Windows 10 Segment Heap Internals - Black Hat
[Pages:63]Windows 10 Segment Heap Internals
Mark Vincent Yason
IBM X-Force Advanced Research yasonm[at]ph[dot]ibm[dot]com @MarkYason
Agenda: Windows 10 Segment Heap
? Internals ? Security Mechanisms ? Case Study and Demonstration
2 IBM Security
WINDOWS 10 SEGMENT HEAP INTERNALS
Notes
? Companion white paper is available
Details of data structures, algorithms and internal functions
? Paper and presentation are based on the following NTDLL build
NTDLL.DLL (64-bit) version 10.0.14295.1000 From Windows 10 Redstone 1 Preview (Build 14295)
3 IBM Security
WINDOWS 10 SEGMENT HEAP INTERNALS
WINDOWS 10 SEGMENT HEAP INTERNALS
Internals: Overview
Architecture
5 IBM Security
WINDOWS 10 SEGMENT HEAP INTERNALS
Defaults
? Segment Heap is currently an opt-in feature
? Windows apps (Modern/Metro apps) are opted-in by default
Apps from the Windows Store, Microsoft Edge, etc.
? Executables with the following names are also opted-in by default (system processes)
csrss.exe, lsass.exe, runtimebroker.exe, services.exe, smss.exe,
svchost.exe
? NT Heap (older heap implementation) is still the default for traditional applications
6 IBM Security
WINDOWS 10 SEGMENT HEAP INTERNALS
Configuration
? Per-executable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\ CurrentVersion\Image File Execution Options\(executable) FrontEndHeapDebugOptions = (DWORD)
Bit 2 (0x04): Disable Segment Heap Bit 3 (0x08): Enable Segment Heap
? Global
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ Session Manager\Segment Heap Enabled = (DWORD)
0
: Disable Segment Heap
(Not 0): Enable Segment Heap
7 IBM Security
WINDOWS 10 SEGMENT HEAP INTERNALS
Edge Content Process Heaps
? Segment Heap: default process heap, MSVCRT heap, etc.
? Some heaps are still managed by the NT Heap (e.g.: shared heaps, heaps that are not growable)
8 IBM Security
WINDOWS 10 SEGMENT HEAP INTERNALS
................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related download
- product release summary aveva lfm server 5 2 0
- windows 10 segment heap internals black hat
- database installation guide
- installation and configuration of ocaml for windows 10
- industry pro rtm eula eval 3 11 13 final clean
- part 1 windows
- update on windows persistent memory support
- windows 10 iot enterprise for dell wyse thin clients
Related searches
- windows gadgets for windows 10 64 bit
- windows 7 to windows 10 free download
- windows journal download windows 10 64 bit
- microsoft windows edge windows 10 download
- windows microsoft windows 10 download
- windows 10 run windows update from cmd
- windows activator for windows 10 64 bit
- windows 10 lenovo camera black screen
- windows 10 black and white
- windows 10 turn off black and white
- black and white windows 10 fix
- windows 10 black screen with cursor