{"id":24493,"date":"2007-11-16T10:00:00","date_gmt":"2007-11-16T10:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2007\/11\/16\/in-windows-xp-even-when-dep-is-on-its-still-sometimes-off\/"},"modified":"2007-11-16T10:00:00","modified_gmt":"2007-11-16T10:00:00","slug":"in-windows-xp-even-when-dep-is-on-its-still-sometimes-off","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20071116-00\/?p=24493\/","title":{"rendered":"In Windows XP, even when DEP is on, it's still sometimes off"},"content":{"rendered":"

\n\nAs we saw last time<\/a>,\nthere are a variety of ways you can control DEP,\none of which is to turn it on for all system processes.\nBut even if you turn on DEP, it still sometimes turns itself off\ntemporarily.\nIt goes back to those bad versions of ATL.\n<\/p>\n

\nThe application compatibility team found that\nthere were so many programs written with application frameworks\nthat were not DEP-compatible (ATL mostly, but a few others)\nthat nobody would actually enable DEP because the odds were close\nto 100% that there would be some program on the system that was\nnot DEP-ready.\nEven DEP-fan Leo Davidson\n\nruns a couple of programs that don’t work with DEP enabled<\/a>.\nAnd\n\nit takes only one program to foul an upgrade<\/a>.\n<\/p>\n

\nWhen the kernel encounters a DEP exception,\nit checks whether thunk emulation is enabled,\nand if so (which it usually is),\nit checks whether the code sequence is\none of the “well-known DEP-violating thunks”.\nIf so, then it simulates the actions the thunks would have performed\nand resumes execution instead of raising the exception.\nFor example, if thunk emulation is enabled and you just took a\nDEP exception on the code sequence\n<\/p>\n

\nmov ecx, 12345678\njmp 43218765\n<\/pre>\n
\nthe kernel thunk emulator will perform the moral equivalent of\n<\/p>\n
\npContext->Ecx = 0x12345678;\npContext->Eip = 0x43218765;\nreturn EXCEPTION_CONTINUE_EXECUTION;\n<\/pre>\n
\nYou can mark your program as\n“I am so okay with DEP that not only do I want you to enable it,\nbut I don’t even want you to do this thunk emulation stuff”\nby setting the\nIMAGE_DLLCHARACTERISTICS_NX_COMPAT<\/code>\nflag in your PE header.\n(The Visual Studio linker uses the \/NXCOMPAT<\/code>\ncommand line switch to set this flag.)<\/p>\n","protected":false},"excerpt":{"rendered":"
As we saw last time, there are a variety of ways you can control DEP, one of which is to turn it on for all system processes. But even if you turn on DEP, it still sometimes turns itself off temporarily. It goes back to those bad versions of ATL. The application compatibility team found […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-24493","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"
As we saw last time, there are a variety of ways you can control DEP, one of which is to turn it on for all system processes. But even if you turn on DEP, it still sometimes turns itself off temporarily. It goes back to those bad versions of ATL. The application compatibility team found […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/24493","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=24493"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/24493\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=24493"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=24493"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=24493"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}