Delphi 如何定义DEP在系统中处于启用状态

DelphiXe；Xp、Vista、Win7、WSrv2008R2

0.支持DEP（数据执行预防）CPU

Function isCpuDEP:bool; 
begin
Result:=... //???
end;

1.如何定义DEP在系统中处于启用状态

Function isEnableDEP:bool; // Win Xp comparable
begin
Result:=false;if isCpuDEP=false then exit;
Result:=... //???
end;

2.定义是否启用DEP，以及是否为所有程序和服务启用DEP

Function isEnableDEPForAllProgram:bool;
begin
Result:=false;if isEnableDEP=false then exit;
Result:=... //???
end;

3.获取DEP计划列表

Function GetDEPProgramList:TStringList;
begin
Result:=nil;if isEnableDEPForAllProgram=false then exit;
Result:=Tstringlist.Create;
Result:=... //???
end;

WMi类有4个属性，它们报告DEP的状态

• DataExecutionPrevention\u可用
• DataExecutionPrevention\u 32位应用程序
• DataExecutionPrevention\u驱动程序
• 数据执行预防支持策略

阅读有关这些属性的MSDN文档以查看说明

检查此示例应用程序

{$APPTYPE CONSOLE}

uses
  SysUtils,
  ActiveX,
  ComObj,
  Variants;


function DEPStatus(Status : integer) : string;
begin
  case Status of
   0 : Result:='Always Off';
   1 : Result:='DEP is turned off for all 32-bit applications on the computer with no exceptions. This setting is not available for the user interface.';
   2 : Result:='DEP is enabled for all 32-bit applications on the computer. This setting is not available for the user interface.';
   3 : Result:='DEP is enabled by default for all 32-bit applications. A user or administrator can explicitly remove support for a 32-bit application by adding the application to an exceptions list.';
   else
       Result:='unknown';
  end;
end;


procedure  GetDEPStatusInfo;
const
  WbemUser            ='';
  WbemPassword        ='';
  WbemComputer        ='localhost';
  wbemFlagForwardOnly = $00000020;
var
  FSWbemLocator : OLEVariant;
  FWMIService   : OLEVariant;
  FWbemObjectSet: OLEVariant;
  FWbemObject   : OLEVariant;
  oEnum         : IEnumvariant;
  iValue        : LongWord;
begin;
  FSWbemLocator := CreateOleObject('WbemScripting.SWbemLocator');
  FWMIService   := FSWbemLocator.ConnectServer(WbemComputer, 'root\CIMV2', WbemUser, WbemPassword);
  FWbemObjectSet:= FWMIService.ExecQuery('SELECT * FROM Win32_OperatingSystem','WQL',wbemFlagForwardOnly);
  oEnum         := IUnknown(FWbemObjectSet._NewEnum) as IEnumVariant;
  if oEnum.Next(1, FWbemObject, iValue) = 0 then
  begin
    Writeln(Format('DataExecutionPrevention_32BitApplications    %s',[FWbemObject.DataExecutionPrevention_32BitApplications]));// Boolean
    Writeln(Format('DataExecutionPrevention_Available            %s',[FWbemObject.DataExecutionPrevention_Available]));// Boolean
    Writeln(Format('DataExecutionPrevention_Drivers              %s',[FWbemObject.DataExecutionPrevention_Drivers]));// Boolean
    Writeln(Format('DataExecutionPrevention_SupportPolicy        %s',[FWbemObject.DataExecutionPrevention_SupportPolicy]));// Uint8
    Writeln(DEPStatus(FWbemObject.DataExecutionPrevention_SupportPolicy));
  end;
end;


begin
 try
    CoInitialize(nil);
    try
      GetDEPStatusInfo;
    finally
      CoUninitialize;
    end;
 except
    on E:EOleException do
        Writeln(Format('EOleException %s %x', [E.Message,E.ErrorCode]));
    on E:Exception do
        Writeln(E.Classname, ':', E.Message);
 end;
 Writeln('Press Enter to exit');
 Readln;
end.

---

这里有一个简单但非正统的检查DEP的方法，但它只适用于当前程序

function IsDepOn:Boolean;
var
shellcode : array [0..1] of byte;
begin
  shellcode[0] := $90;
  shellcode[1] := $C3;
  try
  asm
      lea eax,shellcode
      call eax
  end;
      Result:=False;
  except
      Result:=True;
  end;
end;

以下用于第（1）点：

对于第（2）点，您可以使用类似的方式

---

对于第（3）点，您可以枚举进程并找出与DEP一起运行的进程。

我有.NET背景，但可以帮助回答第一个和第二个问题。尝试在我们使用System.Process的.NET中运行以下wmic OS Get DataExecutionPrevention_SupportPolicy。0=AlwaysOff–DEP对所有进程禁用，1=AlwaysOn–DEP对所有进程启用，2=OptIn–DEP为Windows系统组件和服务启用，3=OptOut–DEP为所有进程启用。要获取DEP例外列表，必须检查Windows注册表项

HKEY\U LOCAL\u MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

，并使用该值筛选所有条目

DisableNXShowUI

type
  TGetProcessDEPPolicy =
      function(Process: THandle; out Flags: DWORD; out Permanent: Bool): Bool; stdcall;
const
  PROCESS_DEP_ENABLE = $00000001;
  PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION = $00000002;

procedure TForm1.Button1Click(Sender: TObject);
var
  GetProcessDEPPolicy: TGetProcessDEPPolicy;
  DEPFlags: DWORD;
  IsPermanent: Bool;
begin
  @GetProcessDEPPolicy :=
      GetProcAddress(GetModuleHandle(kernel32), 'GetProcessDEPPolicy');
  if Assigned(GetProcessDEPPolicy) then begin
    if GetProcessDEPPolicy(GetCurrentProcess, DEPFlags, IsPermanent) then begin

      if (DEPFlags and PROCESS_DEP_ENABLE) = PROCESS_DEP_ENABLE then
        ShowMessage('DEP enabled')
      else
        ShowMessage('DEP disabled');

    end else
      raise EOSError.Create(SysErrorMessage(GetLastError));
  end else
    raise EOSError.Create('Unsupported OS');
end;