给个简单的解答如下:
printf(&linux["\021%s%sto\012\0"], (linux)["kevinliao"] + "hates all bbs." - 0x5B, (linux)["But"] + "he loves mychat." - 0x6C);
=>printf(&1["\021%s%sto\n\0"], (1)["kevinliao"] + "hates all bbs." - 0x5B, (1)["But"] + "he loves mychat." - 0x6C);
=>printf(&"\021%s%sto\n\0"[1], "kevinliao"[1] + "hates all bbs." - 0x5B, "But"[1] + "he loves mychat." - 0x6C);
=>printf("%s%sto\n\0", 'e' + "hates all bbs." - 0x5B, 'u' + "he loves mychat." - 0x6C);
=>printf("%s%sto\n\0", 0x65 + "hates all bbs." - 0x5B, 0x75 + "he loves mychat." - 0x6C);
=>printf("%s%sto\n\0", "hates all bbs." + 10, "he loves mychat." + 9);
=>printf("%s%sto\n\0", "bbs.", "mychat.");
结果就是印出bbs.mychat.to以及一个换行符号啰, 无聊吧