I'm running into a challenge where I have control over the return address and the base pointer through my input, however the program null byte terminates and the addressing scheme only takes up 6 bytes. I'm using leave gadget to control the stack pointer and I'm looking for a gadget to null out the left two bytes. I do not control any other registers.
Current RBP/RSP: 0x11117fffffede0
Desired RBP/RSP: 0x00007fffffede0
Exploit Code:
'A'*50 + 'B'*50 + rbp + return
Any ideas? I'm not seeing any XOR gadgets or shift gadgets.
