New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

Windows Vista » New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows …

Wed, 30 Jan 2008 05:56:24 GMT

PingBack from http://www.windows-vista.luiscorreia.com/new-nx-apis-added-to-windows-vista-sp1-windows-xp-sp3-and-windows/

Couple of good posts

David LeBlanc's Web Log — Wed, 30 Jan 2008 07:31:00 GMT

The SDL blog has some good comments - http://blogs.msdn.com/sdl/archive/2008/01/29/sexy-development-lifecycle.aspx

Couple of good posts

Noticias externas — Wed, 30 Jan 2008 08:31:47 GMT

The SDL blog has some good comments - http://blogs.msdn.com/sdl/archive/2008/01/29/sexy-development-lifecycle

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

Curt Nichols — Wed, 30 Jan 2008 19:06:38 GMT

> an older version of the Abstract Type Library (ATL.)

a.k.a. (by most of us) Active Template Library.

Thanks for an informative article.

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

Tim — Wed, 30 Jan 2008 19:25:35 GMT

What about Windows 2k3? Are there plans for a service pack to add this functionality there as well?

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

IronGutsMorla — Wed, 30 Jan 2008 22:47:56 GMT

Why provide the option to disable it? it seems that makes easier the job of shellcode exploits.

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

michael_HOWARD — Thu, 31 Jan 2008 00:13:09 GMT

Curt, you are 100% correct - I will correct the name.

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

michael_HOWARD — Thu, 31 Jan 2008 01:59:37 GMT

IronGuts

If you're running shellcode, then you must have already defeated NX!!

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

jenny — Thu, 31 Jan 2008 11:25:27 GMT

@IronGutsMorla

all Windows components have DEP enabled, so this doesn't affect the security of Windows. Only 3rd party applications can break DEP security

Does DEP/NX affect web applications?

Notes from a dark corner — Fri, 01 Feb 2008 13:22:45 GMT

A while a go when I posted about the .NET Framework 3.5 and 2.0 SP1 being available for download, Kima

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

o.s. — Fri, 01 Feb 2008 22:54:53 GMT

Michael your One Caveat section was something I found truly disturbing. You mentioned three distinct error condtions there and the system actually only responds with one single code. Error 5 (Access Denied)!

Hey you work at Microsoft can't you just reach out and smack the developers in the head and have them at least attempt to use error messages and codes that are SPECIFIC to the error condition that actually occurred? :-)

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

stefan demetz — Sat, 02 Feb 2008 02:05:14 GMT

Nice, but the APIs missing in Windows are the ones to patch the system i.e. to force downloads of Emergency (critical/wormable ones with an exploit in the wild) or Critical patches

Patching APIs would make a HUGE difference in how systems are protected as they could be called by installers (even third party ones) or system management software ...

or even tempt people to write inoculating viruses (vaccines);-)

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

michael_HOWARD — Sat, 02 Feb 2008 17:47:52 GMT

stefan, updating is built into the OS, it's not an app thing. that's why we default new OSs to check for updates every 24hrs

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

michael_HOWARD — Sat, 02 Feb 2008 17:48:59 GMT

o.s. - *THINK* the issue relates to the granularity of the underlying APIs, it has a fixed set of errors, and Err5 is one.

Windows Vista SP1 - ultime novità

Security & Architecture — Mon, 04 Feb 2008 16:50:04 GMT

Per faciliare la pianificazione di un corretto processo di update di Vista oggi Renato, sul blog di Technet

Windows Vista SP1 - ultime novità

Noticias externas — Mon, 04 Feb 2008 17:30:47 GMT

Per faciliare la pianificazione di un corretto processo di update di Vista oggi Renato, sul blog di Technet

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

antivirus — Sat, 16 Feb 2008 15:54:56 GMT

Thank You For Sharin very inforamtive materials with us

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

Chris — Wed, 20 Feb 2008 21:34:49 GMT

There are other libraries besides old ATL that use thunking. For instance, our app is build with OWLNext which uses thunking for windows in a way similiar to ATL. Is there a way to turn on DEP but allow these specific thunks to work?

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

Chris — Fri, 29 Feb 2008 16:00:19 GMT

I have DEP problems with Server 2003 Enterprise. Is there a possiblility to get the current state of DEP-settings (via an alternative way for GetProcessDEPPolicy / GetSystemDEPPolicy)?

We use a translation tool that modifies the address/code of LoadResString and at that point our program is being kicked without exception.

When the program is in the list it works fine.

But that is not acceptable for clients. They shall know what went wrong...

Any hint would be welcomed.

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

Igor Levicki — Mon, 03 Mar 2008 08:51:49 GMT

1. Error code should be invalid parameter or something, not access denied.

2. NX/DEP can be easily defeated.

http://www.techweb.com/wire/security/166403451

NX = wasted silicon.

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

IronGutsMorla — Fri, 07 Mar 2008 23:51:58 GMT

"'If you're running shellcode, then you must have already defeated NX!!"

Not really, in return to libc attacks you are not there yet. If you can change the return address to point to this function you can disable NX in one more convenient way than before. It would be a two stage attack of course.

maybe we can go from other side, what cases does it support flipping this flag over and over?

re: New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

Peter Westerström — Tue, 08 Apr 2008 01:25:09 GMT

I'm getting a bit confused about the flag PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION.

If I have an ATL application using old ATL, shall I set flag to PROCESS_DEP_ENABLE | PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION or PROCESS_DEP_ENABLE only?

IE8 Security Part I: DEP/NX Memory Protection

IEBlog — Tue, 08 Apr 2008 21:00:43 GMT

Hi, I’m Eric Lawrence from the Internet Explorer Security Team. With the RSA security conference kicking

The Weekly Source Code 33 - Microsoft Open Source inside Google Chrome

ASPInsiders — Fri, 12 Sep 2008 10:45:54 GMT

First, let me remind you that in my new ongoing quest to read source code to be a better developer ,

GOOG Chrome's use of NX/DEP

Michael Howard's Web Log — Mon, 15 Sep 2008 17:20:10 GMT

Scott Hanselman has a look under Chrome's hood and how it uses the new NX/DEP APIs we added to Windows

/DYNAMICBASE and /NXCOMPAT

Visual C++ Team Blog — Thu, 21 May 2009 18:49:13 GMT

Hello, my name is Xiang Fan and I am a developer on the C++ Shanghai team. Today I’d like to talk about

メモリ保護 ( DEP/NX Memory Protection ) 機能の IE7 と IE8 の違い

Windows 開発統括部 Blog — Tue, 02 Jun 2009 11:15:12 GMT

こんにちは、五寳です。 IE7 から実装されているメモリ保護 ( DEP/NX Memory Protection ) の機能ですが、IE8 からは (条件がそろえば) デフォルトで有効になっています。