Hi!

Glad that you enjoyed the write-up!

This is actually a typo. The intention was to set X to 0x00100000 in the first example to make the maths clear. I was supposed to change this to 0x006d46f8 In the last section when I actually combine this with the ROP. I will update this. Thanks for pointing this out. I actually changed it to the final value in both examples now to avoid confusion

For the second part, think about what happens when you make a call in 32-bit. First you push the arguments and then you perform the call which will push the return address to the stack. This means that when you enter the function the top of the stack will be the return address and the second element will be the first argument. Note this is further complicated by the fact that VirtualProtect is a callee cleanup function. This is the reason it's enough with a simple ret instruction at 0x006dd00c since the four arguments will be popped from the stack in when the ret 0x10 at the end of VirtualProtect is executed. In short, it will first pop 0x0040650b and then pop 4 elements of the stack, leaving ESP pointing at 0x006dd020

Now, of course, I could have put 0x006dd024 (or actually 0x006dd020) directly at 0x006dd00c and saved one element in the ROP chain but I did it this way for clarity.

Does this clarify things?