title: Write buffer overflow exploit -- how to figure out the address of the shellcode?
body: <p>When writing buffer overflow exploit, I understand that I'll need to input an array of length (address_of_return_address - address_of_buffer). And the array needs to be filled with the address of the shellcode. So that when my input array overflows, it overwrites the saved return address with the address of the shellcode.</p>
  
  <p>I think since the shellcode will be stored above the saved return address on the stack, its address should be address_of_return_address + the distance to the beginning of the shellcode.</p>
  
  <p>Am I on the right track? If so, how should I figure out the distance between the saved return address and the distance to the beginning of the shellcode using GDB?</p>