> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfnote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfnote/red-teaming/buffer-overflow/step-5-finding-the-right-module.md).

# Step 5: Finding the Right Module

JMP ESP

Find a JMP ESP gadget using Mona:

```
!mona jmp -r esp -cpb "<badchars>"
```

Go to "Log" by pressing Alt+L. Mona finds 9 gadgets and we can pick any gadget in this case:

![JMP ESP](https://3988450783-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWVjG_njKgBtvmnKaJh%2F-MgHIIyLC2M_QBO4GCzr%2F-MgHMeSJQSt9TaKMH258%2Fimage.png?alt=media\&token=ed5a1880-7fe7-446b-af6e-802eec95bcee)