I am training myself for BOF and ASLR in 32Bits. I wrote a program that seems like this :
int main(int argc, char **argv)
{
char buffer[32];
printf(argv[1]);
gets(buffer);
return 0;
}
With a format string I can get main's return address which is: 0xf7e19637 <=> __libc_start_main+247.
But now I don't know what I can do with this address to find the address of the system function to do a Ret2LibC!
EDIT: After researchs I found this How to leak libc base address using format string exploit which is the same program, and he wants to exploit it as the same way as I want (he is in x86_64). But I do not understand how he does its script.