check for our target code location if page[ <equals_button and equals_button ((page[ page[ ])- )print "[*found our trampoline target at % (physicalcalculate virtual offset v_offset equals_button page[ now calculate physical offset trampoline_offset physical v_offset print "[*found our trampoline target at % (trampoline_offsetif slack_space is not nonebreak print "[*writing trampoline fd open(memory_file" +"fd seek(trampoline_offsetfd write(trampfd close(print "[*done injecting code all rightlet' walk through what all of this code does when we iterate over each pagethe code returns two-member list where page[ is the address of the page and page[ is the size of the page in bytes as we walk through each page of memorywe first find the physical offset (remember the offset in the ram image on diskof where the page lies we then open the ram image seek to the offset of where the page isand then read in the entire page of memory we then attempt to find chunk of null bytes the same size as our shellcodethis is where we write the shellcode into the ram image after we've found suitable spot and injected the shellcodewe take the address of our shellcode and create small chunk of opcodes these opcodes yield the following assemblymov ebxaddress_of_shellcode jmp ebx keep in mind that you could use volatility' disassembly features to ensure that you disassemble the exact number of bytes that you require for your jumpand restore those bytes in your shellcode 'll leave this as homework assignment the final step of our code is to test whether our button function resides in the current page that we're iterating over if we find itwe calculate the offset and then write out our trampoline we now have our trampoline in place that should transfer execution to the shellcode we placed in the ram image