Defeating DEP and ASLR.pdf

(1272 KB) Pobierz
Your texte here ….
Defeating
DEP
and
ASLR in Windows
ORIGINAL SWISS ETHICAL HACKING
©2011 High-Tech Bridge SA – www.htbridge.ch 
What is DEP?
Your texte here ….
•
•
Data Execution Prevention (DEP) is a set of hardware and software technologies
It performs additional checks on memory to help prevent malicious code from running on a
system
ORIGINAL SWISS ETHICAL HACKING
©2011 High-Tech Bridge SA – www.htbridge.ch 
Hardware-enforced DEP
Your texte here ….
•
•
•
•
•
•
•
•
Hardware-enforced DEP causes an attempt to transfer control to an instruction in a
memory page marked as “no
execute”
to generate an access fault.
Relies on processor hardware to
mark memory
with an attribute that indicates that code
should not be executed
from that memory region
DEP functions on a per-virtual memory page basis, usually changing a bit in the page table
entry
(PTE)
to mark the memory page
The actual hardware implementation of DEP and marking of the virtual memory page varies
by
processor architecture:
The no-execute page-protection
(NX)
processor feature as defined by AMD
The Execute Disable Bit
(XD)
feature as defined by Intel.
To use these processor features, the processor must be running in Physical Address Extension
(PAE) mode.
Windows will automatically enable PAE mode to support DEP.
ORIGINAL SWISS ETHICAL HACKING
©2011 High-Tech Bridge SA – www.htbridge.ch 
Intel Hardware-enforced
Your texte here ….
DEP
ORIGINAL SWISS ETHICAL HACKING
©2011 High-Tech Bridge SA – www.htbridge.ch 
AMD Hardware-enforced DEP
Your texte here ….
ORIGINAL SWISS ETHICAL HACKING
©2011 High-Tech Bridge SA – www.htbridge.ch 

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin