1. Determine the ebp value for main, the caller of getbuf. 2. Determine the beginning address of the character array buf in getbuf that will be loaded and that will overflow and overwrite getbuf's stack frame. 3. Determine the byte code for our attack function. 4. Build the input string as this byte code plus padding bytes if necessary plus main's ebp plus the beginning address of our code (i.e., the beginning address of the character array).