5

I'd like some technical information on how it works, and how I can disable or enumerate the Fault Tolerant Heap shims that are associated with processes that crash frequently. Is there a heuristic of some sort that Windows 7 uses to decide when to apply an FTH shim?

Cat Zimmermann
  • 1,422
  • 2
  • 21
  • 38

1 Answers1

7

Fault Tolerant Heap is a layer over the heap that defends against common heap errors, such as heap overruns, double frees, and so on. To my knowledge, there is only one FTH shim - not multiple for each mitigation. http://msdn.microsoft.com/en-us/library/dd744764(VS.85).aspx describes how you can monitor if FTH is being enabled for an application via the event log.

I don't believe MS has published the exact heuristic that will enable the FTH, but yes, there is a heuristic.

Michael
  • 54,279
  • 5
  • 125
  • 144
  • 1
    Today I also noticed a debug output string that shows FTH is being enabled for a process I was debugging: OutputDebugString FTH: (9556): *** Fault tolerant heap shim applied to current process. This is usually due to previous crashes. *** – Tim Lovell-Smith Jul 10 '10 at 19:20
  • Mark Russinovich talked about this at PDC 2010. The problem is that I don't remember which talk it was part 1 or part 2: http://channel9.msdn.com/Events/PDC/PDC10?sort=sequential&direction=desc&term=&s=Mark%2BRussinovich – ZippyV May 10 '11 at 20:04