任意代碼保護(hù) - 防止非圖像支持的執(zhí)行代碼和代碼頁修改（例如VirtualAlloc / VirtualProtect創(chuàng)建/修改的代碼）
阻止低完整性圖像
阻止遠(yuǎn)程圖像
阻止不受信任的字體
代碼完整性守護(hù)者
禁用Win32k系統(tǒng)調(diào)用
不允許子進(jìn)程
導(dǎo)出地址過濾 - 將功能修補(bǔ)到另一個(gè)功能的一個(gè)常見方法中的一個(gè)步驟
導(dǎo)入地址過濾 - 將功能修補(bǔ)到另一個(gè)功能的一個(gè)常見方法中的一個(gè)步驟
模擬執(zhí)行
驗(yàn)證API調(diào)用（CallerCheck）
驗(yàn)證圖像依賴完整性
驗(yàn)證堆棧完整性

xperf - “PROC_THREAD + LOADER”-f“wdeg_klogger.etl”
 
xperf -start“WDEG” - “Microsoft-Windows-Security-Mitigations：0xFFFFFFFFFFFFFF：0xFF：'stack'”-f“wdeg_unmerged.etl”

xperf -stop -stop“WDEG”-d“wdeg_merged.etl”

#include <Windows.h>#include <iostream>using namespace std;void* CreateCodeInVirtualMemory(BOOL writable)
{ BYTE code[3] = { 0x33, 0xc0, 0xc3 }; LPVOID result = VirtualAlloc(NULL, sizeof(code), MEM_COMMIT | MEM_RESERVE, writable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE); if (result)
{
  memcpy(result, code, sizeof(code));
} else cout << "VirtualAllocEx failed with error " << GetLastError() << endl; return result;
}void CreateCodeInVirtualMemoryAndExecute(BOOL useWritableMemory)
{ LPTHREAD_START_ROUTINE addr = (LPTHREAD_START_ROUTINE)CreateCodeInVirtualMemory(useWritableMemory); if (addr)
{  DWORD result = addr(NULL);
  cout << "Code at 0x" << hex << (void*)addr << " returned " << result << endl;
} else cout << "NULL address was not executed" << endl;
}void ExecuteIllegalMemory()
{
CreateCodeInVirtualMemoryAndExecute(FALSE);
} 
void PrintOptions()
{
cout << "Enter one of the following options:" << endl;
cout << "1 - Execute Memory Not Marked As Executable" << endl;
cout << "2 - Create Code in Virtual Memory" << endl;
cout << "3 - Create Code in Virtual Memory and Execute" << endl;
cout << "0 - Exit" << endl;
 
}void DecisionLoop()
{ while (true)
{  int selection;
  PrintOptions();
  cin >> selection;  switch (selection)
  {   case 0:    return;   case 1:
    ExecuteIllegalMemory();    break;   case 2:
    CreateCodeInVirtualMemory(TRUE);    break;   case 3:
    CreateCodeInVirtualMemoryAndExecute(TRUE);    break;   default:
    cout << "Invalid input" << endl;
  }
}
}int main()
{
DecisionLoop(); return 0;
}