As far as I know, it is possible to overwrite the unchanged part of the EIP to bypass ASLR protection. Unfortunately, I do not understand how this can help me in order to jump to the location of my exploit. I would need the address of a [JMP ESP] instruction in order to do so, but since the address will always vary, what's the idea behind partially overwriting the EIP?
Furthermore, this answer states that a non-ASLR module is required. How can some parts of the address be fixed and some change in a non-ASLR module?