I'm studying the basics of making shell codes. I have a question about it.
In my textbook, the author stores his shell code in an environment variable, and injects the address of it using
strcpy() in a program.
When he makes his shell code, he removes null bytes. He says that this is because
strcpy() will stop at null bytes.
However, I think, because
strcpy() just gets the address of the environment variable (storing his shell code), if his shell code has null bytes, it doesn't matter. I think that his goal is to change the return address into the path of environment variable.
In the textbook, a shell code which has null bytes doesn't work in this situation, but a null-free shell code does.
I can't understand the reason why we need to remove null bytes in this situation.