When you are overflowing a buffer to write on the stack in a way which is exploitable you will overwrite the return address on the stack. Ie, sending a long string of
AAAAAAAAAAAAAAAAAAAAAAAAAAA.....AAAAAAAAA will result in
EIP containing the value
0x41414141 when the application crashes.
The reasons for this is all well documented in lots of places on the internet. Aleph1's smashing the stack for fun and profit or the Corelan tutorials are great places to read more information, but on to the question at hand.
While having control of
EIP is great it doesn't instantly lead to running code of your choosing. When the function epilogue pops the return address of the stack it will continue to execute the instructions at that memory location. So you will need to supply a different value than
0x41414141. The first problem is that you don't know which 4
A's in your string are the one located in
EIP. This distance from the first A to the 4 A's that overwrite
EIP is commonly called the offset. You can work this out manually by swapping between values suc as
AAAABBBBCCCCDDDD....etc or you can use one of the pattern generators that can calculate the offset for you.
Once you know the offset you can hardcode the address where your shellcode should sit on the stack (easiest for beginners) or find a gadget that will land you back on the stack where your shell code is (f.ex:
jmp esp) and write that memory location to