I'm learning exploit development and while writing an encoder i was wondering what was the root cause of "bad chars" ?

The only explaination i could think of is that, in the case of a buffer overflow, there are changes/operations being done on the buffer between the input and the moment i access it.

This explaination is way too vague to be correct, there must be an other reason for requiring only a small subset of characters in those cases.

I'd appreciate someone pointing me to a more satisfying answer. Thanks!

  • 2
    More clarification is needed to answer the question. Where are you seeing the error? – John Deters Apr 2 at 12:34
  • After overflowing a SEH with the address of a pop+pop+ret and using short jump to get a buffer i control i'm having to write a custom encoder because some bytes (like x0C or x4F) get changed. I know how to circumvent this problem but i don't know why, oftentimes, i'm having to search for badchars and write my exploit accordingly. – Tohm Sawyer Apr 2 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.