Configuring CASP

CASP is a memory-protection technique that renders useless any shellcode running from the non-code area. This shellcode is an abnormal event that usually happens because of a buffer overflow.

CASP allows code to execute from non-code area but disallows the code from invoking any meaningful API calls.

To protect the code in a non-code area from making API calls, configure rules to add executables to CASP.

Task	Syntax	Description
Bypass executables from CASP.	`sadmin attr add –c <filename1 ... filenameN>`	Specify one or more executables where CASP must be bypassed. For example, `sadmin attr add –c alg.exe`
Remove executables from CASP bypass.	`sadmin attr remove –c <filename1 ... filenameN>`	Specify one or more executables to remove from CASP bypass; in effect CASP is enforced. For example, `sadmin attr remove –c alg.exe`
List the executables that CASP bypasses.	`sadmin attr list –c`	Lists all executables that CASP bypasses. For example, `sadmin attr list –c`
Flush the CASP bypass rules from all executables.	`sadmin attr flush –c`	Removes the CASP bypass rules from all executables. For example, `sadmin attr flush –c`