For demonstration / educational purposes I want to write a simple proof of concept application which uses a buffer overflow to execute code from within this app which is not called normally. I thought something like this:

#include <iostream>
#include <cstring>

void vulnerableFunction(const char* input) {
    char buffer[10];  
    strcpy(buffer, input);
}

void printSomething(){
 std::cout << "This should not be executed" << std::endl;
}

int main() {
    const char* input = "This is a long string that will cause a buffer overflow";
    vulnerableFunction(input);
    return 0;
}

With the input string I want to overwrite the IP and point it to the memory location of the printSomething() method and execute it like this.

So first question: Is this even possible like this?

I analyzed it with the Immunity Debugger and was able to exactly create a string which overwrites the EIP. So I know the offset, the thing missing is to find the exact location of the printSomething() method call. Does anybody have a idea how I could do this?