NX 标志如何工作?

发布于 2024-08-19 08:42:18 字数 41 浏览 4 评论 0原文

您能否解释一下 NX 标志是什么以及它是如何工作的(请是技术性的)?

Could you please explain what the NX flag is and how it works (please be technical)?

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(3

不顾 2024-08-26 08:42:18

它在虚拟内存系统和 TLB(CPU 用于解析虚拟内存映射的结构)中标记不可执行的内存页。如果要从该页执行任何程序代码,CPU 将出错并将控制权转移给操作系统进行错误处理。

程序通常将二进制代码和静态数据存储在只读内存部分中,如果它们尝试在那里写入,CPU 将出现故障,然后操作系统通常会终止应用程序(这称为分段错误或访问冲突) 。

出于安全原因,程序的读/写数据存储器通常默认受到 NX 保护。这可以防止攻击者向某些应用程序提供其恶意代码作为数据,使应用程序将其写入其数据区域,然后以某种方式执行该代码,通常是通过应用程序中的缓冲区溢出/下溢漏洞,覆盖函数的返回地址与数据区域中恶意代码的位置在堆栈中。

一些合法应用程序(尤其是高性能模拟器和 JIT 编译器)也需要执行其数据,因为它们在运行时编译代码,但它们专门分配内存,但没有为此设置 NX 标志。

It marks a memory page non-executable in the virtual memory system and in the TLB (a structure used by the CPU for resolving virtual memory mappings). If any program code is going to be executed from such page, the CPU will fault and transfer control to the operating system for error handling.

Programs normally have their binary code and static data in a read-only memory section and if they ever try to write there, the CPU will fault and then the operating-system normally kills the application (this is known as segmentation fault or access violation).

For security reasons, the read/write data memory of a program is usually NX-protected by default. This prevents an attacker from supplying some application his malicious code as data, making the application write that to its data area and then having that code executed somehow, usually by a buffer overflow/underflow vulnerability in the application, overwriting the return address of a function in stack with the location of the malicious code in the data area.

Some legitimate applications (most notably high-performance emulators and JIT compilers) also need to execute their data, as they compile the code at runtime, but they specifically allocate memory with no NX flag set for that.

与君绝 2024-08-26 08:42:18

来自维基百科

NX位,代表No
eXecute,是一种用于 CPU 的技术
隔离内存区域以供使用
通过处理器的任一存储
指令(或代码)或存储
数据,通常只能找到的功能
在哈佛架构处理器中。
然而,NX 位正在
越来越多地用于传统冯
诺依曼架构处理器,用于
安全原因。

支持的操作系统
NX 位可能会标记某些区域
内存为不可执行。这
然后处理器将拒绝执行
驻留在这些区域的任何代码
记忆。一般技术,已知
作为可执行空间保护,是
用于防止某些类型的
恶意软件接管
计算机通过将其代码插入
另一个程序的数据存储区
并从内部运行自己的代码
本节;这被称为
缓冲区溢出攻击。

From Wikipedia

The NX bit, which stands for No
eXecute, is a technology used in CPUs
to segregate areas of memory for use
by either storage of processor
instructions (or code) or for storage
of data, a feature normally only found
in Harvard architecture processors.
However, the NX bit is being
increasingly used in conventional von
Neumann architecture processors, for
security reasons.

An operating system with support for
the NX bit may mark certain areas of
memory as non-executable. The
processor will then refuse to execute
any code residing in these areas of
memory. The general technique, known
as executable space protection, is
used to prevent certain types of
malicious software from taking over
computers by inserting their code into
another program's data storage area
and running their own code from within
this section; this is known as a
buffer overflow attack.

半山落雨半山空 2024-08-26 08:42:18

看看维基百科上找到的使用 NX 位的“DEP”。至于提供技术答案,抱歉,我对此了解不够,但引用一下:

数据执行保护 (DEP) 是现代应用程序中包含的一项安全功能
Microsoft Windows 操作系统旨在防止
应用程序或服务从不可执行的内存区域执行代码。
....

DEP 是在 Windows XP Service Pack 2 中引入的,并包含在 Windows XP 中
Tablet PC Edition 2005、Windows Server 2003 Service Pack 1 及更高版本、Windows
Vista、Windows Server 2008 以及所有较新版本的 Windows。
...

硬件强制 DEP 通过以下方式在兼容 CPU 上启用 NX 位:
在 32 位 Windows 中自动使用 PAE 内核,并在 64 位上提供本机支持
内核。
Windows Vista DEP 的工作原理是将内存的某些部分标记为旨在
仅保存数据,NX 或 XD 位使能处理器将其理解为
不可执行。
这有助于防止缓冲区溢出攻击得逞。在 Windows Vista 中,
进程的 DEP 状态,即 DEP 是启用还是禁用
可以在 Windows 任务的“进程”选项卡上查看特定进程
经理。

另请参阅此处有关 DEP 的 MSDN 知识库。有一个非常详细的解释这里 这是如何工作的。

希望这有帮助,
此致,
汤姆.

Have a look at this 'DEP' found on wikipedia which uses the NX bit. As for supplying the technical answer, sorry, I do not know enough about this but to quote:

Data Execution Prevention (DEP) is a security feature included in modern
Microsoft Windows operating systems that is intended to prevent an
application or service from executing code from a non-executable memory region.
....

DEP was introduced in Windows XP Service Pack 2 and is included in Windows XP
Tablet PC Edition 2005, Windows Server 2003 Service Pack 1 and later, Windows
Vista, and Windows Server 2008, and all newer versions of Windows.
...

Hardware-enforced DEP enables the NX bit on compatible CPUs, through the
automatic use of PAE kernel in 32-bit Windows and the native support on 64-bit
kernels.
Windows Vista DEP works by marking certain parts of memory as being intended to
hold only data, which the NX or XD bit enabled processor then understands as
non-executable.
This helps prevent buffer overflow attacks from succeeding. In Windows Vista,
the DEP status for a process, that is, whether DEP is enabled or disabled for a
particular process can be viewed on the Processes tab in the Windows Task
Manager.

See also here from the MSDN's knowledge base about DEP. There is a very detailed explanation here on how this works.

Hope this helps,
Best regards,
Tom.

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文