Lets say I can control the EIP CPU Register, and I want to jump to a specific function of which I know the correct memory address. This address is inside the same memory page. We have no exploit mitigations enabled. Can I then just pass the memory address of the function to jmp and load that into EIP?

  • You are gooooood :-)
    – peterh
    May 16, 2014 at 17:08
  • sry i dont get that one :)
    – Dirk
    May 17, 2014 at 12:00

1 Answer 1


Yes, but be warned:

  • All function gets its parameters in the stack, or sometimes in registers. Probably you don't know, which params and where will it get. Maybe you will need a little bit play if you won't and early crash at the begin.
  • The return of a function is on the stack, but sometimes they are in registers. It is very sure, that the process will die after the hooked code.

If you are working on a hook, then make sure that ESP and the registers will be set back after your hook.

Maybe you can have problem if there is some like address space randomization feature, which makes the address of the function problematic to find.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .