2

I'm learning exploit development and while writing an encoder i was wondering what was the root cause of "bad chars" ?

The only explaination i could think of is that, in the case of a buffer overflow, there are changes/operations being done on the buffer between the input and the moment i access it.

This explaination is way too vague to be correct, there must be an other reason for requiring only a small subset of characters in those cases.

I'd appreciate someone pointing me to a more satisfying answer. Thanks!

Improve this question
2
  • 2
    More clarification is needed to answer the question. Where are you seeing the error?
    – John Deters
    Commented Apr 2, 2019 at 12:34
  • After overflowing a SEH with the address of a pop+pop+ret and using short jump to get a buffer i control i'm having to write a custom encoder because some bytes (like x0C or x4F) get changed. I know how to circumvent this problem but i don't know why, oftentimes, i'm having to search for badchars and write my exploit accordingly.
    – Tohm Sawyer
    Commented Apr 2, 2019 at 13:02

1 Answer 1

Reset to default
2

There is not a universal root cause for bad characters in exploit paylods. What is considered a bad character in one buffer is not considered a bad character in another buffer, unless that character is a NULL byte since that is almost always a bad character when dealing with C strings.

Whats considered a bad character is very dependent on the application (and function) you're specifically looking at. Anything which can be thought of as a "control" character (characters which influence how something is parsed) - for example \r in HTTP would likely be considered a "bad character".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .