15343685@stackoverflow

You were close.

The following is on linux on x86-64.

main.c:

    #include <stdio.h>

    void change()
    {
        char x;

        /* skip local variable and rbp */
        *(long*)(&x + sizeof(char) + sizeof(long*)) += 0x40055e - 0x400554;
    }

    int main()
    {
        printf("Hello\n");
        change();
        printf("Hai\n");
        printf("How are you?\n");
        return 0;
    }

output:

    $ cc -o main main.c
    $ ./main
    Hello
    How are you?

from objdump we get:

    40054f:	e8 c8 ff ff ff       	callq  40051c <change>
->  400554:	bf 1a 06 40 00       	mov    $0x40061a,%edi
    400559:	e8 92 fe ff ff       	callq  4003f0 <puts@plt>
->  40055e:	bf 1e 06 40 00       	mov    $0x40061e,%edi
    400563:	e8 88 fe ff ff       	callq  4003f0 <puts@plt>