I've done badchars analysis, badchars are "\x00\0a\x0d". The weird thing is, If the ret address contains null, it still works anyway. The amp.exe is the only module that we can use to make the exploit reliable across platform. Any suggestions on this?