Shell code -RVA techniques or something similar

From: Gary O'leary-Steele (garyo@sec-1.com)
Date: 09/26/02 

From: "Gary O'leary-Steele" <garyo@sec-1.com>
To: <pen-test@securityfocus.com>
Date: Thu, 26 Sep 2002 15:54:25 +0100

Hi,

I am looking for documentation/tutorial on writing shell code for Windows.
Specifically using RVA techniques or something similar to make my shell code
service pack independent.

The problem I am experiencing is that all the exploits I have written in the
past use fixed addresses within Kernel32.dll such as the offset for winexec
or loadlibrarya and getprocaddress. Therefore a variation in service pack
etc causes my exploit to fail.

Thanks in advance.

Kind Regards,

Gary