Data Execution Prevention - White Paper, 2nd Edition

9
DEP Level Chart
Processor
Support
BIOS DEP
Setting
OS BOOT.INI
Setting
Result
No N/A Any Setting Only software-enforced DEP is available for limited
Windows system binaries.
Yes Disabled Any Setting
Only software-enforced DEP is available for limited
Windows system binaries.
Yes Enabled Always On
• Hardware and software-enforced DEP coverage for all Windows
binaries, programs, and drivers.
• No programs or drivers can be exempted.
• System Compatibility Fixes (shims) for DEP do not take effect.
Always Off
• No hardware or software-enforced DEP is available for any part
of the system.
• The processor will not run in PAE mode unless a /PAE switch is
present in the BOOT.INI.
OptIn
(Default)
• Hardware and software-enforced DEP coverage for limited
Windows system binaries by default.
• Programs and drivers can be covered by both DEP and NX if
they explicitly specify to be covered (opt-in) by creating a shim.
• This is the default configuration in the BOOT.INI.
OptOut
• Hardware and software-enforced DEP coverage for all Windows
system binaries, programs, and drivers.
• You can exempt programs and drivers if you explicitly specify
they are not covered (opt-out).
• System Compatibility Fixes (shims) for DEP take effect.