WCU / Cybersecurity
~/CSC 472/Class 04/KP 05
Class 04 · KP 05 / 18

Avoiding Null Bytes: A Small Example

  • Loading a register with a small value the naive way embeds nulls.
  • A common idiom clears a register with xor, which encodes without null bytes.
; mov rax, 59  -> may assemble with zero bytes in the immediate
; Null-free idiom to set a small value:
xor    rax, rax     ; rax = 0            (encodes as 48 31 c0)
mov    al, 59       ; rax = 59 (0x3b)    (only the low byte set)
Key Takeaway

Zeroing with xor and writing only the low byte register (al) is a standard way to keep bytes null-free.