softlogger Latest Articles ::Windows-VISTA

FAQ about HeapSetInformation in Windows Vista and Heap Based Buffer Overruns

Michael Howards Web Log : Security — 2008-02-19T00:00:00

2/19 - Added some Minor Tweaks

Perhaps it's the phase of the moon or something, but over the last few weeks I have received more email about correctly using the HeapSetInformation function than any other topic. I really don't know why! This was added last year as an SDL requirement.

So here's a quick FAQ:

Q: What does the HeapSetInformation function do?
A: It lets your application configure the Windows heap manager with a small number of options. The only security-related setting kills your application in case of heap corruption.

Q: What do you mean by "heap corruption"?
A: Anything that messes with data in the Windows heap, for example damaged caused by a buffer overrun, writing to a stray pointer or a double-free are examples.

Q: How do I use the function?
A: Like this:

BOOL f=HeapSetInformation(NULL, HeapEnableTerminationOnCorruption, NULL, 0);

Q: What should my code do if the function fails?
A: I think it's really up to you as this is not a critical failure, the call should only fail on a platform that does not support termination-on-corruption. This function offers a defense in depth, and is not required for successful operation of an application. So personally, I would just keep on running.

Q: What does this buy me?
A: Assume you code has a heap-based buffer overrun that you do not know about (because if you knew about it, you'd remove it!) If an attacker attempts to exploit it, there is a reasonable chance the attack might make the application crash rather than running exploit code.

Q: What if my code is Windows Vista and later only, can I use a linker option?
A: Yes, link with /SUBSYSTEM:WINDOWS,6.0

Q: Is this a "slam dunk" defense?
A: No. There is a no replacement for secure code, this is just a speed bump designed to make it harder for attackers to exploit heap-based vulnerabilities.

Q: When and where should I use this?
A: All the time - just add the code to your main() function.

Q: Which versions of Windows support termination on heap corruption?
A: Windows Vista and Windows Server 2008

Q: So what happens if I call HeapSetInformation with this option on a down-level version of Windows?
A: It's a no-op. you can call HeapSetInformation, but you simply won't get the defense.

Q: What about 64-bit Windows?
~~A: There is no need to call this API, the operating system enables termination-on-corruption by default. But you should call it anyway, because your code might run on 32-bit Windows.~~
A: By default, all 64-bit applications running on 64-bit Windows Vista or Windows Server 2008 get this defense by default, there is no need to call the function. A 32-bit application running on 64-bit Windows does not get the defense for free, the code must call the function.

Q: So if this is available on Windows Vista and Windows Server 2008 and later, do I need to use the Windows Vista (or later) SDKs?
A: No. The termination-on-corruption option is just a flag, so you could use code like the following if you're using an older SDK:

#ifndef HeapEnableTerminationOnCorruption
# define HeapEnableTerminationOnCorruption (HEAP_INFORMATION_CLASS)1
#endif

Q: Is there a performance hit.
A: No.

Q: Is there an application compatibility hit?
A: Possibly, but in my analysis of real world code: no. If your application crashes because of this API, and it never happened in the past without this API, then I suppose technically, that's a compatibility issue. However, you just hit some form of heap corruption which you need to fix, so fix the bug and remove the application compatibility issue!

Q: Is this still of use if grab a hunk of heap, and then perform my own sub-allocations? In other words, I have my own memory allocation system, and only use the operating system to give me the first chunk.
A: Since this API activates extra checking in the Windows heap manager, your sub-allocator won’t necessarily get much benefit. If you want to harden your implementation, make sure your allocator doesn’t include complex control structures or pointers in each block header. While we’re on the subject, is it crucial for you to have a sub-allocator anyway?

WPF Basics: How To Add Controls Dynamically at Run Time

VB & .NET Blogs @ vbCity.com — 2008-01-15T00:00:00

Adding controls at run time using VB.NET in Windows Forms is fairly well-documented. Finding C# code-behind samples for doing this with WPF controls under Framework 3.0 is also an easy task.
But I recently wanted to see how to do this with a WPF application in Visual Basic 2008 and I found that at the time of writing my searches produced no useful clear "How To" results.

Direct conversion from C# to VB using the current conversion tools didn't always identify some essential code elements, resulting in quite a frustrating time spent finding the correct way of doing this. (Not an unusual scenario nowadays, as more and more samples - including too many MSDN ones - seem to have only C# samples available).

Along the way I also discovered that not everything is as it seems - apparently difficult things were easy; things that seemed they should be easy turned out to be more difficult.
And of course as is often the case it turns out that there is more than one way to do most things.

Once you have solved the puzzles it all seems easy, but I thought I'd save you the trouble of having to work out the steps involved if you should need to do this before better Visual Basic documentation becomes available.

You can link to the first page of my article here.

Silverlight Mac\Windows debugging play-by-play

Brad Abrams — 2007-12-24T00:00:00

Martin saw my keynote at ReMix Boston and wanted to try the demo himself to find out if it was all just demo-magic or not ;-). Well, I am ~~relieved~~ happy to say he was successful! His detailed step-by-step instructions are the best I have seen for setting this up.

Windows Vista / Mac debugging a Silverlight app using Visual Studio 2008

Maybe we can talk Martin into doing the Linux part of the demo over the new year holiday ;-)

Embedding a Screensaver in a WinForm (Think "Application Level Privacy Screen")

Gregs Cool [Insert Clever Name] of the Day — 2007-12-22T00:00:00

Mark Schmidt's Abode - Embedding Screensaver's in a Windows Form

"Awhile ago I created the screensaver Vista Sidebar gadget and promised I would put some code up. As promised, here it is. It's actually quite easy to create something like this, and truth be told I actually had the code lying around for a few years since I wrote it for my 2nd book. Rather than confuse you with any sidebar code, I just created a simple Windows Form that hosts the screensaver UserControl (full source code can be downloaded below).

The hardest part (which is actually somewhat easy) is telling Windows to launch the screensaver within a certain window rather than fullscreen. You've seen this window in the control panel and may have wondered how it's done. To do this, you simply launch the screensaver (.scr file) and pass a command line parameter (/p for preview) and your window handle. The window handle can be accessed in a Windows Form or UserControl through the Handle property.
Below is the code that embeds a screensaver in my custom UserControl. ...
...
"

When I saw this example the first use case that came to mind was to use it to create a application level privacy screen.

Say you have a LOB WinForm application that contains sensitive data. Normally you might force a system wide screensaver policy or an application level timeout. Well an application should live in the app. IMHO I don't think it's polite for a user LOB app to take over the entire system (like forcing a system screensaver setting, etc).

Or maybe you have multiple monitors and you run the LOB app on one and other stuff on the other. And from a security point of view you want to LOB app to "hide" without affecting other app's, yet you don't want the LOB app to log off (and maybe lose work in process, etc).

So I'm thinking an application level privacy screen... And you might as well make it cool by using a Windows Screensaver... :)

Put a screensaver in a UserControl, hook into the app's mouse and keyboard events and if the app times out force that control to the top, fill the form and launch the screensaver. Security, privacy and coolness. ;)