Can Buffer overflow attacks succeed if DEP+SEHOP are on?

What about if only DEP is on?

 

Yes, with even Hardware DEP enabled, buffer overflows can spawn a shellcode that can download and execute other malware codes. Even with those advertised buffer overflows protection softwares.

This is based on my experience.

But since the end result is always to download and execute malware codes, any properly configured default deny security policy like the use of SRP, HIPS, AE or containment like Sandboxie, will terminate the malware infection pathway or the hacker's intrusion early on.

 

For an example, see Adobe Flash Player DEP and ASLR bypass affects browsers and Adobe Reader.

 

It depends on the exploit and the details of how it is carried out. ASLR itself can be defeated if the application in question uses a "just-in-time" compiler (which Flash does). They call it JIT spraying. But generally, DEP/ASLR makes it much tougher to find working exploits than used to be the case on Windows back in the day.