I am quite new to buffer overflows and I am practicing right now different types of buffer overflow attacks. The shellcode was not executed until it was padded with NOPs although it's set properly in memory and the execution flow works as needed.

After investigation, I saw some people who wrote the following:

"find the opcode for add esp,-1500 put those bytes at the start of the shellcode remove the nops"

I would appreciate if anybody could help explain this!

3 Answers 3


NOPs tend to get flagged by anti-virus, so an alternate method can be used to 'slide' the execution to the shell code. The way you were told was to add 1500 bytes to the ESP, which (I'm assuming) should replace 1500 NOPs, landing you at your shellcode.

If you have not already seen this, you NEED to be reading corelan.be for awesome BO writing tutorials. Here is one that explains the add esp


I found the answer:

'StackAdjustment' => -3500, # Modify stack pointer at shellcode start so it can use the stack without writing on itself.

First, a disclaimer: I would have to fire up a VM and walk through this to confirm my answer. I really don't do a heck of a lot with Windows exploits. Looking at that article quickly I believe that you are adjusting the stack so as not to corrupt the current stack frame. When code block that you are leveraging to overwrite the SEH chain returns the function prolog will restore ESP from EBP, allowing execution to resume. Later, when an exception is thrown, your SEH overwrite will give you control.

  • This is not SEH based exploit. it is a simple direct return overwrite. Anyway, Here is what I have found about stack adjustment. But I am not able to grasp the whole concept.BTW, thanks for the great spirit of support and help Jul 14, 2013 at 2:34
  • You may wish to reword the question a bit then. It says, "When practicing an SEH overwrite" which is a bit misleading if you're not actually worried about SEH in your question. ;) Jul 14, 2013 at 2:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .