Using a buffer overflow, I have been able to override return addresses. But the problem is that Windows addresses contain zeros at the beginning (e.g. 0x00401020
). As a result, the objdump of any C binary will contain zero's. This makes it very difficult to execute shellcode inside a buffer as a shellcode cannot contain zero's for it to work.
Has anyone done this sort of thing? It does not matter even if the exploit is printing hello-world: is it possible?
Objdump
a *nix utility? What happens if you used a Windows-specific debugger?strcpy
vulnerability? There are many ways of getting buffer overflows, and only strcpy is going to care about null bytes in the payload, but you should have specified anyhow.