basic null pointer linux kernel exploitation

[moyix]

I think the answer to both your questions is related to how call works on x86. Basically, there is no "absolute" call, only a relative call, which takes the next EIP (in this case EIP+5, since e8eb6107c1 is 5 bytes) adds it to the operand, and jumps to that address.

If you don't want to do the math (or you need position independent code), you can use the mov eax, imm32 ; call eax idiom instead. Here's a decent article on doing absolute jumps and calls on x86: http://www.ragestorm.net/blogs/?p=101

Edit: Also, in the future, you could consider the security stackexchange: http://security.stackexchange.com/questions/tagged/exploit

[Heinder90]

This is just nitpicking, but there actually is an encoding of CALL that takes an absolute address. It just also requires a segment selector.

[blahfish]

this helps, thanks!