{"id":4483,"date":"2009-05-21T11:40:00","date_gmt":"2009-05-21T11:40:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/vcblog\/2009\/05\/21\/dynamicbase-and-nxcompat\/"},"modified":"2019-02-18T18:45:55","modified_gmt":"2019-02-18T18:45:55","slug":"dynamicbase-and-nxcompat","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/cppblog\/dynamicbase-and-nxcompat\/","title":{"rendered":"\/DYNAMICBASE and \/NXCOMPAT"},"content":{"rendered":"

Hello, my name is Xiang Fan and I am a developer on the C++ Shanghai team.<\/font><\/font><\/p>\n

Today I\u2019d like to talk about two linker options related to security: \/DYNAMICBASE and \/NXCOMPAT.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

These two options are introduced in VS2005, and target to improve the overall security of native applications.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

You can set these two options explicitly in VS IDE:<\/font><\/font><\/p>\n

<\/font><\/font> <\/p>\n

<\/font><\/font><\/p>\n

 <\/p>\n

These two options have three available values in the IDE: On, Off and Default.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

They are set to \u201cOn\u201d if you create native C++ application using VS2008 wizard. <\/font><\/font><\/p>\n

When VS2008 upgrades projects created by older version of VC which doesn\u2019t support these options, it will set them to \u201cOff\u201d after upgrade.<\/font><\/font><\/p>\n

If you set them to \u201cDefault\u201d, linker will treat it as \u201cOff\u201d.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

After several years adoption, we plan to change the behavior of \u201cDefault\u201d to \u201cOn\u201d in VS2010 to reinforce the security. And we\u2019d like to get your feedback.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

Here are the detailed information about these two options:<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

1.<\/font><\/span>      <\/span>DYNAMICBASE<\/font><\/a><\/span><\/p>\n

 <\/font><\/font><\/p>\n

\/DYNAMICBASE modifies the header of an executable to indicate whether the application should be randomly rebased at load time by the OS. The random rebase is well known as ASLR (Address space layout randomization).<\/font><\/font><\/p>\n

This option also implies \u201c\/FIXED:NO\u201d, which will generate a relocation section in the executable. See \/FIXED<\/font><\/a><\/span> for more information.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

In VS2008, this option is on by default if a component requires Windows Vista (\/SUBSYSTEM<\/font><\/a><\/span> 6.0 and greater)<\/font><\/font><\/p>\n

\/DYNAMICBASE:NO can be used to explicitly disable the random rebase.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

This article talks about ASLR: <\/font>http:\/\/technet.microsoft.com\/en-us\/magazine\/cc162458.aspx<\/font><\/a> <\/span><\/font><\/font><\/p>\n

ASLR is supported only on Windows Vista and later operating systems. It will be ignored on older OS.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

ASLR is transparent to the application. With ASLR, the only difference is OS will rebase the executable unconditionally instead of doing it only when an image base conflict exists.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

2.<\/font><\/span>      <\/span>NXCOMPAT<\/font><\/a><\/span><\/p>\n

 <\/font><\/font><\/p>\n

\/NXCOMPAT is used to specify an executable as compatible with DEP <\/span>(Data Execution Prevention)<\/font><\/font><\/p>\n

Notice that, this option applies for x86 executable only. Non-x86 architecture versions of desktop Windows (e.g. x64 and IA64) always enforce DEP if the executable is not running in WOW64 mode.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

Here is a comprehensive description of DEP:<\/font><\/font><\/p>\n

http:\/\/support.microsoft.com\/kb\/875352<\/font><\/a><\/p>\n

 <\/font><\/font><\/p>\n

This option is on by default if a component requires Windows Vista (\/SUBSYSTEM<\/font><\/a><\/span> 6.0 and greater).<\/font><\/font><\/p>\n

\/NXCOMPAT:NO can be used to explicitly specify an executable as not compatible with DEP.<\/font><\/font><\/p>\n

However, the administrator can still enable the DEP even if the executable is not specified as compatible with DEP. So you should always test your application with DEP on.<\/font><\/font><\/p>\n

 <\/font><\/span><\/p>\n

Windows Vista SP1, Windows XP SP3 and Windows Server 2008 add a new API <\/font>SetProcessDEPPolicy<\/font><\/a> to allow the developer to set DEP on their process at runtime rather than using linker options. See the following link for more details:<\/font><\/font><\/p>\n

http:\/\/blogs.msdn.com\/michael_howard\/archive\/2008\/01\/29\/new-nx-apis-added-to-windows-vista-sp1-windows-xp-sp3-and-windows-server-2008.aspx<\/font><\/a><\/span><\/p>\n

 <\/font><\/span><\/p>\n

There are several common (and incomplete) patterns which are not compatible with DEP (See <\/font>http:\/\/msdn.microsoft.com\/en-us\/library\/aa366553.aspx<\/font><\/a> for more information.)<\/font><\/font><\/p>\n

a.<\/font>       <\/span>Dynamic code generated in heap or stack<\/font><\/font><\/p>\n

If your application must run code from a memory page, it must allocate and set the proper virtual <\/font>memory protection<\/font><\/span><\/a> attributes.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

The allocated memory must be marked PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, or PAGE_EXECUTE_WRITECOPY when allocating memory. Heap allocations made by calling the new<\/b>, <\/span>malloc<\/b> and <\/span><\/font><\/font>HeapAlloc<\/font><\/span><\/b><\/a> functions are non-executable. An application can use the <\/font>VirtualAlloc<\/font><\/span><\/b><\/a> function to allocate executable memory with the appropriate memory protection options.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

Another option is to pass HEAP_CREATE_ENABLE_EXECUTE when create the heap via  HeapCreate. Then the memory allocated by the subsequent HeapAlloc will be executable.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

b.<\/font>      <\/span>Executable code in data section<\/font><\/font><\/p>\n

They should be migrated to a code section<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

Security vulnerabilities are more exploitable than they would be if DEP were enabled. So you should always make your application DEP compatible and turn DEP on.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

The following sample <\/span>demonstrates the code which is not compatible with DEP.<\/font><\/font><\/p>\n

It also shows two DEP compatible ways to run the code on heap.<\/font><\/font><\/p>\n

Running code in data section or on stack almost always implies security holes. You have to put the code in code section or heap instead.<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

#include<\/span> “windows.h”<\/span><\/span><\/p>\n

#include<\/span> <cstdio><\/span><\/span><\/p>\n

 <\/font><\/font><\/p>\n

typedef<\/span> void<\/span> (*funType)();<\/span><\/p>\n

unsigned<\/span> char<\/span> gCode[] = {0xC3}; \/\/ \u201dret\u201d instruction on x86<\/span><\/span><\/p>\n

const<\/span> size_t gCodeSize = sizeof<\/span>(gCode);<\/span><\/p>\n

 <\/font><\/font><\/p>\n

\/\/ these are not DEP compatible<\/span><\/p>\n

 <\/font><\/font><\/p>\n

void<\/span> RunCodeOnHeap()<\/span><\/p>\n

{<\/span><\/p>\n

    unsigned<\/span> char<\/span> *code = new<\/span> unsigned<\/span> char<\/span>[gCodeSize];<\/span><\/p>\n

    memcpy(code, gCode, gCodeSize);<\/span><\/p>\n

 <\/font><\/font><\/p>\n

    funType fun = reinterpret_cast<\/span><funType>(code);<\/span><\/p>\n

    fun();<\/span><\/p>\n

 <\/font><\/font><\/p>\n

    delete<\/span> []code;<\/span><\/p>\n

}<\/span><\/p>\n

 <\/font><\/font><\/p>\n

\/\/ these are DEP compatible<\/span><\/p>\n

 <\/font><\/font><\/p>\n

void<\/span> RunCodeOnHeapCompatible1()<\/span><\/p>\n

{<\/span><\/p>\n

    unsigned<\/span> char<\/span> *code = (unsigned<\/span> char<\/span> *)::VirtualAlloc(NULL, gCodeSize, MEM_COMMIT, PAGE_READWRITE);<\/span><\/p>\n

    memcpy(code, gCode, gCodeSize);<\/span><\/p>\n

 <\/font><\/font><\/p>\n

    DWORD flOldProtect;<\/span><\/p>\n

    ::VirtualProtect(code, gCodeSize, PAGE_EXECUTE_READ, &flOldProtect);<\/span><\/p>\n

 <\/font><\/font><\/p>\n

    funType fun = reinterpret_cast<\/span><funType>(code);<\/span><\/p>\n

    fun();<\/span><\/p>\n

 <\/font><\/font><\/p>\n

    ::VirtualFree(code, 0, MEM_RELEASE);<\/span><\/p>\n

}<\/span><\/p>\n

void<\/span> RunCodeOnHeapCompatible2()<\/span><\/p>\n

{<\/span><\/p>\n

    HANDLE hheap = ::HeapCreate(HEAP_CREATE_ENABLE_EXECUTE, 0, 0);<\/span><\/p>\n

 <\/font><\/font><\/p>\n

    unsigned<\/span> char<\/span> *code = (unsigned<\/span> char<\/span> *)::HeapAlloc(hheap, 0, gCodeSize);<\/span><\/p>\n

    memcpy(code, gCode, gCodeSize);<\/span><\/p>\n

 <\/font><\/font><\/p>\n

    funType fun = reinterpret_cast<\/span><funType>(code);<\/span><\/p>\n

    fun();<\/span><\/p>\n

 <\/font><\/font><\/p>\n

    ::HeapFree(hheap, 0, code);<\/span><\/p>\n

    ::HeapDestroy(hheap);<\/span><\/p>\n

}<\/span><\/p>\n

 <\/font><\/font><\/p>\n

INT DEPExceptionFilter(LPEXCEPTION_POINTERS lpInfo)<\/span><\/p>\n

{<\/span><\/p>\n

    \/\/ please check http:\/\/technet.microsoft.com\/en-us\/library\/bb457155.aspx<\/font><\/a> <\/span><\/span><\/p>\n

    \/\/ for more information<\/span><\/span><\/p>\n

 <\/font><\/font><\/p>\n

    if<\/span> (lpInfo->ExceptionRecord->ExceptionCode == STATUS_ACCESS_VIOLATION &&<\/span><\/p>\n

        lpInfo->ExceptionRecord->ExceptionInformation[0] == 8) {<\/span><\/p>\n

        return<\/span> EXCEPTION_EXECUTE_HANDLER;<\/span><\/p>\n

    }<\/span><\/p>\n

 <\/font><\/font><\/p>\n

    return<\/span> EXCEPTION_CONTINUE_SEARCH;<\/span><\/p>\n

}<\/span><\/p>\n

 <\/font><\/font><\/p>\n

int<\/span> main()<\/span><\/p>\n

{<\/span><\/p>\n

    __try<\/span><\/span><\/p>\n

    {<\/span><\/p>\n

        RunCodeOnHeap();<\/span><\/p>\n

        printf(“RunCodeOnHeap: OK\\n”<\/span>);<\/span><\/p>\n

    }<\/span><\/p>\n

    __except<\/span> (DEPExceptionFilter(GetExceptionInformation()))<\/span><\/p>\n

    {<\/span><\/p>\n

        printf(“RunCodeOnHeap: Fail due to DEP\\n”<\/span>);<\/span><\/p>\n

    }<\/span><\/p>\n

    __try<\/span><\/span><\/p>\n

    {<\/span><\/p>\n

        RunCodeOnHeapCompatible1();<\/span><\/p>\n

        printf(“RunCodeOnHeapCompatible1: OK\\n”<\/span>);<\/span><\/p>\n

    }<\/span><\/p>\n

    __except<\/span> (DEPExceptionFilter(GetExceptionInformation()))<\/span><\/p>\n

    {<\/span><\/p>\n

        printf(“RunCodeOnHeapCompatible1: Fail due to DEP\\n”<\/span>);<\/span><\/p>\n

    }<\/span><\/p>\n

    __try<\/span><\/span><\/p>\n

    {<\/span><\/p>\n

        RunCodeOnHeapCompatible2();<\/span><\/p>\n

        printf(“RunCodeOnHeapCompatible2: OK\\n”<\/span>);<\/span><\/p>\n

    }<\/span><\/p>\n

    __except<\/span> (DEPExceptionFilter(GetExceptionInformation()))<\/span><\/p>\n

    {<\/span><\/p>\n

        printf(“RunCodeOnHeapCompatible2: Fail due to DEP\\n”<\/span>);<\/span><\/p>\n

    }<\/span><\/p>\n

}<\/span><\/p>\n

 <\/font><\/font><\/p>\n

Output:<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

cl test.cpp \/link \/nxcompat:no<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

RunCodeOnHeap: OK<\/font><\/font><\/p>\n

RunCodeOnHeapCompatible1: OK<\/font><\/font><\/p>\n

RunCodeOnHeapCompatible2: OK<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

cl test.cpp \/link \/nxcompat<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

RunCodeOnHeap: Fail due to DEP<\/font><\/font><\/p>\n

RunCodeOnHeapCompatible1: OK<\/font><\/font><\/p>\n

RunCodeOnHeapCompatible2: OK<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

In summary, \u201ccl test.cpp\u201d is equivalent to \u201ccl test.cpp \/link \/nxcompat:no \/dynamicbase:no\u201d before VS2010. We plan to change it to \u201ccl test.cpp \/link \/nxcompat \/dynamicbase\u201d in VS2010.<\/font><\/font><\/p>\n

If you have any concerns about the default behavior change of these two options, don\u2019t hesitate to give your feedback. Thanks!<\/font><\/font><\/p>\n

 <\/font><\/font><\/p>\n

Regards,<\/span><\/font><\/p>\n

    Xiang<\/font><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Hello, my name is Xiang Fan and I am a developer on the C++ Shanghai team. Today I\u2019d like to talk about two linker options related to security: \/DYNAMICBASE and \/NXCOMPAT.   These two options are introduced in VS2005, and target to improve the overall security of native applications.   You can set these two […]<\/p>\n","protected":false},"author":289,"featured_media":35994,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-4483","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cplusplus"],"acf":[],"blog_post_summary":"

Hello, my name is Xiang Fan and I am a developer on the C++ Shanghai team. Today I\u2019d like to talk about two linker options related to security: \/DYNAMICBASE and \/NXCOMPAT.   These two options are introduced in VS2005, and target to improve the overall security of native applications.   You can set these two […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/posts\/4483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/users\/289"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/comments?post=4483"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/posts\/4483\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/media\/35994"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/media?parent=4483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/categories?post=4483"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/tags?post=4483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}