Data Execution Protection in action

a-foton » Data Execution Protection in action

a-foton » Data Execution Protection in action — Wed, 23 Jul 2008 23:44:37 GMT

PingBack from http://blog.a-foton.ru/2008/07/data-execution-protection-in-action/

re: Data Execution Protection in action

ak — Thu, 24 Jul 2008 10:44:51 GMT

I hate it when blogs protect the 3rdpart like this. There are better ways to hook process creation, tell me the name of the 3rd party so I can avoid their stuff

[We don’t call out 3rd party software by name, since often the bug in question has already been fixed, and we don’t want to needlessly give that vendor a bad reputation. All software has bugs, and the point of our blog isn’t to call out which vendors had what bugs.]

re: Data Execution Protection in action

John Hall — Thu, 24 Jul 2008 11:00:14 GMT

So what was the 3rd party DLL possibly doing that caused it to try and execute code from its Initialized Data section?

[The DLL was probably generating small amounts of code during runtime, and storing those in global variables. This was a problem with older versions of ATL/MFC, which wrote small Thunking stubs at runtime. (see http://support.microsoft.com/kb/948468) But, the only way to do this safely with DEP in the picture is to use VirtualAlloc and then Virtual Protect to grant PAGE_EXECUTE access.]

Interesting Links – 7/25/2008

Matt Johnson's Technical Adventures — Fri, 25 Jul 2008 17:39:23 GMT

You Had Me At EHLO... : Where does the time go? -519 Jet_errLogSequenceEnd Microsoft Advanced Windows

re: Data Execution Protection in action

Myth — Thu, 07 Aug 2008 11:56:10 GMT

I like this type of article. Showing us the real world problem and the process to solve it. Thank you for the Aritcle