Skip to content

Add verify strategy for ASLR exclusion step #1053

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
HotCakeX merged 5 commits into from
Feb 21, 2026
Merged

Add verify strategy for ASLR exclusion step #1053

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
614044f
Add verify strategy for ASLR exclusion step
26zl Feb 18, 2026
1af551d
Merge branch 'main' into aslr-verify-remove
HotCakeX Feb 20, 2026
e3a88b8
Change return value to true when no incompatible files
HotCakeX Feb 21, 2026
a5b3917
Merge branch 'main' into aslr-verify-remove
HotCakeX Feb 21, 2026
e79b5a2
Refine comments for clarity in MicrosoftDefenderVM.cs
HotCakeX Feb 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Harden System Security/Strings/AR/Resources.resw
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1115,7 +1115,7 @@
<value>فشل في تعيين قيمة Boot Configuration Data (BCD) No-eXecute (NX).</value>
</data>
<data name="ApplyMandatoryASLRExcl-MSDefender" xml:space="preserve">
<value>استبعاد ملفات GitHub Desktop و Git و MSYS2/MinGW التنفيذية غير المتوافقة من ASLR الإلزامي على مستوى النظام.</value>
<value>استبعاد ملفات GitHub Desktop و Git و MSYS2 التنفيذية غير المتوافقة من ASLR الإلزامي على مستوى النظام.</value>
</data>
<data name="BetaUpdateChannels-MSDefender" xml:space="preserve">
<value>تكوين قنوات تحديث محرك ومنصة Microsoft Defender إلى بيتا.</value>
Expand Down
2 changes: 1 addition & 1 deletion Harden System Security/Strings/ES/Resources.resw
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1115,7 +1115,7 @@
<value>Falló al establecer el valor Boot Configuration Data (BCD) No-eXecute (NX).</value>
</data>
<data name="ApplyMandatoryASLRExcl-MSDefender" xml:space="preserve">
<value>Excluyendo los ejecutables incompatibles de GitHub Desktop, Git y MSYS2/MinGW del ASLR obligatorio a nivel del sistema.</value>
<value>Excluyendo los ejecutables incompatibles de GitHub Desktop, Git y MSYS2 del ASLR obligatorio a nivel del sistema.</value>
</data>
<data name="BetaUpdateChannels-MSDefender" xml:space="preserve">
<value>Configurando los canales de actualización del motor y plataforma de Microsoft Defender a beta.</value>
Expand Down
2 changes: 1 addition & 1 deletion Harden System Security/Strings/de-DE/Resources.resw
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1115,7 +1115,7 @@
<value>Festlegen des No-eXecute-(NX)-Werts in den Bootkonfigurationsdaten (BCD) fehlgeschlagen.</value>
</data>
<data name="ApplyMandatoryASLRExcl-MSDefender" xml:space="preserve">
<value>Inkompatible ausführbare Dateien von GitHub Desktop, Git und MSYS2/MinGW vom systemweiten verpflichtenden ASLR ausnehmen.</value>
<value>Inkompatible ausführbare Dateien von GitHub Desktop, Git und MSYS2 vom systemweiten verpflichtenden ASLR ausnehmen.</value>
</data>
<data name="BetaUpdateChannels-MSDefender" xml:space="preserve">
<value>Aktualisierungskanäle für Engine und Plattform von Microsoft Defender auf Beta konfigurieren.</value>
Expand Down
2 changes: 1 addition & 1 deletion Harden System Security/Strings/el-GR/Resources.resw
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1115,7 +1115,7 @@
<value>Αποτυχία ρύθμισης της τιμής Boot Configuration Data (BCD) No-eXecute (NX).</value>
</data>
<data name="ApplyMandatoryASLRExcl-MSDefender" xml:space="preserve">
<value>Εξαίρεση των μη συμβατών εκτελέσιμων αρχείων GitHub Desktop, Git και MSYS2/MinGW από το υποχρεωτικό ASLR σε επίπεδο συστήματος.</value>
<value>Εξαίρεση των μη συμβατών εκτελέσιμων αρχείων GitHub Desktop, Git και MSYS2 από το υποχρεωτικό ASLR σε επίπεδο συστήματος.</value>
</data>
<data name="BetaUpdateChannels-MSDefender" xml:space="preserve">
<value>Διαμόρφωση των καναλιών ενημέρωσης μηχανής και πλατφόρμας του Microsoft Defender σε beta.</value>
Expand Down
2 changes: 1 addition & 1 deletion Harden System Security/Strings/en-US/Resources.resw
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1115,7 +1115,7 @@
<value>Failed to set the Boot Configuration Data (BCD) No-eXecute (NX) Value.</value>
</data>
<data name="ApplyMandatoryASLRExcl-MSDefender" xml:space="preserve">
<value>Exclude incompatible GitHub Desktop, Git, and MSYS2/MinGW executables from the system-wide Mandatory ASLR.</value>
<value>Exclude incompatible GitHub Desktop, Git, and MSYS2 executables from the system-wide Mandatory ASLR.</value>
</data>
<data name="BetaUpdateChannels-MSDefender" xml:space="preserve">
<value>Configure the Microsoft Defender Engine and Platform update channels to beta.</value>
Expand Down
2 changes: 1 addition & 1 deletion Harden System Security/Strings/fr-FR/Resources.resw
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1115,7 +1115,7 @@
<value>Échec de la définition de la valeur No-eXecute (NX) des données de configuration de démarrage (BCD).</value>
</data>
<data name="ApplyMandatoryASLRExcl-MSDefender" xml:space="preserve">
<value>Exclure les exécutables GitHub Desktop, Git et MSYS2/MinGW incompatibles de l'ASLR obligatoire à l'échelle du système.</value>
<value>Exclure les exécutables GitHub Desktop, Git et MSYS2 incompatibles de l'ASLR obligatoire à l'échelle du système.</value>
</data>
<data name="BetaUpdateChannels-MSDefender" xml:space="preserve">
<value>Configurer les canaux de mise à jour du moteur et de la plateforme Microsoft Defender en version bêta.</value>
Expand Down
2 changes: 1 addition & 1 deletion Harden System Security/Strings/he-IL/Resources.resw
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1115,7 +1115,7 @@
<value>נכשל בהגדרת ערך No-eXecute (NX) ב-Boot Configuration Data (BCD).</value>
</data>
<data name="ApplyMandatoryASLRExcl-MSDefender" xml:space="preserve">
<value>החרגת קובצי ההפעלה הבלתי תואמים של GitHub Desktop, Git ו-MSYS2/MinGW מ-Mandatory ASLR בכל המערכת.</value>
<value>החרגת קובצי ההפעלה הבלתי תואמים של GitHub Desktop, Git ו-MSYS2 מ-Mandatory ASLR בכל המערכת.</value>
</data>
<data name="BetaUpdateChannels-MSDefender" xml:space="preserve">
<value>הגדרת ערוצי העדכון של Engine ו-Platform של Microsoft Defender ל-beta.</value>
Expand Down
2 changes: 1 addition & 1 deletion Harden System Security/Strings/hi-IN/Resources.resw
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1115,7 +1115,7 @@
<value>Boot Configuration Data (BCD) No-eXecute (NX) मान सेट करने में विफल।</value>
</data>
<data name="ApplyMandatoryASLRExcl-MSDefender" xml:space="preserve">
<value>सिस्टम-वाइड अनिवार्य ASLR से असंगत GitHub Desktop, Git और MSYS2/MinGW एक्जीक्यूटेबल को बाहर कर रहे हैं।</value>
<value>सिस्टम-वाइड अनिवार्य ASLR से असंगत GitHub Desktop, Git और MSYS2 एक्जीक्यूटेबल को बाहर कर रहे हैं।</value>
</data>
<data name="BetaUpdateChannels-MSDefender" xml:space="preserve">
<value>Microsoft Defender इंजन और प्लेटफॉर्म अपडेट चैनल को बीटा पर कॉन्फ़िगर कर रहे हैं।</value>
Expand Down
2 changes: 1 addition & 1 deletion Harden System Security/Strings/ml-IN/Resources.resw
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1115,7 +1115,7 @@
<value>Boot Configuration Data (BCD) No-eXecute (NX) മൂല്യം സെറ്റ് ചെയ്യുന്നതിൽ പരാജയപ്പെട്ടു.</value>
</data>
<data name="ApplyMandatoryASLRExcl-MSDefender" xml:space="preserve">
<value>സിസ്റ്റം-വൈഡ് നിർബന്ധിത ASLR-ൽ നിന്ന് പൊരുത്തമില്ലാത്ത GitHub Desktop, Git, MSYS2/MinGW എക്സിക്യൂട്ടബിളുകൾ ഒഴിവാക്കുന്നു.</value>
<value>സിസ്റ്റം-വൈഡ് നിർബന്ധിത ASLR-ൽ നിന്ന് പൊരുത്തമില്ലാത്ത GitHub Desktop, Git, MSYS2 എക്സിക്യൂട്ടബിളുകൾ ഒഴിവാക്കുന്നു.</value>
</data>
<data name="BetaUpdateChannels-MSDefender" xml:space="preserve">
<value>Microsoft Defender എഞ്ചിൻ, പ്ലാറ്റ്‌ഫോം അപ്ഡേറ്റ് ചാനലുകൾ ബീറ്റയിലേക്ക് കോൺഫിഗർ ചെയ്യുന്നു.</value>
Expand Down
2 changes: 1 addition & 1 deletion Harden System Security/Strings/pl-PL/Resources.resw
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1115,7 +1115,7 @@
<value>Nie udało się ustawić wartości Boot Configuration Data (BCD) No-eXecute (NX).</value>
</data>
<data name="ApplyMandatoryASLRExcl-MSDefender" xml:space="preserve">
<value>Wykluczanie niezgodnych plików wykonywalnych GitHub Desktop, Git i MSYS2/MinGW z obowiązkowego ASLR w całym systemie.</value>
<value>Wykluczanie niezgodnych plików wykonywalnych GitHub Desktop, Git i MSYS2 z obowiązkowego ASLR w całym systemie.</value>
</data>
<data name="BetaUpdateChannels-MSDefender" xml:space="preserve">
<value>Konfigurowanie kanałów aktualizacji silnika i platformy Microsoft Defender na beta.</value>
Expand Down
54 changes: 54 additions & 0 deletions Harden System Security/ViewModels/MicrosoftDefenderVM.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -498,7 +498,61 @@ private static List<MUnit> CreateUnits()
}
}
}
}),

verifyStrategy: new DefaultVerify(() =>
{
// Collect all of the ASLR-Incompatible files.
HashSet<string> results = BinarySecurityAnalyzer.GetASLRIncompatibleExes();

// No incompatible files found means nothing has been applied.
if (results.Count is 0)
{
return true;
}

foreach (string item in results)
{
// Use the filename to query registry, then match by full path.
// Using RetrieveSecurityConfigurationListFromRegistry and filter manually.
string fileName = Path.GetFileName(item);

// Gets all of the policies for the selected file name but results contain full file paths.
Result<List<AppMitigations>> registryResult = SecurityPolicyRepository.RetrieveSecurityConfigurationListFromRegistry(fileName);

// If no registry entry exists for this filename, the exclusion is not applied
if (registryResult.IsFailure || registryResult.Value.Count is 0)
{
return false;
}

// Find the entry matching our specific full file path
AppMitigations? matchingPolicy = null;
foreach (AppMitigations policy in registryResult.Value)
{
if (string.Equals(policy.ProcessName, item, StringComparison.OrdinalIgnoreCase))
{
matchingPolicy = policy;
break;
}
}

if (matchingPolicy is null)
{
return false;
}

// Verify that Mandatory ASLR is disabled (excluded) for this PE
// and that the Force override is set so the per-process exclusion
// takes precedence over the system-wide Mandatory ASLR policy
if (matchingPolicy.Aslr.ForceRelocateImages != OPTIONVALUE.OFF ||
!matchingPolicy.Aslr.OverrideForceRelocateImages)
{
return false;
}
}

return true;
}),

deviceIntents: [
Expand Down