Uwp_ARM_VS2015_DefaultBlankApp.exe.sarif

{
  "$schema": "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.6.json",
  "version": "2.1.0",
  "runs": [
    {
      "results": [
        {
          "ruleId": "BA2005",
          "ruleIndex": 0,
          "kind": "pass",
          "level": "none",
          "message": {
            "id": "Pass",
            "arguments": [
              "Uwp_ARM_VS2015_DefaultBlankApp.exe"
            ]
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///Z:/src/Test.FunctionalTests.BinSkim.Driver/BaselineTestData/Uwp_ARM_VS2015_DefaultBlankApp.exe",
                  "index": 0
                }
              }
            }
          ]
        },
        {
          "ruleId": "BA2009",
          "ruleIndex": 1,
          "kind": "pass",
          "level": "none",
          "message": {
            "id": "Pass",
            "arguments": [
              "Uwp_ARM_VS2015_DefaultBlankApp.exe"
            ]
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///Z:/src/Test.FunctionalTests.BinSkim.Driver/BaselineTestData/Uwp_ARM_VS2015_DefaultBlankApp.exe",
                  "index": 0
                }
              }
            }
          ]
        },
        {
          "ruleId": "BA2010",
          "ruleIndex": 2,
          "kind": "pass",
          "level": "none",
          "message": {
            "id": "Pass",
            "arguments": [
              "Uwp_ARM_VS2015_DefaultBlankApp.exe"
            ]
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///Z:/src/Test.FunctionalTests.BinSkim.Driver/BaselineTestData/Uwp_ARM_VS2015_DefaultBlankApp.exe",
                  "index": 0
                }
              }
            }
          ]
        },
        {
          "ruleId": "BA2012",
          "ruleIndex": 3,
          "kind": "pass",
          "level": "none",
          "message": {
            "id": "Pass_NoLoadConfig",
            "arguments": [
              "Uwp_ARM_VS2015_DefaultBlankApp.exe"
            ]
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///Z:/src/Test.FunctionalTests.BinSkim.Driver/BaselineTestData/Uwp_ARM_VS2015_DefaultBlankApp.exe",
                  "index": 0
                }
              }
            }
          ]
        },
        {
          "ruleId": "BA2016",
          "ruleIndex": 4,
          "kind": "pass",
          "level": "none",
          "message": {
            "id": "Pass",
            "arguments": [
              "Uwp_ARM_VS2015_DefaultBlankApp.exe"
            ]
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///Z:/src/Test.FunctionalTests.BinSkim.Driver/BaselineTestData/Uwp_ARM_VS2015_DefaultBlankApp.exe",
                  "index": 0
                }
              }
            }
          ]
        },
        {
          "ruleId": "BA2019",
          "ruleIndex": 5,
          "kind": "pass",
          "level": "none",
          "message": {
            "id": "Pass",
            "arguments": [
              "Uwp_ARM_VS2015_DefaultBlankApp.exe"
            ]
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///Z:/src/Test.FunctionalTests.BinSkim.Driver/BaselineTestData/Uwp_ARM_VS2015_DefaultBlankApp.exe",
                  "index": 0
                }
              }
            }
          ]
        },
        {
          "ruleId": "BA2021",
          "ruleIndex": 6,
          "kind": "pass",
          "level": "none",
          "message": {
            "id": "Pass",
            "arguments": [
              "Uwp_ARM_VS2015_DefaultBlankApp.exe"
            ]
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "file:///Z:/src/Test.FunctionalTests.BinSkim.Driver/BaselineTestData/Uwp_ARM_VS2015_DefaultBlankApp.exe",
                  "index": 0
                }
              }
            }
          ]
        }
      ],
      "tool": {
        "driver": {
          "name": "testhost",
          "version": "15.0.0.0",
          "rules": [
            {
              "id": "BA2005",
              "name": "DoNotShipVulnerableBinaries",
              "fullDescription": {
                "text": "Do not ship obsolete libraries for which there are known security vulnerabilities."
              },
              "help": {
                "text": "Do not ship obsolete libraries for which there are known security vulnerabilities."
              },
              "messageStrings": {
                "Pass": {
                  "text": "'{0}' is not known to be an obsolete binary that is vulnerable to one or more security problems."
                },
                "Error": {
                  "text": "'{0}' appears to be an obsolete library (version {1}) for which there are known security vulnerabilities. To resolve this issue, obtain a version of {0} that is newer than version {2}. If this binary is not in fact {0}, ignore this warning."
                },
                "Error_CouldNotParseVersion": {
                  "text": "Version information for '{0}' could not be parsed. The binary therefore could not be verified not to be an obsolete binary that is known to be vulnerable to one or more security problems."
                },
                "NotApplicable_InvalidMetadata": {
                  "text": "'{0}' was not evaluated for check '{1}' as the analysis is not relevant based on observed metadata: {2}."
                }
              },
              "helpUri": "/~https://github.com/microsoft/binskim/blob/main/docs/BinSkimRules.md#rule-BA2005DoNotShipVulnerableBinaries",
              "properties": {
                "equivalentBinScopeRuleReadableName": "BinaryVersionsCheck"
              }
            },
            {
              "id": "BA2009",
              "name": "EnableAddressSpaceLayoutRandomization",
              "fullDescription": {
                "text": "Binaries should linked as DYNAMICBASE to be eligible for relocation by Address Space Layout Randomization (ASLR). ASLR is an important mitigation that makes it more difficult for an attacker to exploit memory corruption vulnerabilities. Configure your tools to build with this feature enabled. For C and C++ binaries, add /DYNAMICBASE to your linker command line. For .NET applications, use a compiler shipping with Visual Studio 2008 or later."
              },
              "help": {
                "text": "Binaries should linked as DYNAMICBASE to be eligible for relocation by Address Space Layout Randomization (ASLR). ASLR is an important mitigation that makes it more difficult for an attacker to exploit memory corruption vulnerabilities. Configure your tools to build with this feature enabled. For C and C++ binaries, add /DYNAMICBASE to your linker command line. For .NET applications, use a compiler shipping with Visual Studio 2008 or later."
              },
              "messageStrings": {
                "Pass": {
                  "text": "'{0}' is properly compiled to enable Address Space Layout Randomization, reducing an attacker's ability to exploit code in well-known locations."
                },
                "Error_NotDynamicBase": {
                  "text": "'{0}' is not marked as DYNAMICBASE. This means that the binary is not eligible for relocation by Address Space Layout Randomization (ASLR). ASLR is an important mitigation that makes it more difficult for an attacker to exploit memory corruption vulnerabilities. To resolve this issue, configure your tools to build with this feature enabled. For C and C++ binaries, add /DYNAMICBASE to your linker command line. For .NET applications, use a compiler shipping with Visual Studio 2008 or later."
                },
                "Error_RelocsStripped": {
                  "text": "'{0}' is marked as DYNAMICBASE but relocation data has been stripped from the image, preventing address space layout randomization. "
                },
                "Error_WinCENoRelocationSection": {
                  "text": "'{0}' is a Windows CE image but does not contain any relocation data, preventing Address Space Layout Randomization."
                },
                "NotApplicable_InvalidMetadata": {
                  "text": "'{0}' was not evaluated for check '{1}' as the analysis is not relevant based on observed metadata: {2}."
                }
              },
              "helpUri": "/~https://github.com/microsoft/binskim/blob/main/docs/BinSkimRules.md#rule-BA2009EnableAddressSpaceLayoutRandomization",
              "properties": {
                "equivalentBinScopeRuleReadableName": "DBCheck"
              }
            },
            {
              "id": "BA2010",
              "name": "DoNotMarkImportsSectionAsExecutable",
              "fullDescription": {
                "text": "PE sections should not be marked as both writable and executable. This condition makes it easier for an attacker to exploit memory corruption vulnerabilities, as it may provide an attacker executable location(s) to inject shellcode. Because the loader will always mark the imports section as writable, it is therefore important to mark this section as non-executable. To resolve this issue, ensure that your program does not mark the imports section executable. Look for uses of /SECTION or /MERGE on the linker command line, or #pragma segment in source code, which change the imports section to be executable, or which merge the \".rdata\" segment into an executable section."
              },
              "help": {
                "text": "PE sections should not be marked as both writable and executable. This condition makes it easier for an attacker to exploit memory corruption vulnerabilities, as it may provide an attacker executable location(s) to inject shellcode. Because the loader will always mark the imports section as writable, it is therefore important to mark this section as non-executable. To resolve this issue, ensure that your program does not mark the imports section executable. Look for uses of /SECTION or /MERGE on the linker command line, or #pragma segment in source code, which change the imports section to be executable, or which merge the \".rdata\" segment into an executable section."
              },
              "messageStrings": {
                "Pass": {
                  "text": "'{0}' does not have an imports section that is marked as executable, helping to prevent the exploitation of code vulnerabilities."
                },
                "Error": {
                  "text": "'{0}' has the imports section marked executable. Because the loader will always mark the imports section as writable, it is important to mark this section as non-executable, so that an attacker cannot place shellcode here. To resolve this issue, ensure that your program does not mark the imports section as executable. Look for uses of /SECTION or /MERGE on the linker command line, or #pragma segment in source code, which change the imports section to be executable, or which merge the \".rdata\" segment into an executable section."
                },
                "NotApplicable_InvalidMetadata": {
                  "text": "'{0}' was not evaluated for check '{1}' as the analysis is not relevant based on observed metadata: {2}."
                }
              },
              "helpUri": "/~https://github.com/microsoft/binskim/blob/main/docs/BinSkimRules.md#rule-BA2010DoNotMarkImportsSectionAsExecutable",
              "properties": {
                "equivalentBinScopeRuleReadableName": "ExecutableImportsCheck"
              }
            },
            {
              "id": "BA2012",
              "name": "DoNotModifyStackProtectionCookie",
              "fullDescription": {
                "text": "Application code should not interfere with the stack protector. The stack protector (/GS) is a security feature of the compiler which makes it more difficult to exploit stack buffer overflow memory corruption vulnerabilities. The stack protector relies on a random number, called the \"security cookie\", to detect these buffer overflows. This 'cookie' is statically linked with your binary from a Visual C++ library in the form of the symbol __security_cookie. On recent Windows versions, the loader looks for the statically linked value of this cookie, and initializes the cookie with a far better source of entropy -- the system's secure random number generator -- rather than the limited random number generator available early in the C runtime startup code. When this symbol is not the default value, the additional entropy is not injected by the operating system, reducing the effectiveness of the stack protector. To resolve this issue, ensure that your code does not reference or create a symbol named __security_cookie or __security_cookie_complement."
              },
              "help": {
                "text": "Application code should not interfere with the stack protector. The stack protector (/GS) is a security feature of the compiler which makes it more difficult to exploit stack buffer overflow memory corruption vulnerabilities. The stack protector relies on a random number, called the \"security cookie\", to detect these buffer overflows. This 'cookie' is statically linked with your binary from a Visual C++ library in the form of the symbol __security_cookie. On recent Windows versions, the loader looks for the statically linked value of this cookie, and initializes the cookie with a far better source of entropy -- the system's secure random number generator -- rather than the limited random number generator available early in the C runtime startup code. When this symbol is not the default value, the additional entropy is not injected by the operating system, reducing the effectiveness of the stack protector. To resolve this issue, ensure that your code does not reference or create a symbol named __security_cookie or __security_cookie_complement."
              },
              "messageStrings": {
                "Pass": {
                  "text": "'{0}' is a C or C++ binary built with the buffer security feature that properly preserves the stack protecter cookie. This has the effect of enabling a significant increase in entropy provided by the operating system over that produced by the C runtime start-up code."
                },
                "Pass_NoLoadConfig": {
                  "text": "'{0}' is  C or C++binary that does not contain a load config table, which indicates either that it was compiled and linked with a version of the compiler that precedes stack protection features or is a binary (such as an ngen'ed assembly) that is not subject to relevant security issues."
                },
                "Error": {
                  "text": "'{0}' is a C or C++ binary that interferes with the stack protector. The stack protector (/GS) is a security feature of the compiler which makes it more difficult to exploit stack buffer overflow memory corruption vulnerabilities. The stack protector relies on a random number, called the \"security cookie\", to detect these buffer overflows. This 'cookie' is statically linked with your binary from a Visual C++ library in the form of the symbol __security_cookie. On recent Windows versions, the loader looks for the magic statically linked value of this cookie, and initializes the cookie with a far better source of entropy -- the system's secure random number generator -- rather than the limited random number generator available early in the C runtime startup code. When this symbol is not the default value, the additional entropy is not injected by the operating system, reducing the effectiveness of the stack protector. To resolve this issue, ensure that your code does not reference or create a symbol named __security_cookie or __security_cookie_complement. NOTE: the modified cookie value detected was: {1}"
                },
                "Error_CouldNotLocateCookie": {
                  "text": "'{0}' is a C or C++binary that enables the stack protection feature but the security cookie could not be located. The binary may be corrupted."
                },
                "Warning_InvalidSecurityCookieOffset": {
                  "text": "'{0}' appears to be a packed C or C++ binary that reports a security cookie offset that exceeds the size of the packed file. Use of the stack protector (/GS) feature therefore could not be verified. The file was possibly packed by: {1}."
                },
                "NotApplicable_InvalidMetadata": {
                  "text": "'{0}' was not evaluated for check '{1}' as the analysis is not relevant based on observed metadata: {2}."
                }
              },
              "helpUri": "/~https://github.com/microsoft/binskim/blob/main/docs/BinSkimRules.md#rule-BA2012DoNotModifyStackProtectionCookie",
              "properties": {
                "equivalentBinScopeRuleReadableName": "DefaultGSCookieCheck"
              }
            },
            {
              "id": "BA2016",
              "name": "MarkImageAsNXCompatible",
              "fullDescription": {
                "text": "Binaries should be marked as NX compatible to help prevent execution of untrusted data as code. The NXCompat bit, also known as \"Data Execution Prevention\" (DEP) or \"Execute Disable\" (XD), triggers a processor security feature that allows a program to mark a piece of memory as non-executable. This helps mitigate memory corruption vulnerabilities by preventing an attacker from supplying direct shellcode in their exploit (because the exploit comes in the form of input data to the exploited program on a data segment, rather than on an executable code segment). Ensure that your tools are configured to mark your binaries as NX compatible, e.g. by passing /NXCOMPAT to the C/C++ linker."
              },
              "help": {
                "text": "Binaries should be marked as NX compatible to help prevent execution of untrusted data as code. The NXCompat bit, also known as \"Data Execution Prevention\" (DEP) or \"Execute Disable\" (XD), triggers a processor security feature that allows a program to mark a piece of memory as non-executable. This helps mitigate memory corruption vulnerabilities by preventing an attacker from supplying direct shellcode in their exploit (because the exploit comes in the form of input data to the exploited program on a data segment, rather than on an executable code segment). Ensure that your tools are configured to mark your binaries as NX compatible, e.g. by passing /NXCOMPAT to the C/C++ linker."
              },
              "messageStrings": {
                "Pass": {
                  "text": "'{0}' is marked as NX compatible, helping to prevent attackers from executing code that is injected into data segments."
                },
                "Error": {
                  "text": "'{0}' is not marked NX compatible. The NXCompat bit, also known as \"Data Execution Prevention\" (DEP) or \"Execute Disable\" (XD), is a processor feature that allows a program to mark a piece of memory as non-executable. This helps mitigate memory corruption vulnerabilities by preventing an attacker from supplying direct shellcode in their exploit, because the exploit comes in the form of input data to the exploited program on a data segment, rather than on an executable code segment. To resolve this issue, ensure that your tools are configured to mark your binaries as NX compatible, e.g. by passing /NXCOMPAT to the C/C++ linker."
                },
                "NotApplicable_InvalidMetadata": {
                  "text": "'{0}' was not evaluated for check '{1}' as the analysis is not relevant based on observed metadata: {2}."
                }
              },
              "helpUri": "/~https://github.com/microsoft/binskim/blob/main/docs/BinSkimRules.md#rule-BA2016MarkImageAsNXCompatible",
              "properties": {
                "equivalentBinScopeRuleReadableName": "NXCheck"
              }
            },
            {
              "id": "BA2019",
              "name": "DoNotMarkWritableSectionsAsShared",
              "fullDescription": {
                "text": "Code or data sections should not be marked as both shared and writable. Because these sections are shared across processes, this condition might permit a process with low privilege to alter memory in a higher privilege process. If you do not actually require that a section be both writable and shared, remove one or both of these attributes (by modifying your .DEF file, the appropriate linker /section switch arguments, etc.). If you must share common data across processes (for inter-process communication (IPC) or other purposes) use CreateFileMapping with proper security attributes or an actual IPC mechanism instead (COM, named pipes, LPC, etc.)."
              },
              "help": {
                "text": "Code or data sections should not be marked as both shared and writable. Because these sections are shared across processes, this condition might permit a process with low privilege to alter memory in a higher privilege process. If you do not actually require that a section be both writable and shared, remove one or both of these attributes (by modifying your .DEF file, the appropriate linker /section switch arguments, etc.). If you must share common data across processes (for inter-process communication (IPC) or other purposes) use CreateFileMapping with proper security attributes or an actual IPC mechanism instead (COM, named pipes, LPC, etc.)."
              },
              "messageStrings": {
                "Pass": {
                  "text": "'{0}' contains no data or code sections marked as both shared and writable, helping to prevent the exploitation of code vulnerabilities."
                },
                "Error": {
                  "text": "'{0}' contains one or more code or data sections ({1}) which are marked as both shared and writable. Because these sections are shared across processes, this condition might permit a process with low privilege to alter memory in a higher privilege process. If you do not actually require that a section be both writable and shared, remove one or both of these attributes (by modifying your .DEF file, the appropriate linker /section switch arguments, etc.). If you must share common data across processes (for inter-process communication (IPC) or other purposes) use CreateFileMapping with proper security attributes or an actual IPC mechanism instead (COM, named pipes, LPC, etc.)."
                },
                "NotApplicable_InvalidMetadata": {
                  "text": "'{0}' was not evaluated for check '{1}' as the analysis is not relevant based on observed metadata: {2}."
                }
              },
              "helpUri": "/~https://github.com/microsoft/binskim/blob/main/docs/BinSkimRules.md#rule-BA2019DoNotMarkWritableSectionsAsShared",
              "properties": {
                "equivalentBinScopeRuleReadableName": "SharedSectionCheck"
              }
            },
            {
              "id": "BA2021",
              "name": "DoNotMarkWritableSectionsAsExecutable",
              "fullDescription": {
                "text": "PE sections should not be marked as both writable and executable. This condition makes it easier for an attacker to exploit memory corruption vulnerabilities, as it may provide an attacker executable location(s) to inject shellcode. To resolve this issue, configure your tools to not emit memory sections that are writable and executable. For example, look for uses of /SECTION on the linker command line for C and C++ programs, or #pragma section in C and C++ source code, which mark a section with both attributes. Be sure to disable incremental linking in release builds, as this feature creates a writable and executable section named '.textbss' in order to function."
              },
              "help": {
                "text": "PE sections should not be marked as both writable and executable. This condition makes it easier for an attacker to exploit memory corruption vulnerabilities, as it may provide an attacker executable location(s) to inject shellcode. To resolve this issue, configure your tools to not emit memory sections that are writable and executable. For example, look for uses of /SECTION on the linker command line for C and C++ programs, or #pragma section in C and C++ source code, which mark a section with both attributes. Be sure to disable incremental linking in release builds, as this feature creates a writable and executable section named '.textbss' in order to function."
              },
              "messageStrings": {
                "Pass": {
                  "text": "'{0}' contains no data or code sections marked as both shared and executable, helping to prevent the exploitation of code vulnerabilities."
                },
                "Error": {
                  "text": "'{0}' contains PE section(s) ({1}) that are both writable and executable. Writable and executable memory segments make it easier for an attacker to exploit memory corruption vulnerabilities, because it may provide an attacker executable location(s) to inject shellcode. To resolve this issue, configure your tools to not emit memory sections that are writable and executable. For example, look for uses of /SECTION on the linker command line for C and C++ programs, or #pragma section in C and C++ source code, which mark a section with both attributes. Enabling incremental linking via the /INCREMENTAL argument (the default for Microsoft Visual Studio debug build) can also result in a writable and executable section named 'textbss'. For this case, disable incremental linking (or analyze an alternate build configuration that disables this feature) to resolve the problem."
                },
                "Error_UnexpectedSectionAligment": {
                  "text": "'{0}' has a section alignment ({1}) that is smaller than its page size ({2})."
                },
                "NotApplicable_InvalidMetadata": {
                  "text": "'{0}' was not evaluated for check '{1}' as the analysis is not relevant based on observed metadata: {2}."
                }
              },
              "helpUri": "/~https://github.com/microsoft/binskim/blob/main/docs/BinSkimRules.md#rule-BA2021DoNotMarkWritableSectionsAsExecutable",
              "properties": {
                "equivalentBinScopeRuleReadableName": "WXCheck"
              }
            }
          ],
          "properties": {
            "comments": "A security and correctness analyzer for portable executable and MSIL formats."
          }
        }
      },
      "invocations": [
        {
          "toolConfigurationNotifications": [
            {
              "locations": [
                {
                  "physicalLocation": {
                    "artifactLocation": {
                      "uri": "file:///Z:/src/Test.FunctionalTests.BinSkim.Driver/BaselineTestData/Uwp_ARM_VS2015_DefaultBlankApp.exe",
                      "index": 0
                    }
                  }
                }
              ],
              "message": {
                "text": "'Uwp_ARM_VS2015_DefaultBlankApp.exe' was not evaluated because its PDB could not be loaded (E_PDB_NO_DEBUG_INFO)."
              },
              "level": "error",
              "descriptor": {
                "id": "ERR997.ExceptionLoadingPdb"
              }
            }
          ],
          "executionSuccessful": false
        }
      ],
      "artifacts": [
        {
          "location": {
            "uri": "file:///Z:/src/Test.FunctionalTests.BinSkim.Driver/BaselineTestData/Uwp_ARM_VS2015_DefaultBlankApp.exe",
            "index": 0
          },
          "hashes": {
            "md5": "16993E14BD724B825AD732B2E9B98551",
            "sha-1": "45FD81753A74B2CEA142570383E19816A32DFB9B",
            "sha-256": "10056B66A864EBE8F4F15C3B96661494F52E8BC41188175813DD8A57F7ADCA1E"
          }
        }
      ],
      "columnKind": "utf16CodeUnits"
    }
  ]
}