Bad Character Comparator – Find Exploit Bad Characters
Find the bad characters that mangle or truncate your shellcode. Generate a non-repeating run of every byte value, send it, then paste the crashed memory dump – this tool aligns what you sent against what survived (LCS, so it handles truncation and expansion), tells you the exact bad bytes, and hands you a fresh test string with them removed. Runs entirely in your browser. It is the mona compare workflow without Immunity Debugger.
1. Generate the test bytes
Send this non-repeating run of every byte value as your buffer, then look at
how it survived in memory. Null (00) is excluded by default because it almost
always truncates.
2. Compare what came back
Paste the bytes you sent and the memory dump from the crashed register/buffer. It aligns them and tells you the first corrupted byte plus every suspect.
How to use it
Generate above and send that run (after the offset) as your payload, then crash the target.
In the debugger, dump the bytes where your buffer landed (for example db esp).
Paste both. Remove the flagged byte, regenerate, and re-test until the buffer arrives intact.
Why this one
Survives truncation and expansion, not just a naive position-by-position diff.
Outputs a fresh byte run with the found bad chars removed - ready to send.
Reads x64dbg / WinDbg / mona dumps directly; no hand-cleaning.
The mona compare workflow, in any browser, offline.
FAQ
What is a bad character?
A byte the target mangles, drops or truncates in transit (often 00, 0a, 0d). Find them so your shellcode arrives intact.
Why generate 01 to ff?
Sending every byte value at once lets you spot exactly which ones get corrupted in a single crash.
Is this like mona's compare?
Yes - same workflow (compare sent vs dumped, list bad chars, iterate), but fully client-side and without Immunity Debugger.