I am finding it really hard to figure out why we need a DEP!

Microsoft states this about DEP:

The primary benefit of DEP is to help prevent code execution from data pages.

Typically, code is not executed from the default heap and the stack. Hardware-enforced DEP detects code that is running from these locations and raises an exception when execution occurs.

Software-enforced DEP can help prevent malicious code from taking advantage of exception-handling mechanisms in Windows.

What does that mean?

Can you give me a simple non-code example for this!

  • is it that the heap and stack section of memory give full permissions for a malicious program to execute!
    – Anirudha
    Jun 27, 2012 at 18:26

1 Answer 1


Hardware DEP takes advantage of the NX ("No Execute page protection", AMD specification) or XD ("Execute Disable", Intel specification) bit on DEP compatible CPU’s, and will mark certain parts of the memory (which should only contain data, such as the default heap, stack, memory pools) as non-executable.

When an attempt is made to execute code from a DEP protected data page, an access violation (STATUS_ACCESS_VIOLATION (0xc0000005)) will occur. In most cases, this will result in process termination (unhandled exception). As a result of this, when a developer decided he wants to allow code to run from a certain memory page, he will have to allocate the memory and mark it as executable.


When you're trying to redirect code flow through a buffer overflow exploit, etc you want to redirect the flow to a custom shellcode/payload that will give you remote access, etc to the victim computer.

We do this by re-writing registers like EIP(Extended Instruction Pointer), ESP(Extended Stack Pointer), etc. By this technology we attempt to prevent redirecting code flow to unauthorized memory locations. Hence in order to invoke the shell, we'd need to get past the access violation in theory.

Essentially programmers have to specify memory locations that can have executable code, the other locations have non-executable data on invoking which causes an access violation exception.

Read more about its technicalities here: http://msdn.microsoft.com/en-us/library/bb736299(VS.85).aspx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .