Data Execution Prevention (DEP)

DEP is a security feature included in modern Microsoft Windows OS that is intended to prevent an application or service from executing code from a non-executable memory region.

It is a system-level memory protection feature that is built into OS starting with Windows XP and Windows Server 2003.

DEP enables the system to mark one or more pages of memory as non-executable. Marking memory regions as non-executable means that code cannot be run from that region of memory, which makes it harder for the exploitation of buffer overruns (buffer overflow). It is a set of hardware and software technologies that perform additional checks on memory to help protect against malicious code exploits.

• This level of pagin has been introduced with AMD64 (the ability to indicate that code should not be executed from a page or a set of pages by setting NX bit = 1; this is 63rd bit in 64-bit entry in the page table)
• This feature is enabled if NO execute bit in Enable Feature Extended Register (EFER.NXE) and the PAE in CR4 are set, regardless of operating mode (this is because x86's original 32-bit page table format obviously has no bit 63)

Modes of Enforcement

1. Hardware Enforcement: Achieving this DEP using NX bit (bit number 63) of a 64-bit Page Translation Entry. It marks all memory locations in a process as non-executable unless the location explicitly contains executable code. There is a class of attacks that attempt to insert and execute code from non-executable memory locations. DEP helps prevent these attacks by intercepting them and raising an exception.
2. Software Enforcement: System software (kernel) can mark pages used for program stacks and data sections as non-executable.

Processor-corresponding features

1. AMD: Enhanced Virus Protection (EVP in AMD64)
2. Intel: Execute Disable (XD in EM64T)

Page State

Any page in VAS (PAS) of a process can be in one of the three states.

1. Committed: A page state of a page which is mapped to a page frame in physical memory (or to a page-sized entry in a file on disk)
2. Reserved: A page state of a page which been set aside for future use so that it cannot be re-used for any other purpose within the process, but has no associated physical page storage
3. Free: A page state of a page which is available to be reserved

Basics of Memory Management

Memory Manager:

Implements virtual memory, provides a core set of services such as memory mapped files, copy-on-write memory, large memory support and underlying support for the cache manager.

(For details on Copy-on-Write http://spot-myblog.blogspot.com/2009/07/copy-on-write.html)

Each process on a 32-bit Windows OS has a virtual address space (PAS) of 4GB (It is 8TB for a process in 64-bit Windows). Threads cannot access memory that belongs to another process, which protects a process from being corrupted by another process.

VAS (PAS):

• VAS for a process is the set of virtual memory addresses that it can use. The address space of a process P1, cannot be accessed by other process(es) P2, *unless it is shared*.
• This PAS does not represent the actual physical location in memory; instead the system maintains a Page Table for each process (an internal data structure used to translate VA to PA). Each time a thread references an address, the system translates the VA to PA.
• VAS for 32-bit (Windows) process is divided into two partitions; one for process itself and the other for kernel. Default partition will be 2GB:2GB (0x00000000 - 0x7FFFFFFF: 0x80000000 - 0xFFFFFFFF). If 4GT (4GB Tuning) is enabled, then it will be 3GB:1GB (0x00000000 - 0xBFFFFFFF: 0xC0000000 - 0xFFFFFFFF).
• After 4GT, the process that has IMAGE_FILE_LARGE_ADDRESS_AWARE flag set in its image header will have access to the additional 1GB of memory above the low 2GB.

IMPORTANT NOTE:

We can adjust the VAS of 32-bit process, using the following command, which sets a boot entry option that configures the size of the partition that is available for use by the process to a value between 2048 MB (2GB) and 3072 MB(3GB).

BCDEdit /set increaseuserva <XYZ Megabytes>

after which, partition would be like (0x00000000 - XYZ: XYZ+1 - 0xFFFFFFFF).

Working Set:

• The subset of VAS of a process that resides in physical memory is known as "Working Set"
• If the thread of a process attemt to use more physical memory than is currently available, the kernel, "pages" (swaps) some of the memory contents to disk (the total amount of VAS available to a process is limited by physical memory and the free space on disk available for the paging file)
• Physical storage and the VAS of each process are organized into "pages", units of memory, whose size depends on the host computer (usually 4 KB for x86 computers - Use GetSystemInfo API to get the page size)
• When a thread needs space in RAM, the kernel moves the "least recently used" pages in RAM to paging file in disk.
• When a thread references a page that is not a part of Working Set (means not present in main memory, a "page fault"(called Page Exception) occurs, on which Kernel's Page Fault Handler attempts to resolve the page fault (by "Demand Paging") and if it succeeds, the page is added to the working set.
• Hard Page Fault: Occurs when the demanded page is not on Main Memory
• Soft Page Fault: Occurs when the demanded page is on Main memory but in the working set of some other process or if it is demanded for the first time (called "Demand-Zero" fault)
• Process can reduce or empty its working set by calling "SetProcessWorkingSetSize" or "EmptyWorkingSet" functions

PS: The details on the page state at http://spot-myblog.blogspot.com/2009/07/page-state.html