任意代碼保護 - 防止非圖像支持的執(zhí)行代碼和代碼頁修改（例如VirtualAlloc / VirtualProtect創(chuàng)建/修改的代碼）
阻止低完整性圖像
阻止遠程圖像
阻止不受信任的字體
代碼完整性守護者
禁用Win32k系統(tǒng)調用
不允許子進程
導出地址過濾 - 將功能修補到另一個功能的一個常見方法中的一個步驟
導入地址過濾 - 將功能修補到另一個功能的一個常見方法中的一個步驟
模擬執(zhí)行
驗證API調用（CallerCheck）
驗證圖像依賴完整性
驗證堆棧完整性

xperf - “PROC_THREAD + LOADER”-f“wdeg_klogger.etl”
 
xperf -start“WDEG” - “Microsoft-Windows-Security-Mitigations：0xFFFFFFFFFFFFFF：0xFF：'stack'”-f“wdeg_unmerged.etl”

xperf -stop -stop“WDEG”-d“wdeg_merged.etl”

#include <Windows.h>#include <iostream>using namespace std;void* CreateCodeInVirtualMemory(BOOL writable)
{ BYTE code[3] = { 0x33, 0xc0, 0xc3 }; LPVOID result = VirtualAlloc(NULL, sizeof(code), MEM_COMMIT | MEM_RESERVE, writable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE); if (result)
{
  memcpy(result, code, sizeof(code));
} else cout << "VirtualAllocEx failed with error " << GetLastError() << endl; return result;
}void CreateCodeInVirtualMemoryAndExecute(BOOL useWritableMemory)
{ LPTHREAD_START_ROUTINE addr = (LPTHREAD_START_ROUTINE)CreateCodeInVirtualMemory(useWritableMemory); if (addr)
{  DWORD result = addr(NULL);
  cout << "Code at 0x" << hex << (void*)addr << " returned " << result << endl;
} else cout << "NULL address was not executed" << endl;
}void ExecuteIllegalMemory()
{
CreateCodeInVirtualMemoryAndExecute(FALSE);
} 
void PrintOptions()
{
cout << "Enter one of the following options:" <&lt; endl;
cout << "1 - Execute Memory Not Marked As Executable" << endl;
cout << "2 - Create Code in Virtual Memory" << endl;
cout << "3 - Create Code in Virtual Memory and Execute" << endl;
cout << "0 - Exit" << endl;
 
}void DecisionLoop()
{ while (true)
{  int selection;
  PrintOptions();
  cin >> selection;  switch (selection)
  {   case 0:    return;   case 1:
    ExecuteIllegalMemory();    break;   case 2:
    CreateCodeInVirtualMemory(TRUE);    break;   case 3:
    CreateCodeInVirtualMemoryAndExecute(TRUE);    break;   default:
    cout << "Invalid input" << endl;
  }
}
}int main()
{
DecisionLoop(); return 0;
}