linux - Findout address of shellcode dynamically, placed on stack -

i using shellcode spawn shell,i curious findout starting address of shellcode dynamically,which placed on stack , not hard code address in shellcode kindly share ideas ? have gone through smashing stack fun , profit ,however curious know how codered worm or morris worm figures out address of shellcode dynamically

you can find gadgets you.

if find set of gadgets result in 1 of registers containing starting address of shellcode, need 'jmp eax'(assuming address in eax) execute shellcode.

you'll have overwrite saved eip address of first gadget though.

hope helped