Positional Args and Finding Your Offset

• Typing many %p is tedious —- use positional %N$p.
• Trick: put a marker (AAAA) then scan offsets until it appears.

input : AAAAAAAA %6$p %7$p %8$p
output: AAAAAAAA 0x... 0x4141414141414141 0x...
                        ^-- our "AAAA" is at offset 7

• Once you know the offset of your buffer, you can plant an address there and dereference it (next section).
• Offsets are stable per binary, so one probe is enough.