Identifiy The BufferOverflow Character

Once identified the offset, produce a char list using Metepreter pattern_create.rb (Metasploit-framework/tools/exploit) offset + 100.

run the exploit script with created pattern the use mona to identify the correct offset:

!mona findmsp -distance OFFSET

this will give a response of something like:

contains normal pattern : ... (offset XXXX)