Vulnerability Development: Shell code -RVA techniques or something similar

["Gary O'leary-Steele" <garyo () sec-1 com>]

Hi,

I am looking for documentation/tutorial on writing shell code for Windows.
Specifically using RVA techniques or something similar to make my shell code
service pack independent.


The problem I am experiencing is that all the exploits I have written in the
past use fixed addresses within Kernel32.dll such as the offset for winexec
or loadlibrarya and getprocaddress. Therefore a variation in service pack
etc causes my exploit to fail.


Thanks in advance.


Kind Regards,

Gary