从 VirtualAlloc 入手理解 DEP 与 ASLR 内存保护机制

#include <windows.h>
#include <stdio.h>

int main() {
    // 准备一段shellcode，0xC3在x86/x64汇编中代表 `ret` 指令
    char shellcode[] = { 0xC3 }; 

    printf("Shellcode is located on the stack at address: %p\n", shellcode);
    printf("Attempting to execute code from the stack...\n");

    // 创建一个函数指针，指向栈上的shellcode
    void (*pFunc)() = (void(*)())shellcode;
    
    // 尝试调用！
    pFunc();

    // 如果你看到了这条消息，说明DEP没有生效
    printf("Execution successful. (This should not happen!)\n");

    return 0;
}

#include <windows.h>
#include <stdio.h>

int main() {
    LPVOID memoryAddress = NULL;
    SIZE_T memorySize = 4096; // 分配一个页的大小 (4KB)

    printf("Press Enter to reserve memory...\n");
    getchar();

    // 步骤 1: 保留 (Reserve) 内存
    // 此时内存不可访问，状态为 MEM_RESERVE
    memoryAddress = VirtualAlloc(NULL, memorySize, MEM_RESERVE, PAGE_NOACCESS);
    if (memoryAddress == NULL) {
        printf("Failed to reserve memory. Error: %lu\n", GetLastError());
        return 1;
    }
    printf("Memory reserved at: 0x%p\n", memoryAddress);
    printf("--> Check the memory map in your debugger now.\n");
    printf("Press Enter to commit memory...\n");
    getchar();

    // 步骤 2: 提交 (Commit) 内存
    // 将预定的内存提交，并赋予读写权限。状态变为 MEM_COMMIT，保护属性为 RW-
    // 在正常开发时我们一般直接将步骤1和2简化为VirtualAlloc(NULL, memorySize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)
    if (VirtualAlloc(memoryAddress, memorySize, MEM_COMMIT, PAGE_READWRITE) == NULL) {
        printf("Failed to commit memory. Error: %lu\n", GetLastError());
        VirtualFree(memoryAddress, 0, MEM_RELEASE);
        return 1;
    }
    printf("Memory committed with READWRITE protection.\n");
    printf("--> Check the memory map again.\n");
    printf("Press Enter to change protection to EXECUTABLE...\n");
    getchar();

    // 步骤 3: 修改保护属性 (Protect)
    // 使用 VirtualProtect 修改内存为可读、可写、可执行。保护属性变为 RWX
    DWORD oldProtect;
    if (!VirtualProtect(memoryAddress, memorySize, PAGE_EXECUTE_READWRITE, &oldProtect)) {
        printf("Failed to change memory protection. Error: %lu\n", GetLastError());
        VirtualFree(memoryAddress, 0, MEM_RELEASE);
        return 1;
    }
    printf("Memory protection changed to EXECUTE_READWRITE.\n");
    printf("--> Check the memory map for the final time.\n");
    printf("Press Enter to free memory and exit...\n");
    getchar();

    // 步骤 4: 释放内存
    VirtualFree(memoryAddress, 0, MEM_RELEASE);
    printf("Memory released.\n");

    return 0;
}