Smashing stack in x86_64

Question

Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in order to overwrite a return address on the stack), then there is a problem that x86_64 addresses contain zero bytes. Is there a workaround for it?

Answer 1

x86_64 is little endian so the mandatory zero bytes come at the end of the address/string and are already present in the existing return address. That means you don't need to write those last few bytes. You might still have problems if there were zero bytes less significant than the most significant non-zero byte. These are best avoided by careful target selection.