From the Risk Sense PDF (opens a PDF):
3.6.2 DEP Bypass
Starting sometime in Microsoft Windows 8/8.1 (Server 2012), the HAL Heap became non-executable. A virtual memory Page Table
Entry (PTE) contains information about a memory location, such as base
physical addresses, CPU ring mode, a dirty bit, and starting with the
introduction of hardware-enforced DEP, a No eXecute (NX) bit at offset
63. If the NX bit is set and we attempt to move the instruction pointer to the page, a kernel panic will prevent the exploitation.
In general bypasses for ASLR rely on finding a known address. ASLR is generally a one time randomization on startup for kernel/system processes. So if you can find the address of point (structure, function, DLL, etc) then you can calculate the offsets to others that you care about.
I'm not a SME on ASLR, but that's the high level view.