One Day Sec

What is the main advantage of using VirtualAlloc instead of VirtualProtect to bypass DEP?

The main advantage is that the four parameters passed to VirtualAlloc can be directly specified in the shellcode without needing to read and then assign them, making the structure simpler. This is compared to the approach using VirtualProtect, which requires reading the current page protection before modifying it. See the article for a detailed comparison and the related VirtualProtect technique.
DEPVirtualAllocVirtualProtectshellcodeROP chain

Browse all Q&A →