I'm practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple
jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout Randomization (ASLR).
I'm now trying to write a Buffer Overflow for Windows 7, where I haven't gotten any system DLL with rebase or ASLR disabled. I can still exploit it, but it won't survive reboot. As such, I'm very much left with opcode from the FTPServer.exe, but they all use low stack addresses (
0x0040xxxx) and they all end with a NULL byte (e.g.
0xCE 11 40 00) and hence terminate my exploit.
What are the options now? Is there a workaround to the NULL bytes in the addresses I want to use? More specifically, I want to know whenever there is an option to use NULL bytes at the end of an address if it is listed as a bad character.