OWLNext_and_Data_Execution_Prevention

OWLNext and Data Execution Prevention

Data Execution Prevention (DEP) is a security feature included in modern Microsoft Windows operating systems that is intended to prevent an application or service from executing code from a non-executable memory region. This helps prevent certain exploits that inject code in memory and attempt to run it.

• OWLNext and Data Execution Prevention
  • Support for DEP in OWLNext
    • Background
  • No support for Windows 95/98/ME Compatibility Mode
    • Workaround
  • References

---

Support for DEP in OWLNext

32-bit support for DEP was introduced in OWLNext 6.20. The support was extended to 64-bit in OWLNext 6.40. These changes allow 32-bit and 64-bit OWLNext applications to run with DEP enabled (except when running in Windows 95/98/ME compatibility modes; see section below).

Background

OWLNext depends on executable memory for the window message dispatch, using a mechanism based on thunks; small chunks of run-time generated code used to dispatch window messages. See Window Message Dispatch in OWLNext for more details about this mechanism. Support for DEP was implemented in OWLNext 6.20 by allocating the thunks in executable memory, a feature available with the Windows heap manager since Windows NT 4.

Note: 16-bit OWL and old OWLNext applications built for Win16 run without problems with DEP because the 16-bit segmented memory model of the x86 processor architecture puts executable code in a code segment where execution is allowed. On the other hand, 32-bit and 64-bit OWLNext applications built for Win32 use a flat memory model with no separate segments for code and data.

---

No support for Windows 95/98/ME Compatibility Mode

32-bit and 64-bit OWLNext applications do not run in Windows 95/98/ME compatibility mode on Windows XP and later, if Data Execution Prevention (DEP) is enabled (the default in Windows XP is to enable DEP for the system only, while the latest Windows versions enable DEP by default for most applications as well).

In these compatibility modes the heap manager provided by the OS does not support executable memory needed to store the thunks. When DEP is enabled, any attempt to execute code in ordinary memory will cause a processor exception. The same would happen if you built and ran your program with an old version of OWL or OWLNext without DEP support.

Workaround

You can disable DEP for your OWLNext application (see Microsoft Support for instructions). However, if possible, keep DEP enabled and run the application in a compatibility mode for Windows NT 4 or later — or preferably, none at all — so that the system is better protected against exploits.

---

References

• Data Execution Prevention
• What is Data Execution Prevention (DEP)? | Microsoft Support
• Window Message Dispatch in OWLNext