HP dx6128 Data Execution Prevention - White Paper, 2nd Edition - Page 4

What is PAE? The XD and NX features require that the processor run in Physical Address Extension (PAE) mode. A 32-bit processor, such as the Intel Pentium 4 (IA32 family), is usually limited to addressing a maximum of 4-GB of memory. This limitation is due to 32 bits of address capability, as follows: 232 = 4,294,967,296 (4 GB) To address more than 4-GB of memory, Intel created PAE mode. PAE uses an additional 4 bits of addressing, creating a 36-bit address, thereby allowing for the addressing of up to 64-GB of memory, as follows: 236 = 68,719,476,736 (64 GB) A processor with XD or NX marks memory pages as nonexecutable. This marking consists of a bit in the Page Table Entry (PTE), which is a data structure containing the base physical address and attributes of a page in physical memory. When you use PAE mode, the PTEs are extended from 32 bits to 64 bits, allowing for the additional space required to mark an area as nonexecutable. Why is this change important? What threats does it help mitigate? The primary benefit of Data Execution Prevention is the prevention of code execution from data pages such as the default heap, various stacks, and memory pools. A heap is a common pool of memory available to a program. A stack is a set of hardware registers or a reserved amount of memory used for arithmetic calculations or to keep track of internal operations. In normal system operations, code is not typically executed from the default heap and stack. Hardwareenforced DEP detects code that is running from these locations and raises an exception when execution occurs. If the exception is unhandled, the process is terminated. Execution of code from protected memory in kernel mode results in a bugcheck. Although terminating a process or causing the system to fail with a bugcheck do not appear to be ideal solutions, they help prevent malicious code from executing. Preventing malicious code from executing on the system may prevent damage to your system or propagation of malicious code whose harmful effects could easily exceed those of a process terminated by a bugcheck. DEP can help mitigate against a class of security exploits. Specifically, Data Execution Prevention can prevent the exploit in which a virus or other attack injects a process with additional code and then attempts to execute the injected code. On a system with DEP, execution of the injected code results in an exception. Additionally, software-enforced DEP can help mitigate against exploits of exception handling mechanisms within Windows. A secondary benefit of DEP encourages good engineering and best practices for application and driver developers. Data Execution Prevention forces developers to avoid executing code out of data pages without explicitly marking the pages as executable. 4