I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow.

"It's difficult to know the starting address of the shellcode"

Why do we need to know the address of the shellcode? Why does stack not execute the shellcode as it is?

say we inject our shellcode this way

our shellcode -- some padding -- our choice of saved return address

should the shellcode not be executed by default by the stack? Why do we add NOP sleds and complicate things.

  • 1
    Can you link one of those articles? Maybe there's something specific there. I think with the current information you provide it's difficult to correctly answer your questions. Aug 27, 2018 at 6:34
  • Following @perror answer, you can use address containing 0x90 as return address
    – nornor
    Aug 29, 2020 at 11:35

1 Answer 1


Exploiting a software by injecting a shellcode in its memory always requires the following steps:

  1. Have a way to inject your shellcode in memory (usually, it can take place in any buffer of the program).

  2. Redirect the execution flow (i.e. be able to write on the rip) to point to the shellcode and execute it (usually, it is done through a buffer-overflow).

If you are not sure about the address of your shellcode, the second part of the exploitation (the redirection of the eip) cannot be achieved reliably.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.