This is a relatively easy task. Here, the shellcode abuses the call instruction, which takes a relative address to where it should branch to and saves the absolute return address in the stack (which the shellcode can get using the pop instruction).
An example of this is as follows:
call next_ins:
next_ins:
pop eax ; now eax has the absolute address to next_ins
After getting the absolute address, the shellcode can get the address of any data inside the shellcode, like so:
call next_ins:
next_ins:
pop eax ;now eax has the absolute address to next_ins
add eax, data_sec – next_ins ;here, eax has the address to data section
data_sec:
db ‘Hello, World',0
Another common way to get the absolute address is by using the FPU instruction fstenv. This instruction saves some parameters related to the FPU for debugging purposes, including the absolute address of the last executed FPU instruction. This instruction could be used like...
