Steps For Format String Exploitation
Map out the stack
Read arbitrary memory locations
Writing to arbitrary memory
.dtors
Pull it all together for an exploit