Hacker News Reader

Comment by r00fus | Hacker News Reader

Is there no way to simply remove this DLL or is it too widely used in core Windows?

This is part of the huge and unending clusterfuck of vulnerabilities that people find in the Windows graphics stack, which was wisely moved to kernel space early on in NT's life, which makes all these vulnerabilities much more critical than they would be otherwise.

Graphics hasn't been kernel mode since the Vista days FYI. It's now in userspace.

It was moved out in Vista with great fanfare. A side effect was GDI was no longer hardware accelerated. With windows 7 and later hardware acceleration was added back necessitating parts of it return to the kernel. For obvious reasons this wasn't as widely publicized.

This makes exploits like this possible: https://sensepost.com/blog/2017/abusing-gdi-objects-for-ring...

I thought GDI is now emulated over Direct2D.

You draw to a DirectX surface rather than the raw frame buffer but it is by no means translated to D2D. D2D has a "GDI" emulation mode, but it's more than worthless if you care about rendering fidelity with the real thing - and you probably do if your still on GDI these days.

Ah good to know - I was under the incorrect impression that the D2D "GDI" emulation mode was the only codepath remaining. Btw any pointers on how to keep track of the graphics stack in Windows? In the past there used to be a treasure trove of blogs and content in MSDN but over time that community has frittered away. Any pointers on how to keep track of what Microsofts graphics roadmap is going forward?

The simple answer is use D2D/Dwrite for low level render code in new projects. If you use C# there’s probably higher level wrappers over these. Some of the older C# APIs wrap GDI+ which is pretty slow and renders text really poorly so go with whatever new stuff they have now.

I don’t know of any specific blogs/resources. I used to work on Excel’s render code so had a bit of an inside view.

I worked on some inhouse tools similar to Excel (rendering highly customizable grids) so efficient 2D rendering is of high interest to me. This is from C++.

I seem to recall having a discussion with you a while back where Windows would just leave kernel pointers out in userspace, which seemed to do with GDI as well.

Yes, I think we debated the whole concept of GDI being in the kernel as well.

The Vista experience shows you it was and still is necessary for perf.

I recall getting stuck in a DLL hell back in Windows 3.11 ATMFD's granddaddy was still supposedly serviced more directly by Adobe themselves and it was a free for all across various application installers which versions they attempted to install. Windows 3.1 era Games had a bad habit of stuffing weird old versions of Adobe Type Manager into their installers. I forget details of the offenders, but there was a particular many-times-too-many repeated sequence of installing an application then immediately repairing/reinstalling Office to fix the Adobe Type Manager. Forgetting that last step IIRC was a very subtle problem until it wasn't, starting as weird message boxes and then eventually culminating in (days of application use later) Stop Codes that crashed Windows 3.1 back to DOS.

Moving things into the kernel is one heck of a sledgehammer solution to DLL Hell, at least.

(Windows 10 has slowly moved a lot of the graphics stack back out of kernel space. It appears to be moving the right direction, just very slowly.)

> Is there no way to simply remove this DLL

There is:

https://portal.msrc.microsoft.com/en-US/security-guidance/ad...

Microsoft documents, as a possibility, how to "Rename ATMFD.DLL" and describes the impact.

As noted in a bullet point in TFA, one workaround is to:

> Rename ATMFD.DLL, or alternatively, disable the file from the registry

Caveat:

> Renaming ATMFD.DLL, the last recommended stopgap, will cause display problems for applications that rely on embedded fonts and could cause some apps to stop working if they use OpenType fonts.

Also from TFA:

> Monday’s advisory provides detailed instructions for both turning on and turning off all three workarounds.

It doesn't seem to be part of windows. A clean install doesn't have the file. It's probably only an issue if you have adobe flash/reader installed.

See this comment https://news.ycombinator.com/item?id=22670577

There is one and it is mentioned in the article.

it is essential for the rendering of postscript fonts. there is no replacement for it, unfortunately

On the other hand, many of us could probably live without any postscript fonts.

until you open a pdf file

Depends on the PDFs you're interested in. Many use only embedded TrueType (Type42) fonts, which I assume are handled by the usual Microsoft renderer.

(If you're reading lots of LaTeX-generated papers, then yes, you're probably seeing PostScript fonts.)

Reply on news.ycombinator.com