5

I am learning the basics of shell coding so that I can learn to exploit buffer overflows. The problem is, the example byte code that I wrote contains null bytes. Here is the example:

xor    %edi,%edi      >       31 ff         
mov    $0x3c,%eax     >       b8 3c 00 00 00          
syscall               >       0f 05   

Bytecode : "\x31\xff\xb8\x3c\x00\x00\x00\x0f\x05"

What are some common techniques used to eliminate null bytes? I heard that people use encoders for this sort of thing but I cannot find any great resources on this.

4

mov can be replaced by push and pop. So eg this:

mov    $0x3c,%eax

Can become this:

push $0x3c
pop %eax

Which would give you this null byte free code:

   0:   31 ff                   xor    %edi,%edi
   2:   6a 3c                   push   $0x3c
   4:   58                      pop    %eax
   5:   0f 05                   syscall
| improve this answer | |
  • 1
    you can also use the lowest register: mov 0x3c, %al – Yvain Feb 5 '18 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.