I am learning the basics of shell coding so that I can learn to exploit buffer overflows. The problem is, the example byte code that I wrote contains null bytes. Here is the example:

xor    %edi,%edi      >       31 ff         
mov    $0x3c,%eax     >       b8 3c 00 00 00          
syscall               >       0f 05   

Bytecode : "\x31\xff\xb8\x3c\x00\x00\x00\x0f\x05"

What are some common techniques used to eliminate null bytes? I heard that people use encoders for this sort of thing but I cannot find any great resources on this.


1 Answer 1


mov can be replaced by push and pop. So eg this:

mov    $0x3c,%eax

Can become this:

push $0x3c
pop %eax

Which would give you this null byte free code:

   0:   31 ff                   xor    %edi,%edi
   2:   6a 3c                   push   $0x3c
   4:   58                      pop    %eax
   5:   0f 05                   syscall
  • 1
    you can also use the lowest register: mov 0x3c, %al
    – Yvain
    Feb 5, 2018 at 9:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .