How can I build ROP chains on 64 bits if my payload is copied through strcpy?

Question

It seems 64 bits adresses must end in two null bytes. But strcpy will copy only one null byte in the entire payload.

Answer 1

You are correct. With strcpy() you can put at most one gadget.

The second null byte is often not a problem, as you often find a null byte there anyway from a previous address or integer.

If you need to put a complete ROP chain, you can check if you can trigger the bug repeatedly and fill the buffer in reverse with strings of decreasing length.