This tutorial shows how to find a JMP ESP in nttdll.dll


  1. Find address for EIP

In this step we have to check the registers and the stack. We have to find a way to jump to our buffer to execute our code. ESP points to the beginning of the C part of our buffer. We have to find a JMP ESP or CALL ESP instruction. Do not forget, that the address must not contain bad characters!

Open the executable modules list in OllyDbg (press the E letter on the toolbar). Select a module, for example the ntdll.dll. (Vulnserv would not be a good choice as its address contains zero!)

Press right click on the code and select Search for/All commands. Enter JMP ESP. A couple of possible address is displayed. Select one.

I've followed the steps but couldn't find JMP ESP instruction in nttdll.dll.

enter image description here

enter image description here

enter image description here

enter image description here


There are a few executable modules in your screenshot. In your case, nttdll.dll doesn't has JMP ESP instruction.

The right tool for this is mona.py

mona.py is a tool written in Python and available with Immunity Debugger that helps finding a reliable JMP ESP instruction.


To find all addresses with JMP ESP, use !mona jmp -r esp command.

This command will search in the loaded executable modules for a memory address that has JMP ESP.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.