Constraint 2: Bad Bytes (Null-Free)

• Overflows are often triggered through string functions like strcpy, gets, or sprintf.
• A C string ends at the first null byte (0x00), so a null in the middle of the payload truncates it.
• Therefore classic stack shellcode must be null-free.
• Other "bad characters" depend on the input path:
• 0x0a (newline) for line-based input.
• 0x0d, 0x20, or protocol-specific delimiters.