Hacker News new | ask | show | jobs
by symtos 3679 days ago
not necessarily. there are software emulation -- examples would be W^X on OpenBSD[1] and Grsecurity/PaX on linux[2]. Ubuntu[3] and RedHat[4] also has (partial) NX-emulation thanks to ExecShield.

As for OpenBSD and Linux without grsec/pax, one can bypass NX (whether the CPU has the NX-bit or not) by marking the region with the shellcode as executable, eg:

mprotect(shellcode & -pagesize, len, PROT_EXEC);

((void()()) shellcode)();

in an exploit this could be accomplished by ROPing

1: http://marc.info/?l=openbsd-misc&m=105056000801065

2: https://pax.grsecurity.net/docs/mprotect.txt

3: https://outflux.net/blog/archives/2009/05/14/nx-emulation-in...

4: https://en.wikipedia.org/wiki/Exec_Shield