This tutorial shows how to find a JMP ESP in nttdll.dll
- Find address for EIP
In this step we have to check the registers and the stack. We have to find a way to jump to our buffer to execute our code. ESP points to the beginning of the C part of our buffer. We have to find a JMP ESP or CALL ESP instruction. Do not forget, that the address must not contain bad characters!
Open the executable modules list in OllyDbg (press the E letter on the toolbar). Select a module, for example the ntdll.dll. (Vulnserv would not be a good choice as its address contains zero!)
Press right click on the code and select Search for/All commands. Enter JMP ESP. A couple of possible address is displayed. Select one.
I've followed the steps but couldn't find JMP ESP instruction in nttdll.dll.