Get the Whitepaper called Bypass Start Address Protection. This is part 2 of a 5 part series of papers.
You can download it from the following link: https://packetstormsecurity.com/files/download/160249/code_injection_series_part2.pdf
Source: https://packetstormsecurity.com/files/160249/Bypass-Start-Address-Protection-Code-Injection-Series-Part-2.html