Now, I understand all the theory behind the exploit: the shellcode[] is in the data segment (which is writable), and contains the code to spawn a shell. We would like to copy its content to main's buffer, in addition to overwrite main's return address to the beginning of the buffer (so that the execution control will be of our "spawning a shell" code. We do it by coping the shellcode to the large_string[] buffer (second for-loop), and the rest(. ) of large_sting[] will contain the buffer's address (first for-loop). Of course, main's return address will be overwritten by this buffer's address, since we copy large_string[] to buffer[] ( strcpy ). My problem is with the little details of the exploit: 1.) Why does the first for-loop is from i=0 to i=31 ? I mean, considering the pointer arithmetic, how does it work? [ large_string[] is only 128 bytes] 2.) What is srlen(shellcode) ? I would some clearing on that kind of stuff. Thanks!