Formatted — Format String Write with %n Use a format string %n write to overwrite a target variable at a known address and unlock the flag path.