Sign in with Microsoft
Sign in or create an account.
Hello,
Select a different account.
You have multiple accounts
Choose the account you want to sign in with.

Summary

This update introduces the Force ASLR (Address Space Layout Randomization) feature, which is an addition to the ASLR feature for Windows 7 or Windows Server 2008 R2. Click here for more information about ASLR.

This update provides support for the Force ASLR feature. This makes it possible for applications to forcibly relocate images that are not built with the /DYNAMICBASE linker flag. Applications can enable this feature by using new Image File Execution Options (IFEO). For more information about IFEO, visit the following Microsoft website:

General information about IFEO

More Information

Update information

How to obtain this update

The following files are available for download from the Microsoft Download Center:

Operating system

Update

All supported x86-based versions of Windows 7

Download Download the update package now.

All supported x64-based versions of Windows 7

Download Download the update package now.

All supported x64-based versions of Windows Server 2008 R2

Download Download the update package now.

All supported IA-64-based versions of Windows Server 2008 R2

Download Download the update package now.

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Prerequisites

To apply this update, you must be running one of the following operating systems:

  • Windows 7

  • Windows 7 Service Pack 1 (SP1)

  • Windows Server 2008 R2

  • Windows Server 2008 R2 Service Pack 1 (SP1)

For more information about how to obtain a Windows 7 or a Windows Server 2008 R2 service pack, click the following article number to view the article in the Microsoft Knowledge Base:

976932 Information about Service Pack 1 for Windows 7 and for Windows Server 2008 R2

Registry information

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in WindowsAfter you install this hotfix, follow these steps:

  1. Log on to your computer as an administrator.

  2. Click Start start button , type regedit in the Start Search box, and then press Enter.

  3. Locate and then click the following registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

  4. Under the Image File Execution Options folder, locate the name of your application (for example, Myapp.exe). If you cannot find your application:

    • Right-click the Image File Execution Options folder and select New Key.

    • Right-click the new key and select Rename.

    • Edit the key name to the name of your application, for example Myapp.exe.

  5. Right-click the Myapp.exe folder, select New, and then click QWORD Value.

  6. Right-click the new key and select Rename. Type MitigationOptions, and then press Enter.

  7. Click Edit, and then click Modify.

  8. In the Value data box, type 0x100, and then click OK.

  9. Exit Registry Editor.
    Note If the value is set to 0x300, images with stripped relocations will not load.

Restart requirement

You may have to restart the computer after you apply this update.

Update replacement information

This update does not replace a previously released update.

File information

The global version of this update installs files that have the attributes that are listed in the following tables. The dates and the times for these files are listed in Coordinated Universal Time (UTC). The dates and the times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and the times may change when you perform certain operations on the files.

Windows 7 and Windows Server 2008 R2 file information notes


  • The files that apply to a specific product, SR_Level (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table.

    Version

    Product

    SR_Level

    Service branch

    6.1.760
    0.
    16xxx

    Windows 7 and Windows Server 2008 R2

    RTM

    GDR

    6.1.760
    0.
    20xxx

    Windows 7 and Windows Server 2008 R2

    RTM

    LDR

    6.1.760
    1.
    17xxx

    Windows 7 and Windows Server 2008 R2

    SP1

    GDR

    6.1.760
    1.
    21xxx

    Windows 7 and Windows Server 2008 R2

    SP1

    LDR

  • GDR service branches contain only those fixes that are widely released to address widespread, extremely important issues. LDR service branches contain hotfixes in addition to widely released fixes.

  • The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately in the "Additional file information for Windows Server 2008 R2 and for Windows 7" section. MUM and MANIFEST files, and the associated security catalog (.cat) files, are extremely important to maintain the state of the updated components. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.

For all supported x86-based versions of Windows 7

File name

File version

File size

Date

Time

Platform

Ntkrnlpa.exe

6.1.7600.16917

3,957,616

19-Nov-2011

14:25

Not applicable

Ntoskrnl.exe

6.1.7600.16917

3,902,320

19-Nov-2011

14:25

Not applicable

Ntkrnlpa.exe

6.1.7600.21094

3,971,440

19-Nov-2011

11:24

Not applicable

Ntoskrnl.exe

6.1.7600.21094

3,915,632

19-Nov-2011

11:24

Not applicable

Ntkrnlpa.exe

6.1.7601.17727

3,968,368

19-Nov-2011

14:50

Not applicable

Ntoskrnl.exe

6.1.7601.17727

3,913,584

19-Nov-2011

14:50

Not applicable

Ntkrnlpa.exe

6.1.7601.21863

3,971,440

19-Nov-2011

11:11

Not applicable

Ntoskrnl.exe

6.1.7601.21863

3,916,656

19-Nov-2011

11:11

Not applicable

For all supported x64-based versions of Windows 7 and of Windows Server 2008 R2

File name

File version

File size

Date

Time

Platform

Ntoskrnl.exe

6.1.7600.16917

5,504,880

19-Nov-2011

18:30

x64

Ntoskrnl.exe

6.1.7600.21094

5,473,136

19-Nov-2011

12:34

x64

Ntoskrnl.exe

6.1.7601.17727

5,559,152

19-Nov-2011

15:20

x64

Ntoskrnl.exe

6.1.7601.21863

5,561,200

19-Nov-2011

12:04

x64

Ntkrnlpa.exe

6.1.7600.16917

3,957,616

19-Nov-2011

14:25

Not applicable

Ntoskrnl.exe

6.1.7600.16917

3,902,320

19-Nov-2011

14:25

Not applicable

Ntkrnlpa.exe

6.1.7600.21094

3,971,440

19-Nov-2011

11:24

Not applicable

Ntoskrnl.exe

6.1.7600.21094

3,915,632

19-Nov-2011

11:24

Not applicable

Ntkrnlpa.exe

6.1.7601.17727

3,968,368

19-Nov-2011

14:50

Not applicable

Ntoskrnl.exe

6.1.7601.17727

3,913,584

19-Nov-2011

14:50

Not applicable

Ntkrnlpa.exe

6.1.7601.21863

3,971,440

19-Nov-2011

11:11

Not applicable

Ntoskrnl.exe

6.1.7601.21863

3,916,656

19-Nov-2011

11:11

Not applicable

For all supported IA-64-based versions of Windows Server 2008 R2

File name

File version

File size

Date

Time

Platform

Ntoskrnl.exe

6.1.7600.16917

11,177,328

19-Nov-2011

14:21

IA-64

Ntoskrnl.exe

6.1.7600.21094

11,142,000

19-Nov-2011

11:13

IA-64

Ntoskrnl.exe

6.1.7601.17727

11,120,496

19-Nov-2011

14:12

IA-64

Ntoskrnl.exe

6.1.7601.21863

11,129,200

19-Nov-2011

11:01

IA-64

Ntkrnlpa.exe

6.1.7600.16917

3,957,616

19-Nov-2011

14:25

Not applicable

Ntoskrnl.exe

6.1.7600.16917

3,902,320

19-Nov-2011

14:25

Not applicable

Ntkrnlpa.exe

6.1.7600.21094

3,971,440

19-Nov-2011

11:24

Not applicable

Ntoskrnl.exe

6.1.7600.21094

3,915,632

19-Nov-2011

11:24

Not applicable

Ntkrnlpa.exe

6.1.7601.17727

3,968,368

19-Nov-2011

14:50

Not applicable

Ntoskrnl.exe

6.1.7601.17727

3,913,584

19-Nov-2011

14:50

Not applicable

Ntkrnlpa.exe

6.1.7601.21863

3,971,440

19-Nov-2011

11:11

Not applicable

Ntoskrnl.exe

6.1.7601.21863

3,916,656

19-Nov-2011

11:11

Not applicable

More information about ASLR

ASLR is one of the many mitigation technologies which make it difficult and costly for an attacker to exploit vulnerabilities in software. Specifically, ASLR makes the address space layout unpredictable to an attacker. Force ASLR improves the effectiveness of existing ASLR implementations by making it possible to forcibly relocate images that would not generally be randomized by ASLR. This helps to ensure that there are no predictable image mappings in the application’s address space.

urrently ASLR is enabled for any image built by using Microsoft Visual C++ 2008 or a later edition unless the linker flag /DYNAMICBASE:NO is used to opt out. This flag setting tells the linker not to set a special ASLR bit in the final executable image file. For more information about this special linker flag, visit the following Microsoft website:

General information about the /DYNAMICBASE linker flagExecutable images that do not have the ASLR bit set will generally load at their preferred base address.For more information about mitigation technologies, visit the following Microsoft website:

General information about mitigation technologiesHow the Image File Execution Options (IFEO) registry entry works
The IFEO registry key path for a particular application on a computer is as follows:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Application Image Name, where the MitigationOptions value setting needs be specified.

This newly introduced IFEO registry entry enables computer administrators and software developers to apply Force ASLR behavior for only the non-ASLR images. The following table summarizes the conditions in which the Force ASLR feature is applied to a binary:
Entropy of images relocated by Force ASLR

The Force ASLR feature does not guarantee a minimum degree of entropy for images that are forcibly relocated. Applications that want to ensure a minimum degree of entropy can implement a form of “bottom-up randomization.” Bottom-up randomization has the effect of randomizing addresses assigned by the bottom-up allocator that is used when it selects a base address for images that are forcibly relocated. Applications can implement bottom-up randomization by reserving a random number of 64 kilobyte (64K) regions by using the VirtualAlloc function. The maximum number of reserved regions dictates the entropy that will apply to forcibly relocated images.

For more information about the VirtualAlloc function, visit the following Microsoft website:

General information about the VirtualAlloc functionApplication compatibility

Forcibly relocating images that are not built with support for ASLR may cause application compatibility problems. System administrators and software developers are encouraged to thoroughly test applications when enabling the Force ASLR feature.
For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

Additional file information

Additional file information for Windows 7

Additional files for all supported x86-based versions of Windows 7

File name

X86_4c849b9f953ff23cbd03120e7c7355e6_31bf3856ad364e35_6.1.7600.21094_none_cd366ffe60200e07.manifest

File version

Not applicable

File size

717

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

X86_a1a40df738d9f29c3bec34f27de0d33a_31bf3856ad364e35_6.1.7600.16917_none_fef94f9f6ba5b9a0.manifest

File version

Not applicable

File size

697

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

X86_b59092094779cae15109811d499a77b4_31bf3856ad364e35_6.1.7600.21094_none_84d4b00adae83f36.manifest

File version

Not applicable

File size

697

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

X86_bffc18aa52230d0daa49b8720674de3e_31bf3856ad364e35_6.1.7600.16841_none_0cb32ea90a3edc33.manifest

File version

Not applicable

File size

717

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

X86_d0aa463bff211116e88b6ff5f53df9ea_31bf3856ad364e35_6.1.7601.21863_none_fc44d31841a44c40.manifest

File version

Not applicable

File size

697

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

X86_f15f0e2c3ff0a9be84d645ed9d41250f_31bf3856ad364e35_6.1.7601.17727_none_8e0ea66fbe8082dd.manifest

File version

Not applicable

File size

697

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

X86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.16917_none_6c547330153c05da.manifest

File version

Not applicable

File size

16,151

Date (UTC)

19-Nov-2011

Time (UTC)

19:54

File name

X86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.21094_none_6c8465f92e9d6f42.manifest

File version

Not applicable

File size

16,151

Date (UTC)

19-Nov-2011

Time (UTC)

11:52

File name

X86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e30004a126a8db7.manifest

File version

Not applicable

File size

16,151

Date (UTC)

19-Nov-2011

Time (UTC)

19:51

File name

X86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_6e8a5c3d2bac37e9.manifest

File version

Not applicable

File size

16,151

Date (UTC)

19-Nov-2011

Time (UTC)

11:44

File name

X86_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.1.7600.16841_none_83fb97bc8f9ecf16.manifest

File version

Not applicable

File size

8,047

Date (UTC)

23-Jun-2011

Time (UTC)

04:55

File name

X86_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.1.7600.21094_none_8451fdeba8e279dc.manifest

File version

Not applicable

File size

8,047

Date (UTC)

19-Nov-2011

Time (UTC)

11:41

Additional files for all supported x64-based versions of Windows 7 and of Windows Server 2008 R2

File name

Amd64_0e4b1feddab71a271e5e248c4c28654c_31bf3856ad364e35_6.1.7601.17727_none_4284c4548220800e.manifest

File version

Not applicable

File size

701

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

Amd64_30e9e64bdc37c68d6ade06b44e6d41f9_31bf3856ad364e35_6.1.7600.21094_none_87a82642ec078a7a.manifest

File version

Not applicable

File size

1,042

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

Amd64_32d14b46b25ef879ee0b9c553e2d066e_31bf3856ad364e35_6.1.7601.21863_none_83ac019f00b3743b.manifest

File version

Not applicable

File size

1,042

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

Amd64_5d45097eb426019b8290506e5b7faa24_31bf3856ad364e35_6.1.7600.16841_none_29fb2b5f4788482f.manifest

File version

Not applicable

File size

721

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

Amd64_7ffae595f6decdef86d6df31b864549a_31bf3856ad364e35_6.1.7601.17727_none_ce4406a26bedd2c6.manifest

File version

Not applicable

File size

1,042

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

Amd64_a1a40df738d9f29c3bec34f27de0d33a_31bf3856ad364e35_6.1.7600.16917_none_5b17eb2324032ad6.manifest

File version

Not applicable

File size

699

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

Amd64_a4a3c4f5d6cbce78079a8bcdc96b0c2c_31bf3856ad364e35_6.1.7600.21094_none_bb67f2e1d6a615ae.manifest

File version

Not applicable

File size

721

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

Amd64_a63655942d6c7d4f6a0d6dafb091a374_31bf3856ad364e35_6.1.7600.16917_none_cb2ec6b8875dbe1b.manifest

File version

Not applicable

File size

701

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

Amd64_b59092094779cae15109811d499a77b4_31bf3856ad364e35_6.1.7600.21094_none_e0f34b8e9345b06c.manifest

File version

Not applicable

File size

699

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

Amd64_d0aa463bff211116e88b6ff5f53df9ea_31bf3856ad364e35_6.1.7601.21863_none_58636e9bfa01bd76.manifest

File version

Not applicable

File size

699

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

Amd64_dc8f020bcff9a06b1ca8277f4205f614_31bf3856ad364e35_6.1.7600.21094_none_bbc0b4394bb35f72.manifest

File version

Not applicable

File size

701

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

Amd64_ded180d6775ad9f0c9471946715c170f_31bf3856ad364e35_6.1.7600.16917_none_996d30a8355cea4f.manifest

File version

Not applicable

File size

1,042

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

Amd64_e58cfe3ceeb96c0e2f2d9729d52d646a_31bf3856ad364e35_6.1.7601.21863_none_33fad96a96a9bae6.manifest

File version

Not applicable

File size

701

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

Amd64_f15f0e2c3ff0a9be84d645ed9d41250f_31bf3856ad364e35_6.1.7601.17727_none_ea2d41f376ddf413.manifest

File version

Not applicable

File size

699

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

Amd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.16917_none_c8730eb3cd997710.manifest

File version

Not applicable

File size

15,291

Date (UTC)

19-Nov-2011

Time (UTC)

19:51

File name

Amd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.21094_none_c8a3017ce6fae078.manifest

File version

Not applicable

File size

15,291

Date (UTC)

19-Nov-2011

Time (UTC)

13:02

File name

Amd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_ca4e9bcdcac7feed.manifest

File version

Not applicable

File size

15,291

Date (UTC)

19-Nov-2011

Time (UTC)

19:53

File name

Amd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_caa8f7c0e409a91f.manifest

File version

Not applicable

File size

15,291

Date (UTC)

19-Nov-2011

Time (UTC)

12:40

File name

Amd64_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.1.7600.16841_none_e01a334047fc404c.manifest

File version

Not applicable

File size

8,049

Date (UTC)

23-Jun-2011

Time (UTC)

05:55

File name

Amd64_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.1.7600.21094_none_e070996f613feb12.manifest

File version

Not applicable

File size

8,049

Date (UTC)

19-Nov-2011

Time (UTC)

12:50

Additional files for all supported x64-based versions of Windows 7 and of Windows Server 2008 R2

File name

Ia64_0b66d8c5380e8279e96e3d4945f2d8dd_31bf3856ad364e35_6.1.7600.16841_none_08bc4fb7d0649cb3.manifest

File version

Not applicable

File size

719

Date (UTC)

20-Nov-2011

Time (UTC)

15:14

File name

Ia64_1c65c0c36bcbc2ac8cbd29237807d789_31bf3856ad364e35_6.1.7600.16917_none_cd18cdf2dab5ac3a.manifest

File version

Not applicable

File size

1,040

Date (UTC)

20-Nov-2011

Time (UTC)

15:14

File name

Ia64_2030de0efb083b40b122073caee68060_31bf3856ad364e35_6.1.7601.21863_none_813d621ec37a1227.manifest

File version

Not applicable

File size

1,040

Date (UTC)

20-Nov-2011

Time (UTC)

15:14

File name

Ia64_2150869e2bff8fcad9abda47332aefee_31bf3856ad364e35_6.1.7600.21094_none_10a46444845f17b1.manifest

File version

Not applicable

File size

1,040

Date (UTC)

20-Nov-2011

Time (UTC)

15:14

File name

Ia64_25953bc6a6c47b2351b2069a994a15f4_31bf3856ad364e35_6.1.7600.21094_none_01de411e0b6bce41.manifest

File version

Not applicable

File size

719

Date (UTC)

20-Nov-2011

Time (UTC)

15:14

File name

Ia64_4039ed4699bf62c537e1f0dcea1eea2d_31bf3856ad364e35_6.1.7601.17727_none_84a32a3d910bd5be.manifest

File version

Not applicable

File size

1,040

Date (UTC)

20-Nov-2011

Time (UTC)

15:14

File name

Ia64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.16917_none_6c561726153a0ed6.manifest

File version

Not applicable

File size

15,289

Date (UTC)

19-Nov-2011

Time (UTC)

15:24

File name

Ia64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.21094_none_6c8609ef2e9b783e.manifest

File version

Not applicable

File size

15,289

Date (UTC)

19-Nov-2011

Time (UTC)

12:46

File name

Ia64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e31a440126896b3.manifest

File version

Not applicable

File size

15,289

Date (UTC)

19-Nov-2011

Time (UTC)

15:17

File name

Ia64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_6e8c00332baa40e5.manifest

File version

Not applicable

File size

15,289

Date (UTC)

19-Nov-2011

Time (UTC)

12:34

File name

Ia64_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.1.7600.16841_none_83fd3bb28f9cd812.manifest

File version

Not applicable

File size

8,048

Date (UTC)

23-Jun-2011

Time (UTC)

05:48

File name

Ia64_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.1.7600.21094_none_8453a1e1a8e082d8.manifest

File version

Not applicable

File size

8,048

Date (UTC)

19-Nov-2011

Time (UTC)

12:37

File name

Update-bf.mum

File version

Not applicable

File size

1,909

Date (UTC)

20-Nov-2011

Time (UTC)

15:15

File name

X86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.16917_none_6c547330153c05da.manifest

File version

Not applicable

File size

16,151

Date (UTC)

19-Nov-2011

Time (UTC)

19:54

File name

X86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.21094_none_6c8465f92e9d6f42.manifest

File version

Not applicable

File size

16,151

Date (UTC)

19-Nov-2011

Time (UTC)

11:52

File name

X86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e30004a126a8db7.manifest

File version

Not applicable

File size

16,151

Date (UTC)

19-Nov-2011

Time (UTC)

19:51

File name

X86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_6e8a5c3d2bac37e9.manifest

File version

Not applicable

File size

16,151

Date (UTC)

19-Nov-2011

Time (UTC)

11:44

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.

Was this information helpful?

What affected your experience?
By pressing submit, your feedback will be used to improve Microsoft products and services. Your IT admin will be able to collect this data. Privacy Statement.

Thank you for your feedback!

×