ELF x86: Format string bug basic 2

root-me challenge: Or how to write what you want where you want in the stack.

Environment configuration:

PIE 	Position Independent Executable 	 No
RelRO 	Read Only relocations 	                 No
NX 	Non-Executable Stack 	                 YES
ASLR 	Address Space Layout Randomization 	 No
SF 	Source Fortification 	                 No
SSP 	Stack-Smashing Protection 	         No
SRC 	Source code access 	                 Yes

Source code:

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>
int main( int argc, char ** argv )
        int var;
        int check  = 0x04030201;
        char fmt[128];
        if (argc <2)
        memset( fmt, 0, sizeof(fmt) );
        printf( "check at 0x%x\n", &check );
        printf( "argv[1] = [%s]\n", argv[1] );
        snprintf( fmt, sizeof(fmt), argv[1] );
        if ((check != 0x04030201) && (check != 0xdeadbeef))    
                printf ("\nYou are on the right way !\n");
        printf( "fmt=[%s]\n", fmt );
        printf( "check=0x%x\n", check );
        if (check==0xdeadbeef)
                printf("Yeah dude ! You win !\n");
                setreuid(geteuid(), geteuid());