Bad Character Filtering Bypass

Updated 13 Sep 2026

•
What it is
- •
  Re-encode an input or instruction so the delivered bytes avoid a filter's forbidden values without changing the intended operation.
•
How it works
- •
  Substitute instruction encodings that don't happen to contain the forbidden byte: xor reg, reg instead of mov reg, 0 (avoids the embedded 0x00), narrower register forms to drop unwanted prefix bytes, or building a target constant piecewise via shifts/arithmetic instead of one literal immediate.
•
When to use it
- •
  An explicit byte filter or an input routine constrains what arrives. Check the actual routine: null termination and newline/whitespace handling differ.
•
Examples
- •
  Avoid null bytes when zeroing eax: use xor eax, eax instead of mov eax, 0.
- •
  If 0x48 is forbidden, use 32-bit forms where suitable to avoid REX.W. Preserve full-width pointers when their upper bits matter.

pwntools

banned = {0x00, 0x48}
assert not (set(shellcode) & banned)

x/20xb $rip  # Inspect raw bytes.
x/10i $rip   # Compare with decoded instructions.