Defeating Microsoft Windows XP SP2 Heap protection and DEP bypass:

http://www.maxpatrol.com/defeating-xpsp2-heap-protection.htm

(parent page with some more stuff, including example program: http://www.maxpatrol.com/ptmshorp.asp)