The Structured Exception Handling (SEH) is a protection mechanism to prevent the buffer overflows. SEH uses a linked list as it contains a sequence of data records. When an exception occurs, the OS will go through this list and check for the suitable exception function. For this, the exception handler requires a pointer to the current exception registration record (SEH) and another pointer to the next exception registration record (nSEH). As the Windows stack grows downwards, the order will be reversed:
So, if we can overwrite the SEH with a POP POP RETN instruction, the POP will remove four bytes from the top of the stack and the RETN will return an execution to the top of the stack. As the SEH is located at esp+8, we can increment the stack with eight bytes and return to the new pointer at the top of the stack. Then we will be executing nSEH. So...
