Um. Just curious about a few things, could be way off though. First: Isn't the point of the nop sled to made sure that we have some sort of leeway calculating the relative memory address? so whats the point of putting the ret first if we cant get the exact memory address to write to? Second: The heap goes up toward the stack. How can we write shellcode inside of the stack? The overflow works like this: (excuse my lame ascii art.)
Your way: Address -> nop sled -> shell code
My way: nop sled -> shellcode -> address
heap vars-------><----------stack states
so my question for you is how can we get the stack to return to the address we want if we've overwritten it with gibberish? The stack frame is only there to return to the address we want. I've overwritten it with another address, you've done it with shell code.
If this answers your question great. If not, then as long as I'm misunderstanding what your asking, or what the mechanics of the overflow are, please clarify so that maybe I can.