Delphi applications and the TSAWARE header flag [closed]

Question

Could this problem also apply to Delphi applications running on Terminal Servers?

As the MSDN article "An Office 2007 or Office 2003 application that is running on an RD Session Host server may close unexpectedly in Windows Server 2008 R2" explains

This issue occurs because of the Tsappcmd.dll component. This component makes changes to the Import Address Table (IAT) for applications that are not Terminal Server aware in order to prevent viruses or malware from maliciously hooking the application. Because of this, the application may experience temporary memory corruption because of the order in which the modules are loaded. Office 2007 and Office 2003 do not contain the TSAWARE header flag. This flag notifies the server that the application is Terminal Server aware.

Some Delphi 2009 applications in a user environment (Windows Server 2008 R2 Service Pack 1) frequently hang or crash. I am looking for possible reasons, as these hangs / crashes can not be reproduced.

The MSDN article seems to apply to Office products first, is this correct or - attention, here is the basic question - does Tsappcmd.dll also modify non-Office programs so the error can occur with Delphi apps? (Of course I would prefer to leave the Delphi applications untouched if the missing TSAWARE flag is not harmful).

Museology

Use map2dbg and Process Explorer to diagnose where the process is blocking. – Marijuana

Howto set the TSAWARE flag – Peaked

Interesting question. See also: #4855034 – Volsci

@TOndrej thanks for the link - maybe this is worth a separate question, as it says that the app must neither rely on INI files nor write to the HKEY_CURRENT_USER registry during setup (quoted from MSDN) - but in Delphi TRegistry uses HKEY_CURRENT_USER as default, what should be used instead, so I wonder what 'during setup' means, application installation? – Museology

@Museology I don't know anything about Terminal Server, sorry. – Peaked

@mjn: yes during setup means during the first, initial installation. Terminal Server basically does a capture of anything written to HKCU key and writes this to a special registry key called "The Shadow Key". On logon of another user, the contents of the Shadow Key are date/time compared and written to that's users HKCU. – Grateful

I'm confused, having similar stability problems in an Excel 2010 add-in on Windows Server 2008 R2. If "during setup" means in the very first initial installation, then does that mean a library can freely write to a user's HKCU, after installation, when it is running inside a TSAWARE process? – Kenway

Instead of closing as off-topic, could this be moved to serverfault? – Museology

Answer 1

Yes Tsappcmd.dll will affect any and all programs that do not have the TSAWARE flag in the PE header. This does NOT automatically mean however that all those apps are affected by this particular bug. But you can easily test this by setting the TSAWARE flag (see the link that TOndrej provided to my blog) or by setting the registry key that is mentioned in the KB article.

PS: the explanation that it's a protection against viruses seems like a bogus explanation, this mechanism was introduced for app compat reasons...

Grateful