title: How can I find where main()'s return address is sitting in the stack?
body: <p>I need to do a remote a buffer overflow exploit for a class. I understand MOST of it. It involves overwriting main's return address so I can execute my own code. 
  But we never covered how to find the location of the return address in memory...
  I keep getting it wrong and the exploit isn't working :(</p>
  
  <p>I'm sitting in gdb and I have my buffer's address (0xbffff3dc)</p>
  
  <p>Now, I need to find out where in the stack the return address is sitting (so I can find out the offset between it and my buffer).</p>
  
  <p>Then I'll know how much space I have to add:</p>
  
  <ul>
  <li>a NOP (0x90) "sled"</li>
  <li>my shellcode</li>
  <li>more NOPs ???</li>
  <li>the address for my buffer (overwriting the return address)</li>
  <li>"\r\n" ???</li>
  </ul>
  
  <p>^ I'm not sure whether the things marked "???" are completely necessary.</p>