[ryuuchin]

Most of them are just built into Windows now and are accessible through both the registry[1] and at runtime[2][3]. The latter requires recompiling with source code changes but the former can be applied to any application.

The EMET mitigations which are no longer supported have either been depreciated because of better ones (control flow guard) or are not terribly effective (EAF/EAF+, use of debug registers).

[1] https://theryuu.github.io/ifeo-mitigationoptions.txt

[2] https://msdn.microsoft.com/en-us/library/windows/desktop/ms6...

[3] https://msdn.microsoft.com/en-us/library/windows/desktop/hh7...

[MohammadLee]

I get your point, but most does not mean all, and hardening is all about adding layers. https://insights.sei.cmu.edu/cert/2016/11/windows-10-cannot-... is a complete review of the mitigations we are loosing.