How often does software actually ship with the opt in for segment heap turned on though ?
Anyway to globally turn it on when a blacklist or denylist or whatever in case something individual acts up ?
Anyway to globally turn it on when a blacklist or denylist or whatever in case something individual acts up ?
For the question of how to do "segment heap on globally, with a list of exceptions that are still on NT Heap", I believe the "Image File Execution Options" regkey takes precedence over the global one. And the IFEO one lets you explicitly opt out. If you read the whitepaper from Mark Yason's 2016 talk at black hat, they explain how to use these registry keys.