Join Date: 09 2001
Location: South Korea, Gumi
Blog Entries: 16
Uploads: 34Reputation: 561 | 6
Defeating Microsoft Windows XP SP2 Heap protection and DEP bypass
Published 28th January 2005.
In October 2004 it was discovered by MaxPatrol team that it is possible to defeat Microsoft® Windows® XP SP2 Heap protection and Data Execution Prevention mechanism. As a result it is possible to implement:
As a temporary security measure we've developed simple utility PTmsHORP, which allows restriction of lookaside list creation, governed by a special global flag.
Download PTmsHORP (21 Kb)
During the first execution this program shows the list of applications which already have this flag set. In order to activate this safety flag for other applications you just need to add the name of the executable file to the list. Any time you can review or modify the list of protected applications by running PTmsHORP again.
Warning. The flag, while enabled, may decrease the application performance.