I am trying to carry out a simple format string attack on this program: #include <stdio.h> int main(int argc, char *argv[]) { printf(argv[1]); } I face no problem leaking the stack in the usual way by passing a format string like this: ./test "%x %x %x %x" or with direct parameter access like this: ./test "%4\$x" Next, I am trying to find out the location (nth parameter) of the format string itself in the stack this way: for ((i = 1; i < 200; i++)); do echo -n "$i " && ./test "AAAAAAAA%$i\$x" 0; done | grep 4141 Once I know the value of `$i` (let's say 134) where the "AAAA..." string appears, I should be able to read off arbitrary addresses like this: ./test $'\xaa\xbb\xcc\xdd%134$s' I guess it's the traditional way of leaking information through a format string bug (as described in **The Shellcoder's Handbook**). However, the format string I am passing is not nicely packed in a discrete `$i`th parameter (I don't have a better way to phrase it). Interestingly, half of it is present in 133 (upper word) and half of it in 134 (lower word). How am I supposed to pass arbitrary addresses as mentioned above in this situation? I am assuming I have to use a different sort of formatting to catch the exact address, but I am not sure how to proceed. Also, `./test $'\xaa\xbb\xcc\xdd%134$s'`, simply prints off the ascii equivalent of those hex values. The argument doesn't exactly work as it is supposed to (I hope I am clear in what I am trying to achieve here). What is the proper way to pass these addresses? If it helps, I am on Ubuntu12 i386 and using Bash.