/*
 *
 * Goal:
 * Exit status of process == 0
 *
 * Constraints:
 * ExecShield with NX cpu, so..
 * 1)all libraries randomized load address + NULL bytes in addresses
 * 2)no RWX memory in process, ie no library data segment RWX granularity issues
 *   with ExecShield since NX CPU
 * 3)binary code/data is NOT randomized
 * 4)one shot exploitation, no bruteforcing
 */

int main(int argc, char **argv)
{
    int     majic = 0x00110000;
    void    (*f)(void);
    char    buf[100];

    strcpy(buf, argv[1]);
    f();

    if(majic != 0x00110000)
        exit(2);

    return 55;
}