I wrote a pretty detailed guide on format string bugs, targeted towards absolute beginners. Check it out and let me know if something's wrong in this.
#ctf#formatstring#fsb
A runtime sometimes converts string arguments (or string returns) from WTF-16 to UTF-16 between functions in a call stack. Is this a security concern? #webbrowser#javascript#formatstring