Ok, I was just wondering. When someone writes a new exploit, the shellcode usually looks like

/xff/ca/23/5b/54/ba etc... and bunch of abstract characters and then end (usually) in /x2f/x62/x69/x6e/x2f/x73/x68 (ASCII /bin/sh) . Now before you reply, yes, I know what hex is.

What is was wondering was what all the previous hex stuff was. Is it used to control the EIP or what? And also, how do the shellcoders know what characters to use ? It almost seems like you would have to know machine code to use the correct sequence of characters. I was just musing about this earlier...