Has anyone gotten this to work on windows xp sp2 english? I have tried several times to find good pop pop ret addresses but it still never lands in the shellcode. I set break points for it to hit my return add of a pop pop ret, it does, but I still am not getting it to trigger. I am overwriting SEH like I am supposed to but still nothing. I even analyzed the Metasploit exploit and it still doesn't work. Anyone have some suggestions?