Advice Request Data Execution Prevention (DEP)

Please provide comments and solutions that are helpful to the author of this topic.
It is enabled by default. It can be disabled for x86 (32-bit) binaries on the system level or only for some binaries. It cannot be disabled for x64 (64-bit), ARM, and ARM-64 binaries.
All x64, ARM, and ARM-64 executables have DEP enabled by default, and it cannot be disabled. Since an application will have never been executed without DEP, compatibility is assumed.

All x86 (32-bit) binaries have DEP enabled by default, but DEP can be disabled per process. Some old legacy applications, typically applications developed prior to Windows XP SP2, might not be compatible with DEP. Such applications typically generate code dynamically (for example, JIT compiling) or link to older libraries (such as older versions of ATL) which dynamically generate code.
Click to expand...
docs.microsoft.com

Exploit protection reference - Microsoft Defender for Endpoint

Details on how the exploit protection feature works in Windows
docs.microsoft.com
 
  • Like
  • Thanks
Reactions: wat0114, Mercenary, Brahman and 8 others
shmu26 said:
There is an option in advanced system settings of Windows to turn on DEP for all programs and services. Did you do this, and is it wise to do so?
Click to expand...
DEP is security feature that protects your hardware from programs that use memory incorrectly and mostly it isn’t recommended to disable it but then it’s up to you.
 
  • Like
Reactions: Venustus
shmu26 said:
There is an option in advanced system settings of Windows to turn on DEP for all programs and services.
Did you do this, and is it wise to do so?
Click to expand...
yes i do it and it’s recommend using that enforcement.

shmu26 said:
It is enabled by default "for essential Windows programs and services only".
I am asking about the second option: "for all programs and services".
Click to expand...
It can break programs. That’s why it isn’t enforced but I doesn’t care. It doesn’t exist any reason not enabling it.
I guess nobody will see any problems
 
  • Like
Reactions: Venustus and shmu26
shmu26 said:
It is enabled by default "for essential Windows programs and services only".
I am asking about the second option: "for all programs and services".
Click to expand...
When you use Exploit Protection to configure DEP, then it is applied just like in my previous post (enabled by default for all programs). You can disable DEP for compatibility only for x86 (32-bit processes) that do not natively support DEP. Except for the Exploit Protection feature, one can also use the old method:
Settings >> Advanced Settings >> Advanced >> click Settings under Performance section >> click Data Execution Prevention tab:

1626975416844.png


I think that this feature is overridden by Exploit Protection settings. So, it can be used when DEP is disabled in Exploit Protection (applied to x86 processes). Furthermore, it will work only for processes that do not support DEP natively. If the process has native DEP protection, you will see the alert that DEP cannot be disabled for it.
 

Attachments

  • 1626975481691.png
    1626975481691.png
    23.3 KB · Views: 271
  • Like
  • +Reputation
Reactions: Brahman, struppigel, Venustus and 3 others
Andy Ful said:
Settings >> Advanced Settings >> Advanced >> click Settings under Performance section >> click Data Execution Prevention tab:
Click to expand...
Yes, that's exactly what I am talking about. I looked in there and it not enabled for all programs.
I did not configure Exploit Protection settings.
 
  • Like
Reactions: Venustus, ForgottenSeer 85179 and Andy Ful
See Data Execution Prevention (DEP) must be configured to at least OptOut.
Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).
Enter "BCDEDIT /set {current} nx OptOut". (If using PowerShell "{current}" must be enclosed in quotes.)
"AlwaysOn", a more restrictive selection, is also valid but does not allow applications that do not function properly to be opted out of DEP.

Opted out exceptions can be configured in the "System Properties".
Click to expand...
 
  • Like
Reactions: Brahman, Venustus, Andy Ful and 1 other person
Andy Ful said:
I would not use these settings. All that is needed can be done independently via Exploit Protection. :unsure:
Click to expand...
I’m not sure as Exploit protection GUI doesn’t list any settings. Only the advanced list for program specific settings list all.

i also doesn’t see any problems so far
 
  • Like
Reactions: Andy Ful
SecurityNightmares said:
I’m not sure as Exploit protection GUI doesn’t list any settings. Only the advanced list for program specific settings list all.

i also doesn’t see any problems so far
Click to expand...
Probably all your applications have native (hardcoded) DEP which will ignore any Windows DEP settings. You can use Exploit Protection to not force DEP for any x86 legacy application which does not have native DEP. The settings noted by @shmu26 are legacy settings used from Windows XP when many processes did not have native DEP. They are still in Windows 10 for compatibility after upgrading.
If you have default Exploit Protection settings and default settings noted by @shmu26, they will force DEP for all processes anyway.
 
  • Applause
  • Like
  • Thanks
Reactions: Brahman, harlan4096 and ForgottenSeer 85179
Andy Ful said:
Probably all your applications have native (hardcoded) DEP which will ignore any Windows DEP settings. You can use Exploit Protection to not force DEP for any x86 application which does not have native DEP. The settings noted by @shmu26 are legacy settings used from Windows XP when many processes did not have native DEP. They are still in Windows 10 for compatibility after upgrading.
If you have default Exploit Protection settings and default settings noted by @shmu26, they will probably force DEP for all processes anyway.
Click to expand...
If you enable full DEP this way:
"Settings >> Advanced Settings >> Advanced >> click Settings under Performance section >> click Data Execution Prevention tab"
You have an option there for exceptions, in case a certain program doesn't like DEP.
 
  • Like
Reactions: Brahman, ForgottenSeer 85179 and Andy Ful
shmu26 said:
If you enable full DEP this way:
"Settings >> Advanced Settings >> Advanced >> click Settings under Performance section >> click Data Execution Prevention tab"
You have an option there for exceptions, in case a certain program doesn't like DEP.
Click to expand...
Yes. That is why Microsoft still keeps this legacy feature, because someone (on Windows 7, 8.1, or older Windows 10) could put there a list of legacy applications that have not got native DEP. Others can simply forget about this and simply use the new feature eg. Exploit Protection. This new feature also can exclude an application from system-wide DEP settings.
 
  • Like
Reactions: Brahman and shmu26
Andy Ful said:
Probably all your applications have native (hardcoded) DEP which will ignore any Windows DEP settings. You can use Exploit Protection to not force DEP for any x86 legacy application which does not have native DEP. The settings noted by @shmu26 are legacy settings used from Windows XP when many processes did not have native DEP. They are still in Windows 10 for compatibility after upgrading.
If you have default Exploit Protection settings and default settings noted by @shmu26, they will force DEP for all processes anyway.
Click to expand...
I wonder why nobody at official Microsoft forum give me that answer.

Thanks!
 
  • Like
Reactions: Brahman and Andy Ful
How these two features work together (tested on Gnuplot application).

LEGACY = feature noted by @shmu26
EP = Exploit Protection options for DEP

LEGACY_1 means the first option (ticked on the picture)
LEGACY_2 means the second option
1627036284807.png


LEGACY_1 and EP default:
The x86 processes that do not natively support DEP are not forced to use DEP. Others are run with DEP.

LEGACY_2 (empty list) and EP default ---> all programs are forced to use DEP

LEGACY_2 (with list of exclusions) and EP default :
  • the programs from the list are run without DEP,
  • these excluded programs are not visible in EP mitigations.
LEGACY_2 (with list of exclusions) and EP with exclusions ---> EP overrides LEGACY_2 for overlapping items.
 
  • Like
Reactions: somename, Brahman, shmu26 and 3 others
Andy Ful said:
How these two features work together (tested on Gnuplot application).

LEGACY = feature noted by @shmu26
EP = Exploit Protection options for DEP

LEGACY_1 means the first option (ticked on the picture)
LEGACY_2 means the second option
View attachment 259852

LEGACY_1 and EP default:
The x86 processes that do not natively support DEP are not forced to use DEP. Others are run with DEP.

LEGACY_2 (empty list) and EP default ---> all programs are forced to use DEP

LEGACY_2 (with list of exclusions) and EP default :
  • the programs from the list are run without DEP,
  • these excluded programs are not visible in EP mitigations.
LEGACY_2 (with list of exclusions) and EP with exclusions ---> EP overrides LEGACY_2 for overlapping items.
Click to expand...
So how enforce DEP for x86 with EP?
 
  • Like
Reactions: Brahman
SecurityNightmares said:
So how enforce DEP for x86 with EP?
Click to expand...
There are many tutorials, for example:
www.howtogeek.com

How Windows Defender's New Exploit Protection Works (and How to Configure It)

Microsoft's Fall Creators Update finally adds integrated exploit protection to Windows.
www.howtogeek.com www.howtogeek.com
Useful article about DEP:

If you want to do it for all x86 applications then set LEGACY_2 (empty list) and default EP. This will enforce “ATL thunk emulation” to increase compatibility.

If you want to do this for a particular application then use EP Program settings tab and choose the application.
Next, you must navigate to the DEP mitigation, tick "Override system settings" and set ON. You can also tick “ATL thunk emulation” if the application crashes.

1627048219043.png


Most machines with Windows 10 do not have applications that would need enforcing DEP, because they have DEP natively enforced, independently of Windows settings.
 
Last edited:
  • Like
Reactions: harlan4096, wat0114, Gandalf_The_Grey and 2 others
Last edited:
  • Like
Reactions: wat0114, harlan4096 and ForgottenSeer 85179

You may also like...