Variadic Argument Sourcing (x86-64 System V ABI)

printf does not know how many arguments exist. For each conversion

(%x, %p, %s, …) it fetches the "next" argument.

• Arg 1 is the format string itself (in RDI).
• Further conversions read, in order: RSI, RDX, RCX, R8, R9.
• After those 5 register slots are exhausted, it reads from the stack, upward.

On 32-bit x86 there are no register args: every conversion comes straight

off the stack, which makes exploitation even simpler.