I am currently exploring format string attacks. However, the buffer in this example is not located on stack but on heap, so the most common approach does not work and my options of addresses I can overwrite seem to be limited. Assume I need to write on 0x18 but nearest the address I can use with %n is 0x10. Is it possible to set up a format string which will allow me to fill the memory until I reach the right location and then write an arbitrary value?
Compiler used is GCC 5 on Debian OS x86-64.