With regard to the question: How does ASCII-Armoring help to prevent buffer-overflow attacks?:
How does the armored region prevent an attack?
If the most significant byte of the return address is
0x00 then the attacker may still change it because it is the last byte that she writes into the buffer.
For example: assume that
libc:execve resides in
0x00b1ab1a, now having the option to override the
ret of the function, the attacker can fill the last 4 bytes with
0x1a 0xab 0xb1 0x00 (i.e. where the
NULL is the last byte) so the instruction pointer redirection is indeed damaged and goes to
Am I wrong?