I am new to structured exception handling based exploits.
Why don't we put our return address directly in SE handler to jump to our shellcode? (with no safe SEH)
Can anybody explain the reason of using pop pop ret?
I read something that said SEH bypasses ASLR and DEP, but how?
Our shellcode will be located on the stack and since the stack will be still non-executable, how is DEP bypassed?