Where Shellcode Lives and How It Runs

• Getting bytes into memory is only half the job — execution must reach them.
• Common placements:
• On the stack, inside the overflowed buffer itself.
• In an environment variable (predictable-ish address, larger space).
• In a heap buffer or any attacker-controlled region.
• Reaching it: overwrite a saved return address (or a function pointer) so control flow jumps into the shellcode.
• Imprecise landing addresses are bridged with a NOP sled — a run of 0x90 that "slides" into the payload.