Definition
NX (Data Execution Prevention)
NX — also called DEP, Data Execution Prevention — is a hardware/OS defence that makes the stack (and every other data segment) not executable. Only the code segments emitted by the compiler retain execute permission; writable pages lose it. The complementarity is the rule: writable and executable are mutually exclusive on a given memory segment, often written W^X.
Effect
What NX closes, and the primitive it forces
NX stops the injected-shellcode variant of instruction pointer hijacking cold: trying to execute bytes from the stack now segfaults. The attacker can still overwrite the saved return address, but jumping it onto the stack yields a SEGFAULT rather than a shell.
But the saved return address is still on the stack, and the binary still contains code. So the technique migrates from “execute the bytes I wrote” (shellcode) to “execute the bytes the binary already has” — ROP and its libc / PLT variants. NX closes one stage of the technique family; it does not close the saved-return-address overwrite that drives the rest.
Bypass
Warning
The bypass of NX is structural, not circumstantial: jump to code already in the binary. That is exactly what ROP does, chaining snippets of legitimate code instead of injecting new code. NX does not, on its own, stop a ret2libc chain that calls
system—systemisNX-legal code in libc, run from a writable-free region the attacker merely pointed at. The cluster’s ASLR and PIE are what make the addresses needed to point at that code hard to come by.