Null-free shellcode is a type of shellcode that has to avoid any null byte to be able to fit a null-terminated string buffer. Authors of this shellcode have to change the way they write their code. Let's take a look at an example.
For the call/pop instructions that we described earlier, they will be assembled into the following bytes:
Figure 4: call/pop in OllyDbg
As you can see, because of the relative addresses the call instruction uses, it produced 4 null bytes. For the shellcode authors to handle this, they need the relative address to be negative. It could work in a case like this:
Figure 5: call/pop in OllyDbg with no null bytes
Here are some other examples of the changes the malware authors can make in order to avoid null bytes:
| Null-byte instruction | Binary form | Null-free instruction | Binary form |
| mov eax,5 | B8 00000005 | mov al,5 | B0 05 |
| call next | E8 00000000 | jmp next/call prev | EB 05/ E8 F9FFFFFF |
| cmp eax,0 | 83F8 00 | test eax,eax | 85C0 |
| mov eax,0 | B8... |
