DEP and ASLR – the intentional and the unavoidable

So far, we’ve only mentioned these concepts in passing: DEP (which is also called NX for no-execute) and ASLR. I’m afraid we can’t put them off forever. I think I hear a couple of hackers at the back saying, good! It took the impact out of the demonstrations when we had to disable basic protection to make the attack work. Fair enough. When we introduced a basic buffer overflow in Chapter 10, Shellcoding – The Stack, we explicitly disabled ASLR. (To be fair, Windows 7 comes out of the box like that.) This is all by design, though—we can’t understand the core concept without, first, taking a step back. These protection mechanisms are responses to the attacks we’ve demonstrated. But look at me, going off on a tangent again without defining these simple concepts.

Understanding DEP

Do you remember where we stuff our shellcode? The answer is inside the stack or the heap...