Why is JMP ESP required in buffer overflow?

Question

I was reading this article by Hackers Grimoire on Windows buffer overflow attacks.

The article made sense, except for the part where the author searched for a DLL (.dll) file which contained a JMP ESP instruction. I understood the other requirements, such as ensuring the DLL was not protected with DEP, ASLR etc...

Why was it necessary to find a DLL file with JMP ESP and note its memory address?

Answer 1

The problem is that the instruction pointer will always follow the program flow, unless you can alter it. They key time to alter it is on the return from a function, when the saved instruction pointer is popped off the stack into eip. If you can overwrite the saved instruction pointer you can redirect program execution.

Finding a jmp esp at a semi-predictable place in memory allows you to redirect execution to the top of the stack reliably.

So the process would be something like:

• Overwrite saved instruction pointer (ebp+4) on the stack with the address of jmp esp in the .dll.
• When the function returns, execution continues at the jmp esp instruction.
• The jmp esp then redirects execution to the top of the stack where your payload is waiting.