IMAGE_FILE_HEADER (winnt.h) – Win32 apps | Microsoft Learn: IMAGE_FILE_UP_SYSTEM_ONLY flag (not what you think it means)
Posted by jpluimers on 2024/12/04
Need to write a tool for this that sets/clears the ………… flag in the PE .EXE header.
Officially it is for this:
[Wayback/Archive] IMAGE_FILE_HEADER (winnt.h) – Win32 apps | Microsoft Learn
- IMAGE_FILE_UP_SYSTEM_ONLY
- 0x4000
The file should be run only on a uniprocessor computer.
In practice, this sets the affinity to 1 single CPU core (which is kind of random, and could change each time you start the executable).
This is ideal for code that is known for causing trouble executing on multiple cores, or – more importantly – to disallow core-switching for programs that give best performance when executed on a single core.
Via: [Wayback/Archive] Thread by @0gtweet on Thread Reader App – Did you ever hear about IMAGE_FILE_UP_SYSTEM_ONLY flag in NtHeader->FileHeader->Characteristics of an exe file?
Did you ever hear about
IMAGE_FILE_UP_SYSTEM_ONLYflag inNtHeader->FileHeader->Characteristicsof an exe file? Microsoft says it will make the exe run ONLY on single-cpu machines.In practice it works on multi-cpu machines as well, but the affinity is automatically set to one CPU only! And the allowed CPU is rotated, which is cool imho.
There is even a linker flag for it. You can set it with
/DRIVER:UPONLYBut there is more!
IMAGE_LOAD_CONFIG_DIRECTORYcontainsProcessAffinityMaskproviding full flexibility with setting affinity. And here comes my question: how to manage it within an exe? I know it theoretically on binary level, but I hope nice editor exists…Maybe
SetImageConfigInformation()?Any hints?
- [Wayback/Archive] IMAGE_LOAD_CONFIG_DIRECTORY32 (winnt.h) – Win32 apps | Microsoft Learn
- [Wayback/Archive] IMAGE_LOAD_CONFIG_DIRECTORY64 (winnt.h) – Win32 apps | Microsoft Learn
--jeroen
The Wiert Corner - irregular stream of stuff 
Leave a comment