Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was reading about return-to-libc attacks at Wikipedia.

According to what I read and understood from the article, ASCII armoring means that binary data is converted into ASCII values by grouping them into 8-bit chunks.

The article quotes:

Indeed, with ASCII-Armoring, all the system libraries (e.g. libc) addresses contain a NULL byte. Nevertheless, this same concept can be used in a similar and more advanced attack known as return-to-plt, where instead of returning to libc, the attacker uses the PLT functions loaded in the binary (e.g. system@plt, execve@plt, sprintf@plt, strcpy@plt, etc...).

Can someone please explain, how exactly does ASCII armoring prevent buffer overflow? I didn't get the part where it says, that system library addresses contain a NULL byte. And how does return-to-plt prevent buffer overflow? I searched, but didn't find much explanation regarding return-to-plt attacks.

share|improve this question
This is a great article by David Wheeler that should answers all your questions: Secure programmer: Countering buffer overflows. Use of ASCII armor region is explained in the "Non-executing stack defenses" chapter. ;) – TildalWave May 25 '13 at 15:19
^ Updated link: – Aneesh Dogra May 19 at 16:33

If the address is getting treated as a null terminated character string at some point, inclusion of this "ASCII-Armored" address would cause functions that work with null terminated character strings such as, strcpy, strlen, sprintf to stop processing at the end of the libc address.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.