The NX feature uses the Windows Data Execution Prevention (DEP) feature to protect processes against exploits that try to execute code from writable memory area (stack/heap). MP-NX also provides granular bypass capability and raises violation events that can be viewed on the Windows Event Viewer console.
To protect processes against exploits that try to execute code from writable memory area, configure rules to add executables to NX. This technique prevents code from being run from a non-executable memory region.
Task | Syntax | Description |
|---|---|---|
Bypass executables from NX. |
| Specify one or more executables where NX must be bypassed. For example, |
Bypass an executable and its child processes from NX. |
| Specify an executable where NX must be bypassed, including its child processes. You can specify the For example, |
Remove executables from NX bypass. |
| Specify one or more executables to remove from NX bypass; in effect NX is enforced. For example, |
List the executables that are bypassed from NX. |
| Lists all executables that NX bypasses. For example, |
Flush NX bypass rules from all executables. |
| Removes the NX bypass rules from all executables. For example, |