In the code above, gets$($str$)$ stores the user input into a buffer str while it does not check the boundary of the buffer. Now the attack string is composed of three parts from lower address to higher address: $1.$ padding, $2.$ address to overwrite the return address of main$(),$ and $3.$ attack code $($payload$).$ The address to overwrite the return address of main$()$ is the address of a jmp esp instruction.

When the attacker runs the victim program, feeds the attack string into gets$()$ and then main$()$ returns $($i$.$e$.,$ the last line of main$()$ has been executed$),$ the stack pointer register esp contains