The code I'm referring to is found here: Link to code
I read that the buffer overflow exploit uses a buffer that looks something like this:
| NOP SLED | SHELLCODE | REPEATED RETURN ADDRESS |
From what I understand the exploit happens when the buffer is put onto the stack as a function parameter and overwrites the function's return address. I also understand that the repeated return address points to the NOP sled in the same buffer on the stack.
What I don't understand are the following:
Why does the return address have to point to the shellcode in the same buffer? Someone told me that I can't have the return address point to the shellcode array (as opposed to an address in the NOP sled in the same buffer) because different processes can't access each other's memory or something of that sort. I'd love it if anyone can explain this to me.
How is the return address on the buffer perfectly aligned with the original one so the
retcommand will read the correct address and not read it from the middle for example. What I'm referring to is that the repeated return command on the buffer overwrites the original return command on the stack which was pushed there with the
callinstruction. Why is the overwriting return address perfectly aligned with the original one?