Format-string bugs
Find
printf(user)/fprintf(log, user)/ logging wrappers- Missing format in
sprintffamily
Primitives
- Leak stack/code via
%p/%s - Write via
%n/%hn/%hhn(if still reachable) - Direct parameter access
%N$p
Modern reality
- Many compilers warn/forbid; still appears in custom loggers and embedded
- Prefer leak → ROP rather than heavy
%non hardened hosts
Pair with
stack-buffer-overflow, exploit-dev.