printf("%2$*11$s", ...) what is this formation means

Question

it use like in c11/c++?:

printf("%2$*11$s",...)

It is come from a elf file, this file using printf() to operate like mem[4]=mem[2]+mem[1]. You can refer from this https://ctftime.org/task/5042 (it is a reverse CTF question).

To my point, I know the $ is use to specify the position of which var but no reference notice that one block can have two $.

also, I cannot find any func about $ in format except location.

so, I will be grateful if anyone can tell me it is meaning.

Answer 1

n$ is an extension defined in POSIX to select which argument to print. This is called Parameter field.

printf format string - Wikipedia

Actually this question is about using two n$ in one format specifier. Let me examine with small examples...

#include <stdio.h>

int main(void) {
    printf("%1$*3$s\n", "a", "b", 10, 20);
    printf("%1$*4$s\n", "a", "b", 10, 20);
    printf("%2$*3$s\n", "a", "b", 10, 20);
    printf("%2$*4$s\n", "a", "b", 10, 20);
    return 0;
}

Output:

         a
                   a
         b
                   b

It looks like %n$*m$s means "print the n-th argument using the width specified by the m-th argument". The final s has the meaning of s in %s.