function encounters a %n format parameter, it writes the number of bytes that
have been written by the function to the address in the corresponding func-
tion argument. In fmt_uncommon , this is done in two places, and the unary