title: C (s)printf exploit, $hn and %10
body: <p>when trying to follow a tutorial on string exploits in C, I had the following questions which I do not seem to find an answer to.</p>
  
  <ol>
  <li>"If we were to pass the string AAAA%10$n, we would write the value 4 to the address 0x41414141!". This is an excerpt from <a href="http://codearcana.com/posts/2013/05/02/introduction-to-format-string-exploits.html" rel="nofollow noreferrer">a tutorial</a>. But how come we write a 4? I do realize that AAAA in hex becomes 0x41414141 but then %10$n is written. What does this 10 mean, what does this dollar mean and where does the 4 come from?</li>
  <li>The final solution to an exploit for a wargame is given below. It however seems I can completely drop the %238x (what was the purpose of this anyway?) and here the end of the string is %10$hn. what does 'hn' here mean? The <a href="http://www.cplusplus.com/reference/cstdio/printf/" rel="nofollow noreferrer">C reference documentation</a> refers to 'hn' as "unsigned short *". Is this even a datatype?</li>
  </ol>
  
  <p><code>$(python -c 'print "\x40\x99\x04\x08%238x%10$hn"')</code></p>