ARM instructions are usually 32-bit instructions. However, many shellcodes switch to Thumb Mode, which sets the instructions to be 16 bits only and reduces the chances of having NULL bytes. For the shellcode to switch to Thumb Mode, it needs to set the least significant bit of the pc register to 1, which means that the pc register needs to have an odd value. To do this, the shellcode can execute the following instruction:
add r3, pc, #1
After executing this, all instructions switch to the 16-bit mode, which reduces null bytes significantly. By using svc #1 instead of svc #0 and avoiding immediate null values and instructions that include null bytes, the shellcode can reach the null-free goal.
When analyzing ARM shellcode, make sure that you disassemble all the instructions after the mode switch as 16-bit rather than 32-bit.
Now that we have covered Linux shellcode for Intel and ARM processors, let's take a look at Windows shellcode.