Build Treesheets with /DYNAMICBASE and /GUARD:CF

[savchenko]

As treesheets is being built with VS2017, would you consider compiling it with:

• /DYNAMICBASE
• /guard:cf, reference

Interestingly, current build reports /HIGHENTROPYVA enabled, but ASLR is off:

Get-PESecurity -File .\TreeSheets.exe

ARCH             : AMD64
DotNET           : False
ASLR             : False
DEP              : True
Authenticode     : False
StrongNaming     : N/A
SafeSEH          : N/A
ControlFlowGuard : False
HighentropyVA    : True

[aardappel]

/HIGHENTROPYVA was not intentional, this was inherited from the scripting language (https://github.com/aardappel/lobster) that is built into TreeSheets, that used that flag to achieve pointer compression. But since that feature won't be used in TreeSheets, this flag should definitely be off. So /DYNAMICBASE can be on.

As for this control flow guard, I don't think so. I don't like the idea of additional runtime code slowing things down, and TreeSheets has little to no function pointers (outside of vtables). TreeSheets also doesn't work with any code or data received over the internet.. I would say it is not exactly a security problem.

[savchenko]

Fair call. Looking forward towards the build with /DYNAMICBASE :)

[aardappel]

/DYNAMICBASE is now on, but I didn't find any explict reference to /HIGHENTROPYVA in the project: https://github.com/aardappel/treesheets/commit/21b5f1d689f833b2ee3a0ca2c3edbbaaed68b8e4

[savchenko]

Thank you. Maybe these days VisualStudio enables it for all x86_64 builds by default ; "must have" feature.