I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow.
"It's difficult to know the starting address of the shellcode"
Why do we need to know the address of the shellcode? Why does stack not execute the shellcode as it is?
say we inject our shellcode this way
our shellcode -- some padding -- our choice of saved return address
should the shellcode not be executed by default by the stack? Why do we add NOP sleds and complicate things.
0x90
as return address – nornor Aug 29 '20 at 11:35