Removing null bytes from shell code

Question

I am learning the basics of shell coding so that I can learn to exploit buffer overflows. The problem is, the example byte code that I wrote contains null bytes. Here is the example:

xor    %edi,%edi      >       31 ff         
mov    $0x3c,%eax     >       b8 3c 00 00 00          
syscall               >       0f 05   

Bytecode : "\x31\xff\xb8\x3c\x00\x00\x00\x0f\x05"

What are some common techniques used to eliminate null bytes? I heard that people use encoders for this sort of thing but I cannot find any great resources on this.

Answer 1

mov can be replaced by push and pop. So eg this:

mov    $0x3c,%eax

Can become this:

push $0x3c
pop %eax

Which would give you this null byte free code:

   0:   31 ff                   xor    %edi,%edi
   2:   6a 3c                   push   $0x3c
   4:   58                      pop    %eax
   5:   0f 05                   syscall