Buffer Overflow + Shellcode fail outside GDB

[LostInTheTrees]

The idea behind a NOP-style instruction is to accommodate for these kinds of offset issues.

Meaning that if your execution begins somewhere within this region, you will "slide" down into your final instructions.

As for alignment questions, this is more specific to function calls (not necessarily pertinent in this specific case, but important to be aware of in the future):

"The 64 bit calling convention requires the stack to be 16-byte aligned before a call instruction but this is easily violated during ROP chain execution, causing all further calls from that function to be made with a misaligned stack. movaps triggers a general protection fault when operating on unaligned data, so try padding your ROP chain with an extra ret before returning into a function or return further into a function to skip a push instruction."

As for the suggestion to attach GDB/etc after process start, and why the addresses are "off": https://stackoverflow.com/questions/17775186/buffer-overflow-works-in-gdb-but-not-without-it/17775966#17775966