REFERENCE GUIDE
Format-string reads, writes, and argument indexing
A format-string vulnerability passes attacker-controlled bytes as the formatting program rather than as a string argument.
Also known as: printf exploitation
Mechanism
A format-string vulnerability passes attacker-controlled bytes as the formatting program rather than as a string argument. Conversion directives then consume variadic arguments that the caller did not intentionally supply. Reads and writes require different primitives; the write conversion stores a character count through a pointer rather than emitting text.
Practical method
Confirm the vulnerable call shape and identify the argument index where controlled bytes appear. Test a small bounded read from a known fixture. Before any write experiment, establish the destination address, count width, and output limits. Keep positional syntax and ABI details explicit.
/* Data remains an argument with a fixed format. */
printf("%s", user_input);
/* printf(user_input) would interpret user bytes as directives. */Interpreting evidence
Controlled stack disclosure does not guarantee arbitrary-address reads. A useful write proof changes a harmless local marker to a small expected value and shows the exact count and destination used.
Pitfalls and limits
Output buffering can hide observations. Positional directives are implementation-specific. Width padding changes the printed count, and short writes wrap at the destination width; do not mix those assumptions.