Re: DEP (Data Execution Prevention) in WinXP SP2 and ATL/WTL thunk.

From:

"Alexander Nickolov" <agnickolov@mvps.org>

Newsgroups:

microsoft.public.vc.atl

Date:

Wed, 23 May 2007 09:39:07 -0700

Message-ID:

<Or8JjjVnHHA.2596@TK2MSFTNGP06.phx.gbl>

It works because the OS traps the exception, analyzes the code
and allows execution if it matches the ATL thunk signature. It's
inefficient of course...

--
=====================================
Alexander Nickolov
Microsoft MVP [VC], MCSD
email: agnickolov@mvps.org
MVP VC FAQ: http://vcfaq.mvps.org
=====================================

<ZZzz.oOO@gmail.com> wrote in message
news:1179859516.186154.260560@p77g2000hsh.googlegroups.com...

Hello all,

I've been read through various articles about DEP(Data Execution
Prevention) and realized that many of them implied that 'old' ATL/WTL
application may trigger DEP then be terminated due to non-DEP
compliant thunking code that 'old' version of ATL/WTL uses.

However when I wanted and tried to verify it myself by creating WTL
applications based on both ATL3 and ATL71, they didn't trigger DEP nor
crashed and run without any problem. Their thunk are not DEP-compliant
like that in ATL8 is.

The testing systems (one AMD64 and one Intel DuoCore in 32 bit WinXP
SP2) were set to enable hardware enforced DEP, and it was confirmed by
running NXTEST (http://user.cs.tu-berlin.de/~normanb/).

Why can't DEP detect data thunk (on the stack in ATL3 or on the heap
in ATL71) being executed without the excutable flag set in ATL/WTL
application?