DEP/ASLR Implementation Progress in Popular Third-party Windows Applications

Interesting .. because with a x86 app running under WoW I can force the mem base of the loaded exe to 0x10000

this is mapped as RW but allows code execution as though RWX

First two images shows a typical standard dll characteristic which random mem maps 

the other two I forced a dll characteristic of 0 and force it to 0x10000 and I can execute any opcode despite the RW mapping

 

1) Since it is mapped as RW shouldnt DEP prevent any execution?
2) what is that first 0x10000 page called?

ive seen something about dos-compatibility but I’d like to know 

Edited June 20, 2020 by JMC31337

And I just found out my GlobalAlloc API memory which is mapped in RW space also has RWE ability 

Update:

Apparently after setting DllCharacteristics in a PE file to 0 for x86 apps the first page 0x10000 is used as a heap... this heap from my fuzzing around is used by user32/imm32/gdi32full type dll

if i 00 out the entire region then any dll that loads which is not a user32-type dll (imm32, gdi32full, user32) will crash sometimes...

manually 00'ng out this heap and using x64dbg to manually load dll (symbols section) will reproduce the crash..

 other times the crash is continuable under the debugger..

crashes types seen: Heap corruption, Out of Mem, critical errors

 

Edited August 10, 2020 by JMC31337

With updates as of Dec 1st, noticed the DllCharacteristics 0 trick will not work unless GlobalAlloc API memory is used... despite the GlobAlloc being RW mapped it’s still RWE capable {shrug}