I am trying to carry out a simple format string attack on this program:

#include <stdio.h>

int main(int argc, char *argv[])
{
    printf(argv[1]);
}

I face no problem leaking the stack in the usual way by passing a format string like this:

./test "%x %x %x %x"

or with direct parameter access like this:

./test "%4\$x"

Next, I am trying to find out the location (nth parameter) of the format string itself in the stack this way:

 for ((i = 1; i < 200; i++)); do echo -n "$i " && ./test "AAAAAAAA%$i\$x" 0; done | grep 4141

Once I know the value of $i (let's say 134) where the "AAAA..." string appears, I should be able to read off arbitrary addresses like this:

./test $'\xaa\xbb\xcc\xdd%134$s' 

I guess it's the traditional way of leaking information through a format string bug (as described in The Shellcoder's Handbook).

However, the format string I am passing is not nicely packed in a discrete $ith parameter (I don't have a better way to phrase it). Interestingly, half of it is present in 133 (upper word) and half of it in 134 (lower word). How am I supposed to pass arbitrary addresses as mentioned above in this situation? I am assuming I have to use a different sort of formatting to catch the exact address, but I am not sure how to proceed.

Also, ./test $'\xaa\xbb\xcc\xdd%134$s', simply prints off the ascii equivalent of those hex values. The argument doesn't exactly work as it is supposed to (I hope I am clear in what I am trying to achieve here). What is the proper way to pass these addresses?

If it helps, I am on Ubuntu12 i386 and using Bash.

I am trying to carry out a simple format string attack on this program:

#include <stdio.h>

int main(int argc, char *argv[])
{
    printf(argv[1]);
}

I face no problem leaking the stack in the usual way by passing a format string like this:

./test "%x %x %x %x"

or with direct parameter access like this:

./test "%4\$x"

Next, I am trying to find out the location (nth parameter) of the format string itself in the stack this way:

 for ((i = 1; i < 200; i++)); do echo -n "$i " && ./test "AAAAAAAA%$i\$x" 0; done | grep 4141

Once I know the value of $i (let's say 134) where the "AAAA..." string appears, I should be able to read off arbitrary addresses like this:

./test $'\xaa\xbb\xcc\xdd%134\$s' 

I guess it's the traditional way of leaking information through a format string bug (as described in The Shellcoder's Handbook).

However, the format string I am passing is not nicely packed in a discrete $ith parameter (I don't have a better way to phrase it). Interestingly, half of it is present in 133 (upper word) and half of it in 134 (lower word). How am I supposed to pass arbitrary addresses as mentioned above in this situation? I am assuming I have to use a different sort of formatting to catch the exact address, but I am not sure how to proceed.

Also, ./test $'\xaa\xbb\xcc\xdd%134$s', simply prints off the ascii equivalent of those hex values. The argument doesn't exactly work as it is supposed to (I hope I am clear in what I am trying to achieve here). What is the proper way to pass these addresses?

If it helps, I am on Ubuntu12 i386 and using Bash.