[PATCH 0/2] MR4626: ntdll: Allow ASLR to be disabled via the registry

[Brendan McGrath (＠redmcg)]

Setting 'MoveImages' under:
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

to a DWORD with the value 0 will disable ASLR.

[PATCH 1/2] ntdll: Allow ASLR to be disabled via the registry

[Brendan McGrath]

From: Brendan McGrath

Setting 'MoveImages' under:
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

to a DWORD with the value 0 will disable ASLR.
---
 dlls/ntdll/unix/virtual.c | 46 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 45 insertions(+), 1 deletion(-)

diff --git a/dlls/ntdll/unix/virtual.c b/dlls/ntdll/unix/virtual.c
index 75e6319c007..dac01c6eb12 100644
--- a/dlls/ntdll/unix/virtual.c
+++ b/dlls/ntdll/unix/virtual.c
@@ -3011,6 +3011,49 @@ static NTSTATUS map_image_view( struct file_view **view_ret, pe_image_info_t *im
     return map_view( view_ret, NULL, size, top_down ? MEM_TOP_DOWN : 0, vprot, limit_low, limit_high, 0 );
 }

+static ULONG get_ASLR_reg_value(void)
+{
+    static const WCHAR Memory_ManagementW[] = {'\','R','e','g','i','s','t','r','y',
+        '\','M','a','c','h','i','n','e',
+        '\','S','y','s','t','e','m',
+        '\','C','u','r','r','e','n','t','C','o','n','t','r','o','l','S','e','t',
+        '\','C','o','n','t','r','o','l',
+        '\','S','e','s','s','i','o','n',' ','M','a','n','a','g','e','r',
+        '\','M','e','m','o','r','y',' ','M','a','n','a','g','e','m','e','n','t',0};
+    static const WCHAR MoveImagesW[] = {'M','o','v','e','I','m','a','g','e','s',0};
+    HANDLE key;
+    OBJECT_ATTRIBUTES attr;
+    UNICODE_STRING nameW;
+    ULONG ret = 1;
+
+    init_unicode_string( &nameW, Memory_ManagementW );
+    InitializeObjectAttributes( &attr, &nameW, 0, 0, NULL );
+    if (NtOpenKey( &key, KEY_READ, &attr ) == STATUS_SUCCESS)
+    {
+        char buf[256];
+        KEY_VALUE_PARTIAL_INFORMATION *info = (KEY_VALUE_PARTIAL_INFORMATION *)buf;
+        DWORD count;
+
+        init_unicode_string( &nameW, MoveImagesW );
+        if (NtQueryValueKey( key, &nameW, KeyValuePartialInformation, buf, sizeof(buf), &count ) == STATUS_SUCCESS &&
+            info->Type == REG_DWORD)
+                ret = *(ULONG *)info->Data;
+
+        NtClose(key);
+    }
+
+    return ret;
+}
+
+static BOOL ASLR_enabled(void)
+{
+    static LONG val = -1;
+
+    if (val == -1) val = !!get_ASLR_reg_value();
+
+    return val;
+}
+

/***********************************************************************
  *             virtual_map_image
@@ -3039,7 +3082,8 @@ static NTSTATUS virtual_map_image( HANDLE mapping, void **addr_ptr, SIZE_T *size
         return status;
     }

-    if (!image_info->map_addr &&
+    if (ASLR_enabled() &&
+        !image_info->map_addr &&
         (image_info->image_charact & IMAGE_FILE_DLL) &&
         (image_info->image_flags & IMAGE_FLAGS_ImageDynamicallyRelocated))
     {

[PATCH 2/2] ntdll/tests: Mark ProcessVmCounters tests as flaky

[Brendan McGrath]

From: Brendan McGrath

These tests can pass if the VirtualAlloc succeeds via the anon_mmap_alloc path
(which is not within the tests control)
---
 dlls/ntdll/tests/info.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dlls/ntdll/tests/info.c b/dlls/ntdll/tests/info.c
index 68a9f165bfd..c5d89d8448a 100644
--- a/dlls/ntdll/tests/info.c
+++ b/dlls/ntdll/tests/info.c
@@ -1925,7 +1925,8 @@ static void test_query_process_vm(void)
     ok( pvi.PrivateUsage == pvi.PagefileUsage, "wrong value %Iu/%Iu\n", pvi.PrivateUsage, pvi.PagefileUsage );
     if (winetest_debug > 1)
         dump_vm_counters("VM counters after VirtualAlloc", &pvi);
-    todo_wine ok( pvi.VirtualSize >= prev_size + alloc_size,
+    /* this test (and the one marked flaky below) can pass if the VirtualAlloc succeeds via anon_mmap_alloc */
+    flaky todo_wine ok( pvi.VirtualSize >= prev_size + alloc_size,
         "Expected to be greater than %Iu, got %Iu\n", prev_size + alloc_size, pvi.VirtualSize);
     VirtualFree( ptr, 0, MEM_RELEASE);

@@ -1942,7 +1943,7 @@ static void test_query_process_vm(void)
     ok( pvi.PrivateUsage == pvi.PagefileUsage, "wrong value %Iu/%Iu\n", pvi.PrivateUsage, pvi.PagefileUsage );
     if (winetest_debug > 1)
         dump_vm_counters("VM counters after VirtualAlloc(MEM_RESERVE)", &pvi);
-    todo_wine ok( pvi.VirtualSize >= prev_size + alloc_size,
+    flaky todo_wine ok( pvi.VirtualSize >= prev_size + alloc_size,
         "Expected to be greater than %Iu, got %Iu\n", prev_size + alloc_size, pvi.VirtualSize);
     prev_size = pvi.VirtualSize;

[Brendan McGrath (＠redmcg)]

Closing this MR as the issue has been addressed elsewhere.

[PATCH 0/2] MR4626: ntdll: Allow ASLR to be disabled via the registry - closed

[Brendan McGrath (＠redmcg)]

This merge request was closed by Brendan McGrath.