Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrect check for permanent DEP #72

Open
shocoman opened this issue Oct 4, 2023 · 0 comments
Open

Incorrect check for permanent DEP #72

shocoman opened this issue Oct 4, 2023 · 0 comments

Comments

@shocoman
Copy link

shocoman commented Oct 4, 2023

There are a couple of places where the debugger calls the function GetProcessDEPPolicy to check if DEP is enabled and permanent. This function has a bug when it puts garbage into bPermanent parameter if DEP is not actually permanent (otherwise it's just 1). As a result, memory breakpoints on execution sometimes don't work (because instead of applying a guard page, it'll try to simply set a memory protection without EXECUTE which is useless)

There is Raymond Chen's answer on StackOverflow. But the proposed solution works only on Win8+. The only other thing I can think of is to use NtQueryInformationProcess directly (like this), even though its documentation says it's unstable and may change in the future.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant