[Bug]: RuntimeBroker.exe StrictCFG not compatible with Windows 11 on ARM hardware (virtualized) #318
Closed
3 tasks done
Assignees
Labels
Bug 🐛
Something isn't working
Comments
|
Ah, I see it just enabled the 19 known Attack Surface Reduction rules: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#attacksurfacereductionrules I guess I'll need to flip some switches to figure out which causes this Windows Search GUI issue. |
|
Hmm, I can't seem to figure out how to disable the Attack Surface rules. I guess you set some policy, so this does not work: Add-MpPreference -AttackSurfaceReductionRules_Actions Disabled -AttackSurfaceReductionRules_Ids <some ID> |
|
Looking at: Under Event viewer Microsoft-Windows-Windows Defender/Operational I see no EventID=1121 or EventID=1122 But I do see a lot of EventID=5007. But from a cursory glance those appear to be configuration 'changes' (often just applying the enforced settings?). No blocked events or errors or anything. |
|
Hi,
On the readme, items that have blue checkmark are configured via Group policy, so to configure the ASR rules, you need to use the Group policy editor in this path: if you set any of them to 0, it means disabled. here is the reference I'll test it myself too in few minutes, my host is on build 24H2 so need to update my 23H2 build VM. |
|
I did some tests on the latest build of 23H2, applied all categories, including ASR rules, restarted, everything is working normally, here are some screenshots
|
But the Windows Search GUI still doesn't work. Maybe I made some mistake and it's the |
When the ASR rules are applied via Group policy, the cmdlets won't make permanent changes because the Group policies just re-apply the policies frequently to keep the system compliant, the only way to disable them permanently is through Group policy itself. I'm adding individual ASR rule configuration to the GUI in the next update for easier management. You can use the Unprotect-WindowsSecurity to undo the applied protections automatically. And that's understandable, take your time, in the meantime i'll close the issue since the title isn't applicable anymore and this doesn't seem like a reproducible bug i can actively work on fixing. I don't know your exact setup but hopefully your hardware met the requirements for Win 11 and there wasn't any modifications prior to running the module that could've caused this problem. Please feel free to reopen or create new issue if there's more :) |
|
Maybe it had to do with the Microsoft Defender settings. After a '(repair Windows)' install from the Settings reset page, search GUI works again. these are the Confirm-SystemCompliance settings. I'll set some options with |
|
I can run I'll diff this in a jiffy: |
|
Green = broken % diff -u Confirm-SystemCompliance.1.search-works.txt Confirm-SystemCompliance.2.search-broken.txt
--- Confirm-SystemCompliance.1.search-works.txt 2024-08-14 12:05:02.750363387 +0200
+++ Confirm-SystemCompliance.2.search-broken.txt 2024-08-14 12:05:24.384680063 +0200
@@ -4,7 +4,7 @@
------------ --------- -----
Mandatory ASLR True ON
Process Mitigations for: msedge.exe True DisableExtensionPoints,CFG,StrictCFG,MicrosoftSignedOnly,AllowStoreSignedBinaries,EnforceModuleDependencySigning,BlockRemoteImageLoads,BlockLowLabelImageLoads,UserShadowStack,UserShadowStackStrictMode
-Process Mitigations for: explorer.exe False N/A
+Process Mitigations for: explorer.exe True StrictHandle,DisableExtensionPoints
Process Mitigations for: vmcompute.exe True CFG,StrictCFG
Process Mitigations for: vmwp.exe True CFG,StrictCFG
Process Mitigations for: QuickAssist.exe True DisableExtensionPoints,StrictHandle,BlockDynamicCode,MicrosoftSignedOnly,AllowStoreSignedBinaries,EnforceModuleDependencySigning,DisableNonSystemFonts,BlockRemoteImageLoads,BlockLowLabelImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,UserShadowStack,UserShadowStackStrictMode
@@ -22,18 +22,18 @@
Process Mitigations for: Regsvr32.exe True BlockLowLabelImageLoads
Process Mitigations for: WindowsSandbox.exe True StrictHandle,DisableExtensionPoints,CFG,StrictCFG,MicrosoftSignedOnly,EnforceModuleDependencySigning,BlockRemoteImageLoads,BlockLowLabelImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus
Process Mitigations for: WindowsSandboxClient.exe True StrictHandle,DisableExtensionPoints,CFG,StrictCFG,MicrosoftSignedOnly,EnforceModuleDependencySigning,BlockRemoteImageLoads,BlockLowLabelImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus
-Process Mitigations for: RuntimeBroker.exe False DisableExtensionPoints
+Process Mitigations for: RuntimeBroker.exe True DisableExtensionPoints,CFG,StrictCFG,EnforceModuleDependencySigning
Process Mitigations for: msedgewebview2.exe True DisableExtensionPoints,CFG,StrictCFG,EnforceModuleDependencySigning
Process Mitigations for: csrss.exe True BlockRemoteImageLoads
Process Mitigations for: services.exe True BlockRemoteImageLoads
-Process Mitigations for: rundll32.exe False N/A
+Process Mitigations for: rundll32.exe True BlockRemoteImageLoads,BlockLowLabelImageLoads
Process Mitigations for: SMSS.exe True BlockRemoteImageLoads
Process Mitigations for: Wininit.exe True BlockRemoteImageLoads
Process Mitigations for: NisSrv.exe True MicrosoftSignedOnly
Fast weekly Microsoft recommended driver block list update False False
Microsoft Defender Platform Updates Channel N/A NotConfigured
Microsoft Defender Engine Updates Channel N/A NotConfigured
-Controlled Folder Access Exclusions N/A C:\Program Files\PowerShell\7\createdump.exe, C:\Program Files\PowerShell\7\pwsh.exe, C:\Windows\System32\powercfg.exe
+Controlled Folder Access Exclusions N/A
Allow Switch To Async Inspection True True
OOBE Enable Rtp And Sig Update True True
Intel TDT Enabled True True
@@ -272,7 +272,7 @@
FriendlyName Compliant Value
------------ --------- -----
-All users are part of the Hyper-V Administrators group True True
+All users are part of the Hyper-V Administrators group False False
Disable Location False
Include command line in process creation events False
Disable Location Scripting False
@@ -363,4 +363,4 @@
⣿⠃⠃⠄⠄⠄⠄⠄⠄⣀⢀⠄⠄⡀⡀⢀⣤⣴⣤⣤⣀⣀⠄⠄⠄⠄⠄⠄⠁⢹
-Your compliance score is 97 out of 263!
+Your compliance score is 99 out of 263! |
|
That dials is down considerably I'll be flipping these settings in the Windows Defender Exploit Protection GUI. The Exploit Protection feature that breaks the Windows Search GUI (on Dutch ARM Windows 11): RuntimeBroker.exe StrictCFG I can disable this one setting, log out and log back in (no reboot), and the Windows Search GUI works again. |
If I'm reading this correctly Microsoft might have forgot to compile in CFG for some DLL? Or it crashes due to a control flow violation of course. Where would you find that in Event Viewer? Some more:
Src: https://learn.microsoft.com/en-us/cpp/build/reference/guard-enable-control-flow-guard?view=msvc-170
Hey look, Process Explorer has a 'Control Flow Guard' column in the Lower Pane, DLL tab. |
HotCakeX
changed the title
|
@HenkPoley Very nice research and find, thanks for doing that, I'm thinking about not using the |
|
IMHO Microsoft should fix this. But for the time being you can add a "This breaks Windows Search" checkbox to the righthand column 🤣 |
|
Good idea, i'll be adding tooltips to the right-hand sub-categories column for more info in the upcoming design change! 😊🙏 We can file a feedback for it in Feedback hub too but i think letting one of the Windows developers working on ARM know about this will get it fixed sooner |
|
Now to wonder what triggers this. Found some culprits with relation to RuntimeBroker.exe, the Control Flow Guard column is empty (no 'CFG', and neither 'n/a'): 
|
|
Wouldn't be surprised if |
|
Do you happen to have a reason for setting Strict CFG on RuntimeBroker.exe? I mean, does Microsoft claim it should work? |
|
System Informer usually shows more info about the processes, especially when you enable its kernel-mode driver in the settings I remember seeing this in one of the old insider preview release notes
Maybe not related or maybe that change triggered something, i just remember seeing it. strict CFG for RuntimeBroker.exe works on x64 systems that's why i never caught it (don't have ARM devices atm). As for the reason, in the CSV file they're talked about briefly but it's basically what the reference page mentions and since CFG is enabled by default and Strict CFG worked, and because it enforces the mitigations on the binaries loaded by |
|
I think there is a similar issue with OneDrive.exe (which I noticed did not start anymore). |
Well i'm beginning to think for the ARM architecture, it's better to skip the process mitigations entirely just to be on the safe side. Security is the goal but not at the cost of losing functionality. |
|
I'll look into which setting caused the issue later. (Strict) CFG is not set at all for OneDrive.exe, so that's not it. |
|
For OneDrive.exe the issue is "API-aanroep valideren (CallerCheck)" = EnableRopCallerCheck, disabling that makes it work again. Found the changed/missing item with Confirm-SystemCompliance |
|
Thank you, does Windows Sandbox work on ARM with the mitigations? |
|
If you can supply me with an ARM machine that support (nested) virtualisation under Windows, I can test Windows Sandbox for you 😝😉 (That's not on M1 MacBooks sadly, no native Windows / "Apple BootCamp", nor nested virtualisation.) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Tools category
Harden Windows Security Module
Does Your System Meet The Requirements?
Is your Windows Installation Genuine?
Did You Read The Frequently Asked Questions?
Please Explain The Bug
After enabling "some unknown" setting, when I opened the Start menu and typed, it would not show the search GUI. Also the search bar on the taskbar does nothing.
Reset my VM, ran Windows Update, enabled Smart App Control, and applied the rules one by one starting from the bottom, rebooting every time in between. Attack Surface Reduction breaks the search GUI.
Not sure how to proceed from here. Maybe I'll have some more time to look into this later. It is of course a Microsoft bug. This is inside an UTM (Apple M1) VM. So no virtualisation based security (no nested VMs). Might be relevant.
August 2024 Windows Updates installed (of course).
Error Details
N/AThe text was updated successfully, but these errors were encountered: