Windows 10 Segment Heap Internals
[Pages:63]Windows 10 Segment Heap Internals
Mark Vincent Yason
IBM X-Force Advanced Research yasonm[at]ph[dot]ibm[dot]com @MarkYason
Agenda: Windows 10 Segment Heap
? Internals ? Security Mechanisms ? Case Study and Demonstration
2 IBM Security
WINDOWS 10 SEGMENT HEAP INTERNALS
Notes
? Companion white paper is available
Details of data structures, algorithms and internal functions
? Paper and presentation are based on the following NTDLL build
NTDLL.DLL (64-bit) version 10.0.14295.1000 From Windows 10 Redstone 1 Preview (Build 14295)
3 IBM Security
WINDOWS 10 SEGMENT HEAP INTERNALS
WINDOWS 10 SEGMENT HEAP INTERNALS
Internals: Overview
Architecture
5 IBM Security
WINDOWS 10 SEGMENT HEAP INTERNALS
Defaults
? Segment Heap is currently an opt-in feature
? Windows apps (Modern/Metro apps) are opted-in by default
Apps from the Windows Store, Microsoft Edge, etc.
? Executables with the following names are also opted-in by default (system processes)
csrss.exe, lsass.exe, runtimebroker.exe, services.exe, smss.exe,
svchost.exe
? NT Heap (older heap implementation) is still the default for traditional applications
6 IBM Security
WINDOWS 10 SEGMENT HEAP INTERNALS
Configuration
? Per-executable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\ CurrentVersion\Image File Execution Options\(executable) FrontEndHeapDebugOptions = (DWORD)
Bit 2 (0x04): Disable Segment Heap Bit 3 (0x08): Enable Segment Heap
? Global
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ Session Manager\Segment Heap Enabled = (DWORD)
0
: Disable Segment Heap
(Not 0): Enable Segment Heap
7 IBM Security
WINDOWS 10 SEGMENT HEAP INTERNALS
Edge Content Process Heaps
? Segment Heap: default process heap, MSVCRT heap, etc.
? Some heaps are still managed by the NT Heap (e.g.: shared heaps, heaps that are not growable)
8 IBM Security
WINDOWS 10 SEGMENT HEAP INTERNALS
................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related download
- operating systems memory management
- windows 10 optimization test results
- studio manager v2 installation guide english
- windows 10 enterprise 2019 ltsc for dell wyse thin clients
- windows 10 segment heap internals
- instruction manual for windows 10 recovery image download
- memory management
- window s 8 h eap internals
- memory management in vulkan and dx12
Related searches
- windows gadgets for windows 10 64 bit
- windows 7 to windows 10 free download
- windows journal download windows 10 64 bit
- microsoft windows edge windows 10 download
- windows microsoft windows 10 download
- windows 10 run windows update from cmd
- windows activator for windows 10 64 bit
- make windows 10 look like windows 7
- windows 10 windows start menu
- windows repair tool windows 10 64 bit
- windows 7 to windows 10 update tool
- windows 10 windows security enter network credentials