Hi
I've been trying to change a programs memory to jump to some shellcode, i've got the shellcode in there and have changed some data in the TIB region but the program keeps crash as other code uses that place in memory. I won't beable to overwrite esp,ebp.
I was wondering if anyone know a place with RW access that only gets called by one function,doesn't crash or a better idea how to get eip.

Thanks