@CassieJade you need to look at the documentation of these functions online. printf, snpritf are pretty common functions. And by the way, this platform is not for school assignments. You are most welcome if you have tried something and want to follow from there.

1. http://www.cplusplus.com/reference/cstdio/printf/
2. http://www.cplusplus.com/reference/cstdio/snprintf/

The following explains beautifully about your concern of $. (GCC) Dollar sign in printf format string

Notation %2$d means the same as %d (output signed integer), except it formats the parameter with given 1-based number (in your case it's a second parameter, b).

int a = 3, b = 2;

printf("%2d", a, b);

Here you would expect 3 2 to be printed, but it will print 2 3, because the parameter a becomes param#1, and b becomes param#2, and %2$d is printed first so 2 is printed first followed by %1$d which is 3

You may want to look at man page of printf, its a bit complex for newbies but its the final source of truth.

The following is your print wrapper.

char buf[5012];
memcpy(buf, argv[1], 5012);
printWrapper(argv[1]);
return (0);

Your website says: When an attacker can modify an externally-controlled format string, this can lead to buffer overflows, denial of service, or data representation problems.

Now, if this argv1 can be provided by someone who is not trusted, he can provide any junk argument which will go to printf. The goal of your task is to not to feed on print() with any string that is externally controlled. e.g. argv1 can be very huge string (max allowable). Or for example I am the one invoking your program and I passed argv1 as "%d Hello World", your printWrapper will end up printing some junk like "-446798072 Hello World", because no integer is passed as argument in printf(argv1).

Also memcpy is reading fixed number of bytes from origin argv1 which can have shorter length string, in this case it will be an invalid read (read past bound).

snprintf(buf,128,argv[1]);

exploit here is very clear, the argv1 can be changed with containment of several specifiers like %n which can write n number of bytes to your buf rather than intended write. By using %X in argc1 hacker can gain address of a variable on stack which can be exploited further. All this is vulnerable because an external untrusted source is creating the format specifier string that is used by your printf or snprintf, sprintf functions. For example suppose hacker gave "%200d" in the argv1. sprintf(buf, 128, argv[1]); will land up printing 200 bytes and then a junk integer, which might not be intended at all, since its snprintf which is a bounded function it will allow only 128 bytes to be written which will be empty.

I hope it is clear now.