When you are overflowing a buffer to write on the stack in a way which is exploitable you will overwrite the return address on the stack. Ie, sending a long string of AAAAAAAAAAAAAAAAAAAAAAAAAAA.....AAAAAAAAA
will result in EIP
containing the value 0x41414141
when the application crashes.
The reasons for this is all well documented in lots of places on the internet. Aleph1's smashing the stack for fun and profit or the Corelan tutorials are great places to read more information, but on to the question at hand.
While having control of EIP
is great it doesn't instantly lead to running code of your choosing. When the function epilogue pops the return address of the stack it will continue to execute the instructions at that memory location. So you will need to supply a different value than 0x41414141
. The first problem is that you don't know which 4 A
's in your string are the one located in EIP
. This distance from the first A to the 4 A's that overwrite EIP
is commonly called the offset. You can work this out manually by swapping between values suc as AAAABBBBCCCCDDDD....etc
or you can use one of the pattern generators that can calculate the offset for you.
Once you know the offset you can hardcode the address where your shellcode should sit on the stack (easiest for beginners) or find a gadget that will land you back on the stack where your shell code is (f.ex: jmp esp
) and write that memory location to EIP
.