2

With regard to the question: How does ASCII-Armoring help to prevent buffer-overflow attacks?:

How does the armored region prevent an attack?

If the most significant byte of the return address is 0x00 then the attacker may still change it because it is the last byte that she writes into the buffer.

For example: assume that libc:execve resides in 0x00b1ab1a, now having the option to override the ret of the function, the attacker can fill the last 4 bytes with 0x1a 0xab 0xb1 0x00 (i.e. where the NULL is the last byte) so the instruction pointer redirection is indeed damaged and goes to libc:execve.

Am I wrong?

2

If the most significant byte of the return address is 0x00 you can still redirect the execution to execve in your example but you can't specify any arguments because they have to be after the address of execve. But this is impossible if the overwrite stops at 0x00. So the power of an attacker is very limited.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.