> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/format-strings-0.md).

# Format Strings 0

### Format String 0 — PicoCTF Walkthrough | Binary Exploitation

We start by analyzing the source code and identifying anything unusual in how input is handled.

### Program Behavior

At the start:

* The program reads the flag into a global variable
* It sets a signal handler:

```c
void sigsegv_handler(int sig) {
    printf("\n%s\n", flag);
    exit(1);
}
```

This means:

```
If the program crashes → print the flag
```

So again, just like previous challenges, crashing = winning.

***

### Key Observation

Inside the menu, one option looks strange:

```
Gr%114d_Cheese
```

That `%114d` is not normal text — it’s a **format specifier**.

This is the first hint that the program is vulnerable to a **format string bug**.

***

### Vulnerability

Somewhere in the program, user input is used like this:

```c
printf(user_input);
```

Instead of the safe version:

```c
printf("%s", user_input);
```

So:

```
Your input is treated as instructions, not just text
```

***

### Exploitation Idea

We want to trigger a crash.

Format specifiers like:

* `%d` → read integer
* `%x` → read memory
* `%s` → read string from memory address

The dangerous one is:

```
%s
```

Because it tries to read from a memory address that doesn’t exist → causes **segmentation fault**

***

### Payload

Input something like:

```
%s%s%s%s
```

or even:

```
AAAA%s
```

***

### What Happens

* `printf()` interprets `%s`
* It tries to read a string from an invalid memory address
* Program crashes (SIGSEGV)
* Signal handler runs
* Flag is printed

***

### Steps

1. Run the program
2. When prompted, enter:

```
%s%s%s%s
```

3. Program crashes
4. Flag is printed

***

### Why This Works

* Format string vulnerability allows memory access
* `%s` causes invalid memory dereference
* Crash triggers `sigsegv_handler()`
* Flag is leaked

***

### Key Takeaway

This challenge teaches:

```
Never use printf(user_input)
```

Always use:

```
printf("%s", user_input)
```

Because:

```
User input = data, not instructions
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/format-strings-0.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.