Hi, are there any techniques to execute the shellcode if the necessary opcodes cannot fit after the return address! the return address is overwritten with an address of "jmp esp"! some says its not possible, is it? TIA -- npguy mailto:npguy at ysgnet.com