I'm trying to write a rop chain to bypass dep on Windows 7 x64 SP1.
I'm working on a SEH overwrite exploit and so, in the first place, i need to return back to my buffer after exception is triggered and ESP was moved away. My problem is, i cannot find a good stackpivot gadget due to badchars and distance too much large of existing gadget that i could use to pivoting back into my buffer.
During the overwrite i can see ECX register that points into my buffer and i know the offset. But it seems to me its value is changed in the same time ESP is moved away. So, i cannot return back into my buffer to start my rop chain.
How can i approach to solve this problem ? Any suggestions ?