> Of course, it's possible to modify it to automagically get the needed
> addresses. It should also be possible to use pipe() and write() to send
> the evil buffer to the vulnerable program.
This is the popen() version. You may find other similar examples at: