Comments on: Format String Exploits http://webstersprodigy.net/2009/04/09/format-string-exploits/ Wed, 07 Jul 2010 04:52:52 +0000 hourly 1 http://wordpress.org/?v=3.0.1 By: mopey http://webstersprodigy.net/2009/04/09/format-string-exploits/comment-page-1/#comment-61 mopey Fri, 10 Apr 2009 00:06:21 +0000 http://webstersprodigy.net/?p=490#comment-61 The magic formula is: "[addr][addr+2]%.[val. min. - 8]x%[offset]$hn%.[val. max - val. min.]x%[offset+1]$hn" where addr is the memory location you want to overwrite (eg .dtors), val. max and val.min are the upper and lower bytes of what we want to put into that memory location (eg the address of our shellcode) and offset is where our format string is. The magic formula is:

“[addr][addr+2]%.[val. min. - 8]x%[offset]$hn%.[val. max - val. min.]x%[offset+1]$hn”

where addr is the memory location you want to overwrite (eg .dtors), val. max and val.min are the upper and lower bytes of what we want to put into that memory location (eg the address of our shellcode) and offset is where our format string is.

]]>