1. Use gdb to determine ebp value and beginning address of character array. 2. Use gcc -S to generate the assembly code for the attack function. 3. Copy the code and add the pushl instruction to push main's return address on the stack in a file named attack2.s. Then use gcc -c attack2.s to assemble this code in to object file attack2.o 4. Use objdump on the object file attack2.o to get the byte encoding of the function we want. 5. Append padding bytes (00 or 90) if necessary to the bytes from 4 and then add main's ebp value and the beginning address of the char array buf where this code will be copied by getsx.