Following a tutorial at http://www.fuzzysecurity.com/tutorials/expDev/2.html, regarding buffer overflows. I am able to execute the shellcode successfully. Used 'jmp esp' instead of 'pop esp; retn' as showed in tutorial.
Problem is, when I set breakpoint at the overwritten EIP address(I use 'jmp esp' from ntdll.dll) and try to step into(continously pressing F7), I run into access violation at 0x00443B46. If I try to see what is lying at this memory address, immunity can't find anything.
If after reaching breakpoint, I execute program(by pressing F9), or don't use breakpoints at all, everything works fine.
What does get changed by immunity while stepping, which leads to this error?
Update(23-Apr-2016) : I was just being specific about my steps, since using both instructions I am able to make the program jump to my NOP sled followed by the shellcode. Issue is, when I try to walkthrough the shellcode step by step(using F7), I run into 'access violation when writing to 0x00443B46'.
Either I use 'jmp esp' or 'pop esp; retn', it does not matter, problem is independent of this, because anyhow, both instruction executes properly and program proceeds further.
The only difference is, setting a breakpoint and proceeding step by step leads to this problem, and with no breakpoints, no problems.
INT 3in each step, thus overwriting the stack, and with it, your memory location. But you'll have to improve your question and be much more specific to make it clear, if you want a helpful answer.