Created attachment 373657 [details] GnuCash Windows process details Looking at how GnuCash is built for Debian: > $ hardening-check /usr/bin/gnucash: > Position Independent Executable: yes > Stack protected: yes > Fortify Source functions: unknown, no protectable libc functions used > Read-only relocations: yes > Immediate binding: yes However, inspecting the Windows version, it appears that both DEP and ASLR are disabled. Would it be possible to compile Windows version with something like: > -Wl,--nxcompat,--dynamicbase,--export-all-symbols Please see the screenshot attached. Thank you!
OK. The actual syntax turned out to be " -Wl,--nxcompat -Wl,--dynamicbase" Exporting symbols from an exe makes no sense so I left that one off. > dumpbin /headers gnucash.exe Microsoft (R) COFF/PE Dumper Version 14.22.27905.0 Copyright (C) Microsoft Corporation. All rights reserved. Dump of file gnucash.exe ... FILE HEADER VALUES 14C machine (x86) 11 number of sections 5EA08B33 time date stamp Wed Apr 22 11:21:39 2020 82400 file pointer to symbol table A4B number of symbols E0 size of optional header 106 characteristics Executable Line numbers stripped 32 bit word machine ... 140 DLL characteristics Dynamic base NX compatible
(In reply to John Ralls from comment #1) > OK. The actual syntax turned out to be " -Wl,--nxcompat -Wl,--dynamicbase" > > Exporting symbols from an exe makes no sense so I left that one off. I you (have) manage(d) to build the GnuCash with these flags, would you be able to share the resulting *.exe? Happy to beta-test.
I pushed a commit so it will be in tomorrow's Windows nightly and barring the extremely unlikely event that someone detects breakage before the weekend in the upcoming 3.901 beta release.
Created attachment 373659 [details] v3.902 I have checked the v3.902 (2020-04-27) and can confirm that DEP and ASLR are enabled. Image address is non-standard which strongly suggests that ASLR is operational. Thanks so much for making it (a)live :) I have also noticed that Windows build is 32b. Is there a plan to compile x86_64? Amongst other things, would strengthen ASLR further: https://security.stackexchange.com/a/24831
Since Microsoft Windows still supports 32-bit machines, so do we. We have no intention of providing multiple builds.
