When I fuzz Windows Applications, I often enable PageHeap which helps to detect memory access error such as buffer overflows more reliably. If you have installed the full Windows Debugging Tools, then you can use a tool named gflags.exe which is I think is the official way to do this. It is as easy as running gflags.exe /p /enable notepad.exe /full, see here.

However, often I don't want or can't install software on the target under test and fortunately, having access to gflags.exe is not required for enabling PageHeap. It is just a registry setting in the Image File Execution registry settings. I always forget the cryptic registry option, so this blog post just documents the command which enables full PageHeap for notepad.exe by adding a registry entry:

reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v "GlobalFlag" /t REG_SZ /d "0x02000000" /f

Removing the global flags can be done by setting the value back to 0x00000000 (or to the value it was before).

Finally, some remarks and links:

• You need to restart the process, otherwise the new image file execution options will not take effect. Please note that the process requires more memory now.
• The flag must be of type REG_SZ, i.e. a string value. I don't know why Microsoft made this a string, in my opinion I would have used a REG_DWORD for setting some binary flags.
• Here is the official reference of all global flags.
• You can set some more flags and use a flag value of 0x02109870, too. This flag combination is stolen from the BugId github repository and explained below

REM 00000010 Enable heap tail checking
REM 00000020 Enable heap free checking
REM 00000040 Enable heap parameter checking
REM 00001000 Create user mode stack trace database
REM 00008000 Enable heap tagging by DLL
REM 00100000 Enable system critical breaks
REM 02000000 Enable page heap (full page heap)
REM ----------
REM 02109870 =

REM The following flags were considered but not enabled:
REM 00000080 Enable heap validation on call ## disabled because of overhead
REM 00000800 Enable heap tagging ## disabled because tags are not used.
REM 00000100 Enable application verifier ## disabled because of idunno
REM 00200000 Disable heap coalesce on free ## superfluous: page heap is enabled
REM 00400000 Enable close exception ## I don't think this is useful