0

I am attempting to disable DEP on a program that will be used in a demonstration of how a basic buffer overflow works.

The application is a C++ app written in visual studio and I am running into sections of the program (particularly where the payload is) that are non executable. To my knowledge this should only happen if DEP is enabled.

The error code when I land in my payload is: C0000005, EXCEPTION_ACCESS_VIOLATION

I have disabled DEP in the linker options of the project properties and run bcdedit.exe /set {current} nx AlwaysOff from the command prompt.

Is there something else that needs to be disabled to make all sections of an x64 application memory executable?

0

In recent versions of Windows 10, there's an "Exploit Protection" feature that allows controlling DEP on both a per-app and system-wide basis (the former overriding the latter). Use the Start search to find it.

Make sure the access violation you're getting is actually due to DEP, and not due to trying to read (or write) memory that is not mapped to the process (or is mapped unwritable, or is a guard page, etc.) If you're using windbg, the !analyze command (after you hit the AV) will give you the details.

It is never going to be the case that all addresses of a 64-bit program are executable. Even leaving aside the high addresses that are mapped to the kernel and the first page being never usable to limit the damage of null pointer dereferences, there simply isn't anywhere near enough memory - physical or backed by the pagefile - to cover so many addresses. However, it should be possible to make all mapped pages executable.

If you can't figure out any other way, you can have your vulnerable program call VirtualProtect to make the relevant address range executable before the exploit occurs. This isn't realistic for most apps (the notable exception being anything that JIT compiles its own code, if you can put your payload in there) but then, neither is a modern system or even process without DEP.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.