not necessarily. there are software emulation -- examples would be W^X on OpenBSD[1] and Grsecurity/PaX on linux[2]. Ubuntu[3] and RedHat[4] also has (partial

not necessarily. there are software emulation -- examples would be W^X on OpenBSD[1] and Grsecurity/PaX on linux[2]. Ubuntu[3] and RedHat[4] also has (partial) NX-emulation thanks to ExecShield. As for OpenBSD and Linux without grsec/pax, one can bypass NX (whether the CPU has the NX-bit or not) by marking the region with the shellcode as executable, eg: mprotect(shellcode & -pagesize, len, PROT_EXEC); ((void()()) shellcode)(); in an exploit this could be accomplished by ROPing 1: http://marc.info/?l=openbsd-misc&m=105056000801065 http://marc.info/?l=openbsd-misc&m=105056000801065 2: https://pax.grsecurity.net/docs/mprotect.txt https://pax.grsecurity.net/docs/mprotect.txt 3: https://outflux.net/blog/archives/2009/05/14/nx-emulation-in-ubuntu/ https://outflux.net/blog/archives/2009/05/14/nx-emulation-in... 4: https://en.wikipedia.org/wiki/Exec_Shield https://en.wikipedia.org/wiki/Exec_Shield