Small doubt in the rot26 writeup about writeups HOT 2 CLOSED

Firstly: thanks for the comment.

Whenever you use a string format exploit you use %n to write the number of character printed up to now in a variable passed to printf, more information here (in our case we refer explicitly to the seventh variable because of the 7$ specifier) so we need to print a certain number of characters to reach the exact number to write in the address passed as first element of the exploit. You need to calculate it via trial and error since you don't know exactly how many character will be printed by the program in first place. The second number is calculated to overflow the higher part of the address since we are deciding to overwrite the got entry in two steps.
Here an amazing video about the whole argument.

from writeups.

Thank you so much for the explanation. I totally got it now. Thanks for the video reference as well.

from writeups.