I'm learning exploit development and while writing an encoder i was wondering what was the root cause of "bad chars" ?

The only explaination i could think of is that, in the case of a buffer overflow, there are changes/operations being done on the buffer between the input and the moment i access it.

This explaination is way too vague to be correct, there must be an other reason for requiring only a small subset of characters in those cases.

I'd appreciate someone pointing me to a more satisfying answer. Thanks!

  • 2
    More clarification is needed to answer the question. Where are you seeing the error? Apr 2, 2019 at 12:34
  • After overflowing a SEH with the address of a pop+pop+ret and using short jump to get a buffer i control i'm having to write a custom encoder because some bytes (like x0C or x4F) get changed. I know how to circumvent this problem but i don't know why, oftentimes, i'm having to search for badchars and write my exploit accordingly. Apr 2, 2019 at 13:02

1 Answer 1


There is not a universal root cause for bad characters in exploit paylods. What is considered a bad character in one buffer is not considered a bad character in another buffer, unless that character is a NULL byte since that is almost always a bad character when dealing with C strings.

Whats considered a bad character is very dependent on the application (and function) you're specifically looking at. Anything which can be thought of as a "control" character (characters which influence how something is parsed) - for example \r in HTTP would likely be considered a "bad character".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.