Class 04 · KP 13 / 18

NX / DEP and checksec

NX (No-eXecute), a.k.a. DEP on Windows, marks the stack and heap non-executable.
Result: classic stack shellcode injection simply fails — the payload bytes cannot execute.
checksec reports which protections a binary has.

$ checksec --file=./vuln
RELRO      STACK CANARY   NX          PIE
Full RELRO No canary      NX enabled  No PIE
# "NX enabled" -> the stack is non-executable:
# return-to-shellcode on the stack will not work.

Key Takeaway

Run checksec first. "NX enabled" tells you injected shellcode is off the table and you must reuse existing code.