Lets say I can control the EIP CPU Register, and I want to jump to a specific function of which I know the correct memory address. This address is inside the same memory page. We have no exploit mitigations enabled. Can I then just pass the memory address of the function to jmp and load that into EIP?
Yes, but be warned:
- All function gets its parameters in the stack, or sometimes in registers. Probably you don't know, which params and where will it get. Maybe you will need a little bit play if you won't and early crash at the begin.
- The return of a function is on the stack, but sometimes they are in registers. It is very sure, that the process will die after the hooked code.
If you are working on a hook, then make sure that ESP and the registers will be set back after your hook.
Maybe you can have problem if there is some like address space randomization feature, which makes the address of the function problematic to find.