Steve
I'm a PC, so shut up
Consultant
join:2001-03-10
Yorba Linda, CA
| reply to H3lpme
said by H3lpme:
Apparently, applications compressed with this application doesn't work flawlessly on SP2.. good to know, they work 100% on SP1 though.. This smells like the application is trying to execute a data page, which is impacted by SP2's Data Execution Protection.
I'd imagine that self-unpackers allocate a big chunk of memory with either HeapAlloc() or VirtualAlloc(), unpack the data into it, then jump into the entry point. But with DEP, stack and data pages aren't executable, so I think they'd need to use VirtualProtect() to explicitly mark the pages executable.
I think it's also possible to disable DEP on a per-application basis.
A detailed description of the Data Execution Prevention (DEP) feature in Windows XP Service Pack 2
Steve
--
Stephen J. Friedl • Unix Wizard • Microsoft Security MVP • Tustin, California USA • my web site |
