Testing EDB Functionality

As we just mentioned, Intel’s Execute Disable Bit is enabled through Windows XP Service Pack 2, but being proponents of testing as many supported features as possible we turned to Robert Schlabbach’s Data Execution Prevention Test (aka NXTEST) to test Intel’s EDB.

CPUs that support Data Execution Prevention (DEP) will have to run in Physical Address Extension mode in order to enable DEP support.  You can confirm the operating status by looking at the System Properties control panel:

Physical Address Extension should be listed here.

Before setting up NXTEST you have to enable full Data Execution Prevention under SP2. By default DEP is only enabled for certain Windows programs and services, given that NXTEST is not one off those Windows programs and services we had to manually enable DEP for all programs. 

Microsoft buries the DEP controls under the Performance Options control panel, to get there you must first visit the System Properties control panel:

Then click on the advanced tab and select the Performance Settings option.

The third tab in the Performance Options control panel is the Data Execution Prevention tab, which is where you can enable/disable system-wide DEP:

A reboot later we were ready to run NXTEST:

As expected, running the test confirmed that Intel’s EDB was working properly:

Intel didn’t make a huge deal out of EDB support for two likely reasons: 1) AMD beat them to the punch with their NX bit support, and 2) the benefits are not as tangible to end users since EDB doesn’t prevent all types of malicious code from wreaking havoc on your system, neither Intel nor AMD wish to inspire false confidence in their processors’ abilities to provide greater security.