如何为我的 .NET 应用程序启用 DEP 或 ASLR？
我正在 VS2010 中编写程序，构建目标是 .NET 4。我相信 DEP 兼容性标志默认处于打开状态。这是真的吗？
.NET 默认情况下是否也与 ASLR 兼容，并且在我的进程中默认启用 ASLR ，或者我必须在运行时请求它？
I'm writing my program in VS2010 and the build target is .NET 4. I believe that the DEP compatibility flag is on by default. Is that true?
Is .NET also compatible by default with ASLR, and is ASLR turned on by default for my process, or do I have to request it at runtime?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
是的，自 .NET 2.0 SP1 起，标准 .NET 语言编译器会打开 NXCOMPAT 标志。
凭借 JIT 编译器，ASLR 在 .NET 程序中本质上是自动的。 JIT 编译的机器代码将放置在何处是不可预测的。尽管它可能在完全相同的机器上重复，具有完全相同的 CLR 修订号、完全相同的启动代码流以及注入到进程中的完全相同的 DLL。但不容易被恶意软件攻击。自 .NET 3.5 SP1 版本以来，ngen-ed .NET 程序集支持 ASLR。
更强大的是数据的 ASLR，这是针对攻击的更重要的对策。重要的是，绝大多数攻击都是从恶意数据开始的。每次启动程序时，线程堆栈、GC 堆和静态数据的位置都会发生变化。顺便说一句，尝试调试 AVE 可能会非常痛苦。
ASLR 可防止已知的不可修补的安全漏洞。安全缺陷必须首先存在，这在可验证代码中并不常见。
Yes, the NXCOMPAT flag is turned on by the standard .NET language compilers since .NET 2.0 SP1.
ASLR is essentially automatic in .NET programs by virtue of the JIT compiler. Where it will place the JIT compiled machine code is unpredictable. Albeit that it will likely be repeatable on the exact same machine with the exact same revision number of the CLR and the exact same flow of the startup code and the exact same DLLs getting injected into the process. Not easily targetable by malware though. The ngen-ed .NET assemblies support ASLR since the .NET 3.5 SP1 release.
Much more powerful is the ASLR for data, the more essential counter-measure against attacks. Important because the vast majority of attacks start with malicious data. Every time you start your program, the location of stack of a thread, the GC heap and static data changes. Can be quite painful of you are trying to debug an AVE btw.
ASLR protects against known unpatchable security flaws. The security flaw has to exist first, uncommon in verifiable code.