title: How to write value into an address in format string attack
body: <p>I'm taking a security course which needs us to do format string attack on an unix virtual machine. The vulnerability is a format string using command line argument.</p>
  
  <p>My question is how can I write value into an address in format string (like write shell code address into function return address)?</p>
  
  <p>For example, I try to write value 987654 into the return address location 0xaabbccdd.
  I tried some strings like <code>"AAAA_%10$x"</code>, and this can lead the program to print <code>AAAA_41414141</code>.</p>
  
  <p>Then I replace the letters with my address and try to overwrite it.</p>
  
  <pre><code>\xdd\xcc\xbb\xaa_%10$x_%54321x_%n"
  </code></pre>
  
  <p>But it does not work. I see an article says I should use a smaller number in <code>%54321x</code> since there are some chars I already wrote, but I don't know how many chars I've written before <code>%54321x</code>, either.</p>
  
  <p>note: The environment has an old version of gcc, so it's not necessary to worried about the value is too large.
  Any suggestions? Thanks.</p>