What is better? memset or RtlSecureZeroMemory? C

[scrim]

whats the best solution to zero out memory? Other thoughts?

 

[Apocalypse]

xor al, al
mov ecx, length
mov edi, source
rep stosb

 

[evilcore]

V597. Compiler may delete ′memset′ function call that is used to clear ′Foo′ buffer. Use the RtlSecureZeroMemory() function to erase private data.

V597. The analyzer has detected a potential error: an array containing private information is not cleared.

pvs-studio.com

 

[DildoFagins]

whats the best solution to zero out memory? Other thoughts?

It depends on what you need. If you need to make sure that compiler won't optimize away memset when the buffer isn't used after zeroing it, you should use RtlSecureZeroMemory. This may be useful to clear out sensitive data from memory after using it. If you don't care about it, just use memset.

 

[varwar]

If you write for modern windows 10 (2004+), you should probably use new pool allocator's - ExAllocatePool2/3 which are initialize memory with zeroes. (I suspect you talk about kernel mode and pool allocation context?)

// Old code
PVOID Allocation = ExAllocatePoolWithTag(PagedPool, 100, 'abcd');
RtlZeroMemory(Allocation, 100);

// New code
PVOID Allocation = ExAllocatePool2(POOL_FLAG_PAGED, 100, 'abcd')

For ordinary buffers memset would be enough (widely used in the ntoskrnl, for example).




Source: https://docs.microsoft.com/en-us/wi...rnel/updating-deprecated-exallocatepool-calls

 

[DildoFagins]

If you write for modern windows 10 (2004+), you should probably use new pool allocator's - ExAllocatePool2/3 which are initialize memory with zeroes. (I suspect you talk about kernel mode and pool allocation context?)

He may be talking about user mode as well, I believe RtlSecureZeroMemory is exported from ntdll.dll.

 

[varwar]

He may be talking about user mode as well, I believe RtlSecureZeroMemory is exported from ntdll.dll.

I didn't find RtlSecureZeroMemory in the ntdll exports. Only RtlZeroMemory which is a wrapper of memset.

 

[DildoFagins]

I didn't find RtlSecureZeroMemory in the ntdll exports. Only RtlZeroMemory which is a wrapper of memset.

Oh, I got it, it is provided inline:

This function is defined as the RtlSecureZeroMemory function (see WinBase.h). The implementation of RtlSecureZeroMemory is provided inline and can be used on any version of Windows (see WinNT.h.)

When I read your message I was like: wait, what does SecureZeroMemory uses then, and there was the answer: https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa366877(v=vs.85)

 

[garrett]

xor al, al
mov ecx, length
mov edi, source
rep stosb

ходят слухи что цээртэшные функции поддерживают MMX