Article ID: 2639308 - View products that this article applies to.
Expand all | Collapse all

On This Page

Summary

This update introduces the Force ASLR (Address Space Layout Randomization) feature, which is an addition to the ASLR feature for Windows 7 or Windows Server 2008 R2. Click here for more information about ASLR.

This update provides support for the Force ASLR feature. This makes it possible for applications to forcibly relocate images that are not built with the /DYNAMICBASE linker flag. Applications can enable this feature by using new Image File Execution Options (IFEO). For more information about IFEO, visit the following Microsoft website:
General information about IFEO

More information

Update information

How to obtain this update

The following files are available for download from the Microsoft Download Center:
Collapse this tableExpand this table
Operating systemUpdate
All supported x86-based versions of Windows 7
Collapse this imageExpand this image
Download
Download the update package now.
All supported x64-based versions of Windows 7
Collapse this imageExpand this image
Download
Download the update package now.
All supported x64-based versions of Windows Server 2008 R2
Collapse this imageExpand this image
Download
Download the update package now.
All supported IA-64-based versions of Windows Server 2008 R2
Collapse this imageExpand this image
Download
Download the update package now.
For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591 How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Prerequisites

To apply this update, you must be running one of the following operating systems:
  • Windows 7
  • Windows 7 Service Pack 1 (SP1)
  • Windows Server 2008 R2
  • Windows Server 2008 R2 Service Pack 1 (SP1)
For more information about how to obtain a Windows 7 or a Windows Server 2008 R2 service pack, click the following article number to view the article in the Microsoft Knowledge Base:
976932 Information about Service Pack 1 for Windows 7 and for Windows Server 2008 R2

Registry information

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows
After you install this hotfix, follow these steps:
  1. Log on to your computer as an administrator.
  2. Click Start
    Collapse this imageExpand this image
    start button
    , type regedit in the Start Search box, and then press Enter.
  3. Locate and then click the following registry subkey:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  4. Under the Image File Execution Options folder, locate the name of your application (for example, Myapp.exe). If you cannot find your application:
    • Right-click the Image File Execution Options folder and select New Key.
    • Right-click the new key and select Rename.
    • Edit the key name to the name of your application, for example Myapp.exe.
  5. Right-click the Myapp.exe folder, select New, and then click QWORD Value.
  6. Right-click the new key and select Rename. Type MitigationOptions, and then press Enter.
  7. Click Edit, and then click Modify.
  8. In the Value data box, type 0x100, and then click OK.
  9. Exit Registry Editor.
    Note If the value is set to 0x300, images with stripped relocations will not load.

Restart requirement

You may have to restart the computer after you apply this update.

Update replacement information

This update does not replace a previously released update.

File information

The global version of this update installs files that have the attributes that are listed in the following tables. The dates and the times for these files are listed in Coordinated Universal Time (UTC). The dates and the times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and the times may change when you perform certain operations on the files.
Windows 7 and Windows Server 2008 R2 file information notes
  • The files that apply to a specific product, SR_Level (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table.
    Collapse this tableExpand this table
    VersionProductSR_LevelService branch
    6.1.760 0 . 16xxxWindows 7 and Windows Server 2008 R2RTMGDR
    6.1.760 0 . 20xxxWindows 7 and Windows Server 2008 R2RTMLDR
    6.1.760 1 . 17xxxWindows 7 and Windows Server 2008 R2SP1GDR
    6.1.760 1 . 21xxxWindows 7 and Windows Server 2008 R2SP1LDR
  • GDR service branches contain only those fixes that are widely released to address widespread, extremely important issues. LDR service branches contain hotfixes in addition to widely released fixes.
  • The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately in the "Additional file information for Windows Server 2008 R2 and for Windows 7" section. MUM and MANIFEST files, and the associated security catalog (.cat) files, are extremely important to maintain the state of the updated components. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.
For all supported x86-based versions of Windows 7
Collapse this tableExpand this table
File nameFile versionFile sizeDateTimePlatform
Ntkrnlpa.exe6.1.7600.169173,957,61619-Nov-201114:25Not applicable
Ntoskrnl.exe6.1.7600.169173,902,32019-Nov-201114:25Not applicable
Ntkrnlpa.exe6.1.7600.210943,971,44019-Nov-201111:24Not applicable
Ntoskrnl.exe6.1.7600.210943,915,63219-Nov-201111:24Not applicable
Ntkrnlpa.exe6.1.7601.177273,968,36819-Nov-201114:50Not applicable
Ntoskrnl.exe6.1.7601.177273,913,58419-Nov-201114:50Not applicable
Ntkrnlpa.exe6.1.7601.218633,971,44019-Nov-201111:11Not applicable
Ntoskrnl.exe6.1.7601.218633,916,65619-Nov-201111:11Not applicable
For all supported x64-based versions of Windows 7 and of Windows Server 2008 R2
Collapse this tableExpand this table
File nameFile versionFile sizeDateTimePlatform
Ntoskrnl.exe6.1.7600.169175,504,88019-Nov-201118:30x64
Ntoskrnl.exe6.1.7600.210945,473,13619-Nov-201112:34x64
Ntoskrnl.exe6.1.7601.177275,559,15219-Nov-201115:20x64
Ntoskrnl.exe6.1.7601.218635,561,20019-Nov-201112:04x64
Ntkrnlpa.exe6.1.7600.169173,957,61619-Nov-201114:25Not applicable
Ntoskrnl.exe6.1.7600.169173,902,32019-Nov-201114:25Not applicable
Ntkrnlpa.exe6.1.7600.210943,971,44019-Nov-201111:24Not applicable
Ntoskrnl.exe6.1.7600.210943,915,63219-Nov-201111:24Not applicable
Ntkrnlpa.exe6.1.7601.177273,968,36819-Nov-201114:50Not applicable
Ntoskrnl.exe6.1.7601.177273,913,58419-Nov-201114:50Not applicable
Ntkrnlpa.exe6.1.7601.218633,971,44019-Nov-201111:11Not applicable
Ntoskrnl.exe6.1.7601.218633,916,65619-Nov-201111:11Not applicable
For all supported IA-64-based versions of Windows Server 2008 R2
Collapse this tableExpand this table
File nameFile versionFile sizeDateTimePlatform
Ntoskrnl.exe6.1.7600.1691711,177,32819-Nov-201114:21IA-64
Ntoskrnl.exe6.1.7600.2109411,142,00019-Nov-201111:13IA-64
Ntoskrnl.exe6.1.7601.1772711,120,49619-Nov-201114:12IA-64
Ntoskrnl.exe6.1.7601.2186311,129,20019-Nov-201111:01IA-64
Ntkrnlpa.exe6.1.7600.169173,957,61619-Nov-201114:25Not applicable
Ntoskrnl.exe6.1.7600.169173,902,32019-Nov-201114:25Not applicable
Ntkrnlpa.exe6.1.7600.210943,971,44019-Nov-201111:24Not applicable
Ntoskrnl.exe6.1.7600.210943,915,63219-Nov-201111:24Not applicable
Ntkrnlpa.exe6.1.7601.177273,968,36819-Nov-201114:50Not applicable
Ntoskrnl.exe6.1.7601.177273,913,58419-Nov-201114:50Not applicable
Ntkrnlpa.exe6.1.7601.218633,971,44019-Nov-201111:11Not applicable
Ntoskrnl.exe6.1.7601.218633,916,65619-Nov-201111:11Not applicable

More information about ASLR

ASLR is one of the many mitigation technologies which make it difficult and costly for an attacker to exploit vulnerabilities in software. Specifically, ASLR makes the address space layout unpredictable to an attacker. Force ASLR improves the effectiveness of existing ASLR implementations by making it possible to forcibly relocate images that would not generally be randomized by ASLR. This helps to ensure that there are no predictable image mappings in the application’s address space.

urrently ASLR is enabled for any image built by using Microsoft Visual C++ 2008 or a later edition unless the linker flag /DYNAMICBASE:NO is used to opt out. This flag setting tells the linker not to set a special ASLR bit in the final executable image file. For more information about this special linker flag, visit the following Microsoft website:
General information about the /DYNAMICBASE linker flag
Executable images that do not have the ASLR bit set will generally load at their preferred base address.For more information about mitigation technologies, visit the following Microsoft website:
General information about mitigation technologies
How the Image File Execution Options (IFEO) registry entry works
The IFEO registry key path for a particular application on a computer is as follows:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Application Image Name, where the MitigationOptions value setting needs be specified.

This newly introduced IFEO registry entry enables computer administrators and software developers to apply Force ASLR behavior for only the non-ASLR images. The following table summarizes the conditions in which the Force ASLR feature is applied to a binary:
Collapse this imageExpand this image
2662731

Entropy of images relocated by Force ASLR

The Force ASLR feature does not guarantee a minimum degree of entropy for images that are forcibly relocated. Applications that want to ensure a minimum degree of entropy can implement a form of “bottom-up randomization.” Bottom-up randomization has the effect of randomizing addresses assigned by the bottom-up allocator that is used when it selects a base address for images that are forcibly relocated. Applications can implement bottom-up randomization by reserving a random number of 64 kilobyte (64K) regions by using the VirtualAlloc function. The maximum number of reserved regions dictates the entropy that will apply to forcibly relocated images.

For more information about the VirtualAlloc function, visit the following Microsoft website:
General information about the VirtualAlloc function
Application compatibility

Forcibly relocating images that are not built with support for ASLR may cause application compatibility problems. System administrators and software developers are encouraged to thoroughly test applications when enabling the Force ASLR feature.
For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates

Additional file information

Additional file information for Windows 7

Additional files for all supported x86-based versions of Windows 7
Collapse this tableExpand this table
File nameX86_4c849b9f953ff23cbd03120e7c7355e6_31bf3856ad364e35_6.1.7600.21094_none_cd366ffe60200e07.manifest
File versionNot applicable
File size717
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameX86_a1a40df738d9f29c3bec34f27de0d33a_31bf3856ad364e35_6.1.7600.16917_none_fef94f9f6ba5b9a0.manifest
File versionNot applicable
File size697
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameX86_b59092094779cae15109811d499a77b4_31bf3856ad364e35_6.1.7600.21094_none_84d4b00adae83f36.manifest
File versionNot applicable
File size697
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameX86_bffc18aa52230d0daa49b8720674de3e_31bf3856ad364e35_6.1.7600.16841_none_0cb32ea90a3edc33.manifest
File versionNot applicable
File size717
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameX86_d0aa463bff211116e88b6ff5f53df9ea_31bf3856ad364e35_6.1.7601.21863_none_fc44d31841a44c40.manifest
File versionNot applicable
File size697
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameX86_f15f0e2c3ff0a9be84d645ed9d41250f_31bf3856ad364e35_6.1.7601.17727_none_8e0ea66fbe8082dd.manifest
File versionNot applicable
File size697
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameX86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.16917_none_6c547330153c05da.manifest
File versionNot applicable
File size16,151
Date (UTC)19-Nov-2011
Time (UTC)19:54
File nameX86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.21094_none_6c8465f92e9d6f42.manifest
File versionNot applicable
File size16,151
Date (UTC)19-Nov-2011
Time (UTC)11:52
File nameX86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e30004a126a8db7.manifest
File versionNot applicable
File size16,151
Date (UTC)19-Nov-2011
Time (UTC)19:51
File nameX86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_6e8a5c3d2bac37e9.manifest
File versionNot applicable
File size16,151
Date (UTC)19-Nov-2011
Time (UTC)11:44
File nameX86_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.1.7600.16841_none_83fb97bc8f9ecf16.manifest
File versionNot applicable
File size8,047
Date (UTC)23-Jun-2011
Time (UTC)04:55
File nameX86_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.1.7600.21094_none_8451fdeba8e279dc.manifest
File versionNot applicable
File size8,047
Date (UTC)19-Nov-2011
Time (UTC)11:41
Additional files for all supported x64-based versions of Windows 7 and of Windows Server 2008 R2
Collapse this tableExpand this table
File nameAmd64_0e4b1feddab71a271e5e248c4c28654c_31bf3856ad364e35_6.1.7601.17727_none_4284c4548220800e.manifest
File versionNot applicable
File size701
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameAmd64_30e9e64bdc37c68d6ade06b44e6d41f9_31bf3856ad364e35_6.1.7600.21094_none_87a82642ec078a7a.manifest
File versionNot applicable
File size1,042
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameAmd64_32d14b46b25ef879ee0b9c553e2d066e_31bf3856ad364e35_6.1.7601.21863_none_83ac019f00b3743b.manifest
File versionNot applicable
File size1,042
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameAmd64_5d45097eb426019b8290506e5b7faa24_31bf3856ad364e35_6.1.7600.16841_none_29fb2b5f4788482f.manifest
File versionNot applicable
File size721
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameAmd64_7ffae595f6decdef86d6df31b864549a_31bf3856ad364e35_6.1.7601.17727_none_ce4406a26bedd2c6.manifest
File versionNot applicable
File size1,042
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameAmd64_a1a40df738d9f29c3bec34f27de0d33a_31bf3856ad364e35_6.1.7600.16917_none_5b17eb2324032ad6.manifest
File versionNot applicable
File size699
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameAmd64_a4a3c4f5d6cbce78079a8bcdc96b0c2c_31bf3856ad364e35_6.1.7600.21094_none_bb67f2e1d6a615ae.manifest
File versionNot applicable
File size721
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameAmd64_a63655942d6c7d4f6a0d6dafb091a374_31bf3856ad364e35_6.1.7600.16917_none_cb2ec6b8875dbe1b.manifest
File versionNot applicable
File size701
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameAmd64_b59092094779cae15109811d499a77b4_31bf3856ad364e35_6.1.7600.21094_none_e0f34b8e9345b06c.manifest
File versionNot applicable
File size699
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameAmd64_d0aa463bff211116e88b6ff5f53df9ea_31bf3856ad364e35_6.1.7601.21863_none_58636e9bfa01bd76.manifest
File versionNot applicable
File size699
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameAmd64_dc8f020bcff9a06b1ca8277f4205f614_31bf3856ad364e35_6.1.7600.21094_none_bbc0b4394bb35f72.manifest
File versionNot applicable
File size701
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameAmd64_ded180d6775ad9f0c9471946715c170f_31bf3856ad364e35_6.1.7600.16917_none_996d30a8355cea4f.manifest
File versionNot applicable
File size1,042
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameAmd64_e58cfe3ceeb96c0e2f2d9729d52d646a_31bf3856ad364e35_6.1.7601.21863_none_33fad96a96a9bae6.manifest
File versionNot applicable
File size701
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameAmd64_f15f0e2c3ff0a9be84d645ed9d41250f_31bf3856ad364e35_6.1.7601.17727_none_ea2d41f376ddf413.manifest
File versionNot applicable
File size699
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameAmd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.16917_none_c8730eb3cd997710.manifest
File versionNot applicable
File size15,291
Date (UTC)19-Nov-2011
Time (UTC)19:51
File nameAmd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.21094_none_c8a3017ce6fae078.manifest
File versionNot applicable
File size15,291
Date (UTC)19-Nov-2011
Time (UTC)13:02
File nameAmd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_ca4e9bcdcac7feed.manifest
File versionNot applicable
File size15,291
Date (UTC)19-Nov-2011
Time (UTC)19:53
File nameAmd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_caa8f7c0e409a91f.manifest
File versionNot applicable
File size15,291
Date (UTC)19-Nov-2011
Time (UTC)12:40
File nameAmd64_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.1.7600.16841_none_e01a334047fc404c.manifest
File versionNot applicable
File size8,049
Date (UTC)23-Jun-2011
Time (UTC)05:55
File nameAmd64_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.1.7600.21094_none_e070996f613feb12.manifest
File versionNot applicable
File size8,049
Date (UTC)19-Nov-2011
Time (UTC)12:50
Additional files for all supported x64-based versions of Windows 7 and of Windows Server 2008 R2
Collapse this tableExpand this table
File nameIa64_0b66d8c5380e8279e96e3d4945f2d8dd_31bf3856ad364e35_6.1.7600.16841_none_08bc4fb7d0649cb3.manifest
File versionNot applicable
File size719
Date (UTC)20-Nov-2011
Time (UTC)15:14
File nameIa64_1c65c0c36bcbc2ac8cbd29237807d789_31bf3856ad364e35_6.1.7600.16917_none_cd18cdf2dab5ac3a.manifest
File versionNot applicable
File size1,040
Date (UTC)20-Nov-2011
Time (UTC)15:14
File nameIa64_2030de0efb083b40b122073caee68060_31bf3856ad364e35_6.1.7601.21863_none_813d621ec37a1227.manifest
File versionNot applicable
File size1,040
Date (UTC)20-Nov-2011
Time (UTC)15:14
File nameIa64_2150869e2bff8fcad9abda47332aefee_31bf3856ad364e35_6.1.7600.21094_none_10a46444845f17b1.manifest
File versionNot applicable
File size1,040
Date (UTC)20-Nov-2011
Time (UTC)15:14
File nameIa64_25953bc6a6c47b2351b2069a994a15f4_31bf3856ad364e35_6.1.7600.21094_none_01de411e0b6bce41.manifest
File versionNot applicable
File size719
Date (UTC)20-Nov-2011
Time (UTC)15:14
File nameIa64_4039ed4699bf62c537e1f0dcea1eea2d_31bf3856ad364e35_6.1.7601.17727_none_84a32a3d910bd5be.manifest
File versionNot applicable
File size1,040
Date (UTC)20-Nov-2011
Time (UTC)15:14
File nameIa64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.16917_none_6c561726153a0ed6.manifest
File versionNot applicable
File size15,289
Date (UTC)19-Nov-2011
Time (UTC)15:24
File nameIa64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.21094_none_6c8609ef2e9b783e.manifest
File versionNot applicable
File size15,289
Date (UTC)19-Nov-2011
Time (UTC)12:46
File nameIa64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e31a440126896b3.manifest
File versionNot applicable
File size15,289
Date (UTC)19-Nov-2011
Time (UTC)15:17
File nameIa64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_6e8c00332baa40e5.manifest
File versionNot applicable
File size15,289
Date (UTC)19-Nov-2011
Time (UTC)12:34
File nameIa64_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.1.7600.16841_none_83fd3bb28f9cd812.manifest
File versionNot applicable
File size8,048
Date (UTC)23-Jun-2011
Time (UTC)05:48
File nameIa64_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.1.7600.21094_none_8453a1e1a8e082d8.manifest
File versionNot applicable
File size8,048
Date (UTC)19-Nov-2011
Time (UTC)12:37
File nameUpdate-bf.mum
File versionNot applicable
File size1,909
Date (UTC)20-Nov-2011
Time (UTC)15:15
File nameX86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.16917_none_6c547330153c05da.manifest
File versionNot applicable
File size16,151
Date (UTC)19-Nov-2011
Time (UTC)19:54
File nameX86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.21094_none_6c8465f92e9d6f42.manifest
File versionNot applicable
File size16,151
Date (UTC)19-Nov-2011
Time (UTC)11:52
File nameX86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e30004a126a8db7.manifest
File versionNot applicable
File size16,151
Date (UTC)19-Nov-2011
Time (UTC)19:51
File nameX86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_6e8a5c3d2bac37e9.manifest
File versionNot applicable
File size16,151
Date (UTC)19-Nov-2011
Time (UTC)11:44

Properties

Article ID: 2639308 - Last Review: January 4, 2013 - Revision: 6.0
Applies to
  • Windows 7 Enterprise
  • Windows 7 Home Basic
  • Windows 7 Home Premium
  • Windows 7 Professional
  • Windows 7 Starter
  • Windows 7 Ultimate
  • Windows Server 2008 R2 Standard
  • Windows Server 2008 R2 Foundation
  • Windows Server 2008 R2 Enterprise
  • Windows Server 2008 R2 Datacenter
  • Windows Server 2008 R2 for Itanium-Based Systems
Keywords: 
kbfix kbsurveynew kbexpertiseinter atdownload KB2639308

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com