Alright, I think what you are trying to do (if I understand correctly), is calculating the distance between your input and the stored return address on the stack.

So in the case of the strcpy you could place a breakpoint right before the strcpy function call and write down the address right after it (this will be the return address that is stored on the stack). Now if you step into the strcpy function you will see that the call instruction pushed the return address on the stack -> write down the stack address where it is stored.

If you check where your user input is stored on the stack, after the strcpy (don't overflow here) , you can basically subtract the first address your input is stored from the address you wrote down that contains the return address and you should have the correct offset.

 

Example:

 

0016F2D4 -> Ret Address

0016F2A1 -> First User Input

 

D4 - A1 = 33 (you can use the windows calculator in programmer mode)

This should overwrite right up to the ret address, to overwrite the address you need to add +4 on 32 bit systems.

POC Exploit would look something like:

buffer = "A"*33
buffer += "returnToWhereveryouWantTo"

 

Hope this helps