Right after the ROP NOP that is just junk, I replaced it with random text. But it seems there must be some NOP padding after the ROP chain before the actual payload to make it work, otherwise there will be an access violation.