search

pharo-project / pharo

Pharo is a dynamic reflective pure object-oriented language supporting live programming inspired by Smalltalk.
http://pharo.org
Other
1.21k stars 356 forks source link

MS Windows Security can hinder Pharo.exe #8445

Open noellapin opened 3 years ago

noellapin commented 3 years ago

MS Windows Security/Defender(MSWS) can hinder Pharo.exe.

1)When MSWS ensures control flow integrity, Pharo.exe does not run. 2)When MSWS forces relocation of images (not Smalltalk image), Pharo.exe runs with errors. 3)When MSWS does not check the control flow and does not relocate the image, Pharo.exe runs without an error.

Windows 10 Home, version 20H2, build 19042.746 I'm using the default Pharo Launcher installed by pharo-launcher-2.2.msi. I run the Pharo Launcher as admin.

The MSWS settings are the following. In "App & browser control", in "Exploit protection settings", the "System settings" are all set as "On by default". Where the "System settings" are: Control flow, Data Execution, Force randomization, Radomize memory, High-entropy, Validate exception, Validate heap. In "Program settings", one program is added to customize. The only customized program is C:/Users/noel_/AppData/Local/PharoLauncher/Pharo.exe. By "Edit", many settings can be selected by square checkboxes. Where only two checkboxes are selected - "Control flow guard" and "Force randomization for images". The default system settings are "On" by the "System settings" stated above.

When two slide buttons are left-side "Off", Pharo.exe runs OK.

When the slide button of "Control flow guard" is right-side "On", Pharo Launcher does not run. Diagnostic Data Viewer (MS Store app) reports as follows. (--- Pharo Cog Spur Virtual Machine

Description Faulting Application Path: C:/Users/noel_/AppData/Local/PharoLauncher/Pharo.exe Creation Time: 1/29/2021 7:27:33 PM Problem: Stopped working Status: Report sent

Problem signature Problem Event Name: BEX64 Application Name: Pharo.exe Application Version: 5.0.0.0 Application Timestamp: 00000000 Fault Module Name: msvcrt.dll Fault Module Version: 7.0.19041.546 Fault Module Timestamp: 564f9f39 Exception Offset: 0000000000030a70 Exception Code: c0000409 Exception Data: 000000000000000d

Extra information about the problem Bucket ID: 3075bcac0c4047b71d4c5ed39e7acdc3 (2111166588319878595) ---)

When "Force randomization" is right-side "On", Pharo Launcher runs with errors. Diagnostic Data Viewer does not record any errors. Pharo Launcher's error screen is: https://www.dropbox.com/s/0k6img63zdj8s90/PharoLauncher.jpg?dl=0

I think this error is the same one as posted on 12 Nov 2020 https://github.com/pharo-project/pharo/issues/7725

noellapin commented 3 years ago

As stated in #7725, I manually made a non-default Pharo.exe from /files.pharo.org/vm/pharo-spur64/win/stable-20201102.zip /files.pharo.org/get-files/80/pharo64.zip

This non-default Pharo.exe can run without an error even when MSWS forces randomization. But when MSWS checks flow integrity, this Pharo.exe does not run． Diagnostic Data Viewer is (--- Problem signature Problem Event Name: BEX64 Application Name: Pharo.exe Application Version: 8.6.1.0 Application Timestamp: 5f85bd00 Fault Module Name: msvcrt.dll Fault Module Version: 7.0.19041.546 Fault Module Timestamp: 564f9f39 Exception Offset: 0000000000030a70 Exception Code: c0000409 Exception Data: 000000000000000d ---)

kderichs commented 1 year ago

You must not disable any other checkboxes but "Control flow guard" and "Force randomization for images". I tried to be proactive and disabled everything which did not work at all.