format string vulnerability - printf

Question

Why does this print the value of the memory address at 0x08480110? I\'m not sure why there are 5 %08x arguments - where does that take you up the stack?

add         


        

Answer 1

You misunderstood the paper.

The text you linked is assuming that the current position on the stack is 0x08480110 (look at the surrounding text). The printf() will dump data from wherever on the stack you happen to be.

The \x10\x01\x48\x08 at the beginning of the format string is merely to print the (assumed) address to stdout in front of the dumped data. In no way do these numbers modify the address from which the data is dumped.