I was reading this article by Hackers Grimoire on Windows buffer overflow attacks.

The article made sense, except for the part where the author searched for a DLL (.dll) file which contained a JMP ESP instruction. I understood the other requirements, such as ensuring the DLL was not protected with DEP, ASLR etc...

Why was it necessary to find a DLL file with JMP ESP and note its memory address?

1 Answer 1


The problem is that the instruction pointer will always follow the program flow, unless you can alter it. They key time to alter it is on the return from a function, when the saved instruction pointer is popped off the stack into eip. If you can overwrite the saved instruction pointer you can redirect program execution.

Finding a jmp esp at a semi-predictable place in memory allows you to redirect execution to the top of the stack reliably.

So the process would be something like:

  • Overwrite saved instruction pointer (ebp+4) on the stack with the address of jmp esp in the .dll.
  • When the function returns, execution continues at the jmp esp instruction.
  • The jmp esp then redirects execution to the top of the stack where your payload is waiting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.