Suppose I have shellcode injected into the memory of a process, which way will the shellcode get executed? Assuming higher memory addresses are on bottom of stack and lower memory addresses are on top of stack, does the shellcode run from lowest memory address of shellcode to highest memory address of shellcode or the other way round?
The program counter (aka instruction pointer) typically moves from lower to higher memory addresses (except for branches and function calls/returns of course).