windows XP数据执行保护（国外英文资料）.doc

windows XP数据执行保护（国外英文资料） The Windows XP data execution protection (DEP) function details the 2008-09-16 11:52 profile Data execution protection (DEP) is a hardware and software technology that can perform additional checks in memory to help prevent malicious code running on the system. In Microsoft Windows XP Service Pack 2 (SP2) and Microsoft Windows XP Tablet PC Edition 2005, the DEP was enforced with hardware and software. The main advantage of DEP is that it can help prevent data page execution of code. Typically, code is not executed from the default heap and stack. The hardware implements the DEP to detect the code running from these locations and causes an exception when the execution is found. Software implementation DEP helps prevent malicious code from exploiting the exception handling mechanism in Windows. Hardware implementation of DEP In addition to explicitly containing the memory location where the executable code is executed, the hardware implements the DEP to mark all memory locations in the process as inexecutable. One type of attack is to try to insert code into an unexecutable memory location and run it. DEP can help prevent these attacks by intercepting these attacks and causing an exception. The hardware implementation DEP relies on the processor hardware to use the attribute tag memory, which indicates that the code cannot be executed from that memory. The DEP runs on a virtual memory Page, usually changing the bits in the Page Table Entry (PTE) to mark the memory Page. The processor architecture determines how the DEP is implemented in hardware and the way DEP tags virtual memory pages. However, when executing code from a page that USES the appropriate property set tag, the handler that supports the hardware implementation DEP may cause an exception. Advanced Micro Devices (AMD) and Intel have defined and released Windows compatible architectures that are compatible with DEP. Starting with Windows XP SP2, the 32-bit version of Windows USES o