What is Windows 7's Fault Tolerant Heap?

Question

I'd like some technical information on how it works, and how I can disable or enumerate the Fault Tolerant Heap shims that are associated with processes that crash frequently. Is there a heuristic of some sort that Windows 7 uses to decide when to apply an FTH shim?

Answer 1

Fault Tolerant Heap is a layer over the heap that defends against common heap errors, such as heap overruns, double frees, and so on. To my knowledge, there is only one FTH shim - not multiple for each mitigation. http://msdn.microsoft.com/en-us/library/dd744764(VS.85).aspx describes how you can monitor if FTH is being enabled for an application via the event log.

I don't believe MS has published the exact heuristic that will enable the FTH, but yes, there is a heuristic.