I'm trying to exploit a strcpy() buffer overflow vulnerability to test ROP attack. I found a very useful gadget at address 0x0000f26c so I am obliged to insert null bytes to the stack to override the return address of the vulnerable function. For the moment I failed doing this because strcpy() uses 0x00 as a string terminator.
Is there any other method to do this?