I am currently exploring format string attacks. However, the buffer in this example is not located on stack but on heap, so the most common approach does not work and my options of addresses I can overwrite seem to be limited. Assume I need to write on 0x18 but nearest the address I can use with %n is 0x10. Is it possible to set up a format string which will allow me to fill the memory until I reach the right location and then write an arbitrary value?

Compiler used is GCC 5 on Debian OS x86-64.

  • Why wouldn't you be able to write to 0x18?
    – noone392
    Jan 27, 2018 at 0:50
  • I should have been clearer in what I am able to change in the program to reach my goal. It's all about format string attacks, so everything I can influence is the input via stdin. The source code includes an unsafe format string which I have to make use of. I have only a few stack addresses available to write an arbitrary value to using %n, but my target address is not on stack. However, the address target-8 is on stack. Can I use %n on target-8 with a large enough value to change target?
    – Calyx
    Jan 27, 2018 at 8:41
  • Someone can correct me if im wrong, but if you target address is on the stack, you would get a stack overflow from most OS's if it was so big it would extend to the heap. I think we need more info because if your writable address is on the stack at target -8 then I don't think compiling code with gcc will result in target being on the heap
    – noone392
    Jan 28, 2018 at 16:34

1 Answer 1


assuming what you mean is that you want to write in the middle of your 64 bit address, because your on a 64 bit system you could just create 8 byte array and add them to an unsigned long long kind of in sudo code:

//get the pointer to the nearast address
unsigned long long * datapointer = 0x18;
//get all the data from the smallest adressible chunk for your system, in this case 64 bits
unsigned long long data = &(datapointer);
//some values of individual bytes you want to override
uchar a = 0x23;
ucahr b = 0x99;
//clear out the bytes you want to change
data = data & (data mask to be overidden);
//change the desired bytes with the desired values
data = data | a << (byte number for a in bits);
data = data | a << (byte number for b in bits);
//override the data chunk    
&datapointer = data;

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .