I am trying to carry out a simple format string attack on this program:

    #include <stdio.h>
    
    int main(int argc, char *argv[])
    {
        printf(argv[1]);
    }

I face no problem leaking the stack in the usual way by passing a format string like this: 

    ./test "%x %x %x %x"

or with direct parameter access like this:

    ./test "%4\$x"

Next, I am trying to find out the location (nth parameter) of the format string itself in the stack this way:

     for ((i = 1; i < 200; i++)); do echo -n "$i " && ./test "AAAAAAAA%$i\$x" 0; done | grep 4141

Once I know the value of `$i` (let's say 134) where the "AAAA..." string appears, I should be able to read off arbitrary addresses like this:

    ./test $'\xaa\xbb\xcc\xdd%134$s' 
I guess it's the traditional way of leaking information through a format string bug (as described in **The Shellcoder's Handbook**).

However, the format string I am passing is not nicely packed in a discrete `$i`th parameter (I don't have a better way to phrase it). Interestingly, half of it is present in 133 (upper word) and half of it in 134 (lower word). How am I supposed to pass arbitrary addresses as mentioned above in this situation? I am assuming I have to use a different sort of formatting to catch the exact address, but I am not sure how to proceed.

Also, `./test $'\xaa\xbb\xcc\xdd%134$s'`, simply prints off the ascii equivalent of those hex values. The argument doesn't exactly work as it is supposed to (I hope I am clear in what I am trying to achieve here). What is the proper way to pass these addresses? 

If it helps, I am on Ubuntu12 i386 and using Bash.