Re: Jump back to shellcode Windows overflow

Have you tried putting your shellcode after the saved EIP? Use the fact that ESP points to just after the location of the saved EIP as a blessing and just put your shellcode at the end.

[ 396 bytes padding ] [ RET ] [NOP*] [ SHELLCODE ]

You'll often have more room for your shellcode after the saved return address anyway.

Have fun,

-Dino

On Monday, April 21, 2003, at 09:50 PM, <chaboyd77@yahoo.com> wrote:

>
>
> I'm practicing developing Windows Buffer Overflows and

--
          Dino Dai Zovi / ddz@theta44.org / www.theta44.org
       "Bein' Crazy is the least of my worries." - Jack Kerouac
          C439 2B06 D8D2 A2D8 1ABB  0A55 A61D 9057 63F5 9B1F