title: Buffer overflow using snprintf
body: <p>This is an assignment but I am having problems with the basic understanding.</p>
  
  <p>The vulnerable code:</p>
  
  <pre><code>int choc(char *arg)
  {
    char buf[400];
    snprintf(buf, sizeof buf, arg);
    return 0;
  }
  </code></pre>
  
  <p>I understand that arg needs to be a format string which will overwrite the return address with the address of the code I want to execute. But I am having trouble creating the format string.</p>
  
  <p>So, things which the format string needs to have:</p>
  
  <ol>
  <li>the address of the return instruction, which I need to overwrite</li>
  <li>A list of %x</li>
  <li>The value which I would write on the return address. This would be the address of the code I want to execute.</li>
  </ol>
  
  <p>In order to get the return address, I just need to look at the address of the 'ret' instruction in gdb right? What exactly is the purpose to the %x? And how do I encode the address of the code I want to execute in the format string?</p>
  
  <p>A test I did:
  Using gdb I found that the address of my buf is 0xbffffba0. I generated arg to be "\xa0\xfb\xff\xbf_%x.%x.%n"; Shouldn't this write some value to the start of the buff at the address 0xbffffba0? However I get a segfault. What am I doing wrong?</p>
  
  <p>Any help would be appreciated!</p>