Malware Removers Detect Malicious Software: Execute-Disable Bit capability is a robust hardware feature, detectable using the CPUID instruction, that protects against malicious software executing code on IA-32 systems. Software developers who implement it can deliver a valuable security feature to their users.

---

by Shijong Kuo. Intel Corp.

Execute Disable Bit capability is an enhancement to 32-bit Intel® architecture. An IA-32 processor with Execute Disable Bit capability can protect data pages against being used by malicious software to execute code. The processor provides page protection in either of the following modes:

• Legacy protected mode, if Physical Address Extension (PAE) is enabled.
• IA-32e mode, when Intel Extended Memory 64 Technology (Intel EM64T) is enabled.

Note that entering IA-32e mode requires enabling PAE. While the Execute Disable Bit capability does not introduce new instructions, it does require operating systems to operate in a PAE-enabled environment and to establish a page-granular protection policy for memory.

Execute Disable Bit Capability Overview
Software can detect the presence of the Execute Disable Bit capability using the CPUID instruction with the input value 80000001H in EAX. Presence is indicated by a value returned in EDX. If bit 20 of EDX is set, the Execute Disable Bit is available.

If CPUID extended function 80000001H reports that Execute Disable Bit capability is available and PAE is enabled, software can enable the Execute Disable Bit capability by setting the NXE bit to 1 in IA32_EFER MSR (address C0000080H). IA32_EFER is available if bit 20 or bit 29 of the EDX register returned by CPUID-extended function 80000001H is 1.

When Physical Address Extension is enabled (either in IA-32e mode or in legacy protected mode), Execute Disable Bit capability is enabled by setting bit 11 of IA32_EFER to 1. If CPUID extended function 80000001H reports Execute Disable Bit capability is not available, bit 11 of IA32_EFER is reserved. A write to IA32_EFER.NXE will produce a #GP exception.

Table 1. Extended Feature Enable MSR (IA32_EFER):

63:12	11	10	9	8	7:1	0
Reserved	Execute Disable Bit Enable (NXE)	IA-32e mode Active (LMA)	Reserved	IA-32e mode Enable (LME)	Reserved	SysCall Enable (SCE)