Controlling EIP

You have the offset, so you can place any four bytes into EIP. The question now is: what address should you put there?

You want EIP to point at your shellcode. But you cannot just hardcode the stack address; you need a reliable jump.

The stack address where your shellcode sits can shift between runs and systems. Even small environment changes move it.

Instead, you use a stable instruction already in memory that redirects execution to wherever ESP currently points.

If ESP points at your shellcode at crash time, you can set EIP to the address of a JMP ESP instruction. When EIP loads that address, the CPU executes jmp esp and jumps into your shellcode.

This indirection makes the exploit reliable regardless of the exact stack address.

You search loaded modules (preferably ones without ASLR) for the opcode bytes FF E4. The module's base address stays constant, so this gadget is dependable.

Tools like mona.py find suitable instructions automatically.

Some byte values break the input before it reaches the buffer intact. The classic one is the null byte 0x00, which terminates C strings. Others include 0x0a (newline) and 0x0d (carriage return).

The JMP ESP address must not contain any of these bad characters.

To find which bytes are bad, send all byte values 0x00-0xff in the buffer and inspect memory in the debugger. Bytes that are mangled or missing are bad characters.

You will exclude these from both the return address and the shellcode.

Now assemble the input: padding to the offset, then the JMP ESP address in little-endian order.

If the JMP ESP lives at 0x625011AF, the bytes written are reversed.

Set a breakpoint on the JMP ESP address in the debugger and run the exploit. When EIP reaches it and steps into ESP, you have confirmed reliable redirection.

At this point EIP points where your shellcode will go.

After the return address, the remaining buffer (where ESP points) holds your shellcode. If space is tight, you may need a short jump or to relocate.

A NOP sled (a run of 0x90 no-op bytes) before the shellcode adds tolerance so the jump can land anywhere in the sled.

The full exploit structure is now clear:

• Padding up to the offset.
• The JMP ESP address (no bad chars, little-endian).
• A NOP sled.
• The shellcode.

You are one step from a shell.

JMP ESP is the classic redirect, but it is not the only one. If a different register points at your buffer, you can use jmp eax, call esp, or a push esp; ret gadget.

The principle is the same: find a stable instruction that transfers control to where your shellcode lives.

Recall why JMP ESP is preferred over a hardcoded stack address.

You now control execution flow:

• Overwrite EIP with the address of a JMP ESP gadget instead of a fragile stack address.
• Find the gadget in a non-ASLR module, avoiding bad characters like 0x00.
• Write the address in little-endian and add a NOP sled before shellcode.

Next you will generate shellcode and pop a shell.