Format String Bug

Format-string vulnerabilities: read/write primitives via %n/%s, GOT overwrite, modern compiler constraints.

netvar1337 f64baf0 648 B Updated

File contents

Format-string bugs

Find

  • printf(user) / fprintf(log, user) / logging wrappers
  • Missing format in sprintf family

Primitives

  • Leak stack/code via %p/%s
  • Write via %n/%hn/%hhn (if still reachable)
  • Direct parameter access %N$p

Modern reality

  • Many compilers warn/forbid; still appears in custom loggers and embedded
  • Prefer leak → ROP rather than heavy %n on hardened hosts

Pair with

stack-buffer-overflow, exploit-dev.

netvar1337/unleash/tree/main/contrib/skills/format-string-bug commit f64baf014f

Frequently asked questions

npx skillmds@latest add netvar1337/format-string-bug