I was writing an exploit for BOF. The server accepts only ASCII payloads. FInally I wnted to jump to my shellcode which is clearly in the stack. But only one module is available without ASLR and DEP which has address starting from 56566577. I got JUMP ESP, suppose in 5757578E, this doesn't work. Becuase the 0x8E outside the scope of ASCII 0x00 to 0x7F. Consider no other register has the shellcode. How can I deal with certain situations?
To create ASCII shellcode I use below:
msfvenom -p windows/shell_bind_tcp -a x86 -f perl --platform windows LHOST=192.168.1.1 LPORT=8181 -b "\x00" EXITFUNC=seh -e x86/alpha_upper
But this also has character above 0x7F. How can I generate shellcode within 0x00 - 0x7F.