Format String

c programming-languages

Definition

Format String

A format string is a string template that allows dynamic string construction: placeholders called format specifiers are replaced, in order, by the parameters passed to a format-string function. The C stdio.h family exposes printf, fprintf, sprintf, and snprintf, all taking a const char* format followed by a variable argument list.

Common Format Specifiers

Specifiers on 64-bit platforms

Specifier	Size	Usage
%d	4 bytes	int
%u	4 bytes	unsigned int
%x	4 bytes	hex
%s	8-byte ptr	string (prints until \0)
%c	1 byte	character
%ld	8 bytes	long int
%f	4 bytes	float
%lf	8 bytes	double

Every specifier starts with %.

Length Modifiers

Modifiers cast the specifier's type

Length modifiers add another layer of control on top of a specifier, casting it to a char, short, long, or long long.

Modifier	Size	Usage
hh	1 byte	char
h	2 bytes	short int
l	8 bytes	long int
ll	8 bytes	long long int

For example printf("%hhx", 0x1337) prints one hex-encoded byte (37) — the hh cast truncates to char width. The hhn variant is the byte-truncating write form central to format-string attacks.

Padding and Direct Parameter Access

Two extra controls the attack chains together

• Padding — %10x left-pads the value up to 10 characters: printf("%10x", 0x1337) → 0000001337.
• Direct parameter access — %n$x reads the n-th argument directly, bypassing ordering and letting one argument be used multiple times or out of order: printf("%2$x", 0xcafe, 0xdead, 0xabba) → dead (the 2nd argument after the format string).

The two combine: printf("%3$08x", …) prints the 3rd argument, zero-padded to 8 characters. This combination is the building block for both the read primitive (pick which stack slot to read) and the write primitive (control the printed-character count, then %n to write it) of Format String Vulnerability.

Format-String Functions

Obs

The C <stdio.h> family is printf, fprintf, sprintf, snprintf — all taking a const char* format followed by a variable argument list. It is the varargs signature, and the absence of any argument count in that signature, that makes the format-string attack possible: the function has to walk arguments by parsing %s out of the format string itself.