title: failure reading format string off the stack in c
body: <p>I am learning about format string vulnerabilities and am confused by the behavior of my code. I recognize that I need to know more about how the stack actually works, compiler optimizations, and more, but as of now I don't know and hope to get a useful reply. I have spent many hours trying to figure it out and have some guesses but I really don't know what is happening.</p>
  <p>I have the following code:</p>
  <pre><code>    #include&lt;stdio.h&gt;
      #include&lt;string.h&gt;
      int main(int argc, char** argv){
          char test[1024];
          strcpy(test,argv[1]);
          printf(test);
          //printf(argv[1]); // print without using local variable
      }    
  </code></pre>
  <p>Assuming a.exe is the compiled code, the following input returns the next line.</p>
  <p><code>a.exe &quot;AAAA.%08x.%08x.%08x.%08x.%08x&quot;  </code></p>
  <p>My output is: AAAA.b8c1fa30.b8c25940.0061de60.41414141.30252e78</p>
  <p>If I uncomment out the next printf(), it appends the same input string</p>
  <p>This is what I expected. I can see the AAAA printed as 41414141 and confirm that I am, indeed, looking at my format string using either a local variable or directly as an argument to main().</p>
  <p>However, if I comment out the local variable and strcpy() function and only print the argument to main(), then I get the following output.</p>
  <p><code>    AAAA.001a13a0.001a4730.00000011.001a13a0.004013c7  // removed both</code></p>
  <p>and if I just remove strcpy() and comment out the print statement that uses the local variable then I get this output:</p>
  <p><code>    AAAA.00a813a0.00a84730.00000011.000003ff.00000002 // removed strcpy()</code></p>
  <p>This confuses me. Why am I not seeing the 41414141 for my string of A's and what are the, presumably integers, of 0x11 and 0x02?? Why don't I ever see 41414141 in my output if I do not have local variables?</p>
  <p>I know that I am uninformed about some aspect of stack management but beats the heck out of me if I can figure it out.</p>
  <p>Edit: removed superfluous printf statement to appease pedantics</p>