Why do I see a filler being used in some exploits?

Take as an example the code below:

exploit = junk + eip + nops + shellcode

fill = "\x43"*(BUF_SIZE-len(exploit))
buf = exploit + fill

I guess the buffer is the max number of byte we can send to the stack..our exploit could be smaller than that so we add a filter to make it more stable? Is it recommended? Can we just do without a filler?

  • "Why do I see a filler being used in some exploits?" - I am interested in examining real examples of this. If you could provide links to such examples it would be appreciated – julian Nov 17 '17 at 1:10
  • @SYS_V see here for an example shogunlab.com/blog/2017/08/19/zdzg-windows-exploit-1.html – Fabio Nov 18 '17 at 8:34
  • 1
    Sometimes you need to have a certain length of payload in order to trigger the vulnerability. if you have enough space that you can have your shellcode in a simple payload and even then you have some space left to trigger the vulnerability you add more junk to it in the last. Although I don't think it was needed here in this case cause you've already overflown to eip. as @SYS_V already mentioned, such cases are actually very rare. – sudhackar Dec 21 '17 at 9:51

Your Answer


Browse other questions tagged or ask your own question.