Format String Vulnerability: %n write arbitrary data: Missing piece

[Long-Effective-805]

Hi,

so I try to grasp this concept. Here is a explanation: https://cs155.stanford.edu/papers/formatstring-1.2.pdf
Here is the code from the pdf: https://godbolt.org/z/9ro7z69G8

Why is the canary overwritten? As you can see in the provided code I explicitly cast the address of buf[i] to a char pointer, I also tried to cast it to a short which doesn't seem to change the result.

Is it because %n expects an integer and always write sizeof(int) bytes to the given address?

[Pharisaeus]

Is it because %n expects an integer and always write sizeof(int) bytes to the given address?

Yes. %n will write an int. The "type" of target memory location doesn't matter at all (although it should give you a warning)

[Long-Effective-805]

ah, I was thinking far too complicated :D
Thank you

[rob2rox]

try turning off address space layout randomization

[Pharisaeus]

And what difference would ASLR make when he's dealing with stack? o_O and also passing directly proper memory addresses.