This 3 lines of code are used by some encoders to get EIP into ECX register:
fldz
fnstenv [esp-C]
pop ecx
The 2 first instructions push some datas on stack and we get one of this into ECX on the last line.
I have tried this code in a very basic poc. It works fine.
But in real life (in a Buffer overflow application), ecx contains 0x0000000 and I do not understand why.
The only thing I know is ESP value has been changed, but points in the middle of a big buffer.
Are there some rules on ESP ? Can ESP points anywhere (on an allocated memory region of course) ?
For example if I create a global variable in my program: unsigned char buf[1024]. Can I set ESP to buf+512 and call PUSH, fldz or fnstenv instructions ?
Thanks