I have read some articles about bypassing
ASLR , but it seems that they bypass
DEP by using the instructions in the modules not applying
ASLR.But how to bypass
DEP in the modules applying both this two protection?
Like you said, first ASLR will have to be defeated before any DEP circumvention can be applied. This is usually done by leaking pointers with a separate memory disclosure vulnerability. Then when the location of the code pages is known, the usual technique of a return to libc can be applied.