> Since you don't have direct control of the instruction pointer this way, there's some complexity in loading shellcode somewhere and having the process return to it to get it to usefully execute your code, much like an actual stack-corruption exploit.)

The readme states that the (primary) shell code is written at the EIP location, so no return hijacking is required.