lkd> !process 0n1984 0
Searching for Process with Cid == 7c0
PROCESS 85d97268 SessionId: 0 Cid: 07c0    Peb: 7ffdb000 ParentCid: 0788
    DirBase: 17fc00a0 ObjectTable: e12c9158 HandleCount: 466.
    Image: lsass.exe

lkd> dt nt!_KPROCESS Flags. 0x85d97268
   +0x06b Flags :
      +0x000 ExecuteDisable : 0y0
      +0x000 ExecuteEnable : 0y0
      +0x000 DisableThunkEmulation : 0y0
      +0x000 Permanent : 0y0
      +0x000 ExecuteDispatchEnable : 0y0
      +0x000 ImageDispatchEnable : 0y0
      +0x000 Spare : 0y00

lkd> !process 0n448 0
Searching for Process with Cid == 1c0
PROCESS 84f2c3b8 SessionId: 0 Cid: 01c0    Peb: 7ffdc000 ParentCid: 04a0
    DirBase: 17fc0480 ObjectTable: e44a91f0 HandleCount: 731.
    Image: QQ.exe

lkd> dt nt!_KPROCESS Flags. 0x84f2c3b8
   +0x06b Flags :
      +0x000 ExecuteDisable : 0y0
      +0x000 ExecuteEnable : 0y1
      +0x000 DisableThunkEmulation : 0y0
      +0x000 Permanent : 0y0
      +0x000 ExecuteDispatchEnable : 0y1
      +0x000 ImageDispatchEnable : 0y1
      +0x000 Spare : 0y00

通过编写驱动可以从内核中取出这些信息，从而判断进程是否打开了 DEP 保护。还可以直接修改这些值，切换进程的 DEP 状态。