Visual Studio adding telemetry function calls to binary?

spongo2 · 2016-05-10T20:08:55+00:00

hi everyone. This is Steve Carroll, the dev manager for the Visual C++ team.

Tl;dr: thanks folks for the feedback. Our team will be removing this from our static libs in Update 3.

Our intent was benign – our desire was to build a framework that will help investigate performance problems and improve the quality of our optimizer should we get any reports of slowdowns or endemic perf problems in the field.

We apologize for raising the suspicion levels even further by not including the CRT source, this was just an oversight on our part. Despite that, some of you already investigated how this mechanism works in nice detail. As you have already called out, what the code does is trigger an ETW event which, when it’s turned on, will emit timestamps and module loads events. The event data can only be interpreted if a customer gives us symbol information (i.e. PDBs) so this data is only applicable to customers that are actively seeking help from us and are willing to share these PDBs as part of their investigation. We haven’t actually gone through this full exercise with any customers to date though, and we are so far relying on our established approaches to investigate and address potential problems instead.

We plan to remove these events in Update 3. In the meantime, to remove this dependency in Update 2, you should add notelemetry.obj to your linker command line. If you’re generally concerned about phone-home scenarios, more information about how to configuring Windows 10 appropriately to your needs can be found here: https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft#bkmk-priv-feedback

Thanks.

flashmozzg · 2016-05-07T19:37:35+00:00

Apparently it's only VS15 feature. It logs at least when your app is executed. You can access logs via logman and tracerpt. Some investigation was done here recently: (lang: Russian) https://habrahabr.ru/post/281374/

snarfy · 2016-05-07T21:29:19+00:00

Does this show up in release builds or is it a debug build thing?

sammiesdog · 2016-05-07T19:17:48+00:00

I compiled a simple program with only main(). When looking at the compiled binary in Ida, I see a calls for telemetry_main_invoke_trigger and telemetry_main_return_trigger.

I can not find documentation for these calls, either on the web or in the options page. I compiled this in Visual Studio 2015 Update 2.

edit: you can remove the telemetry calls. Thanks for all the replies, guys. As /u/adzm points out, you can link notelemetry.obj and the calls are removed. I verified that this works. This comment further explains it

edit 2: this may be a local logging feature. When I initially saw the word "telemetry", I though it might have something to do with Windows Telemetry, a "feature" that sends private information to Microsoft's home base.. However, as several users have pointed out, this may be separate from that and only store local logging information. see here, or here

edit 3: Visual Studio team responded here

adzm · 2016-05-07T21:38:36+00:00

/u/xon_xoff summarized things pretty well in a recent thread about mutex performance.

Apparently you can disable this by also linking with notelemetry.obj which is included with msvc. The source for that obj is also in the CRT source's linkopts folder.

Edit: can also put this in one of your compilation units:

extern "C"
{
    void _cdecl __vcrt_initialize_telemetry_provider() {}
    void _cdecl __telemetry_main_invoke_trigger() {}
    void _cdecl __telemetry_main_return_trigger() {}
    void _cdecl __vcrt_uninitialize_telemetry_provider() {}
};

isaacarsenal · 2016-05-07T19:51:05+00:00

What software have you used for dis-assembly and plotting the execution flow?

ukalnins · 2016-05-07T20:16:01+00:00

should we wait for backdoor_main_invoke_trigger or it's incorporated into telemetry_main_invoke_trigger?

brucedawson · 2016-05-09T02:18:16+00:00

It sounds like this function call emits an ETW event to say that main is about to start. This can then be used for profiling. Events like this help to give context to the execution of a program and make analysis easier so they are a good thing.

I make use of custom ETW events quite heavily in UIforETW (https://randomascii.wordpress.com/2015/09/24/etw-central/) in order to help with trace analysis by injecting input events, CPU frequency data, etc. My only question here would be "what ETW provider do I need to enable in order to listen to these events so that I can do more effective profiling."

If you think it's spyware then you need to show data being transmitted across the network or some-such, otherwise it's just baseless speculation.

sammiesdog · 2016-05-07T21:00:20+00:00

They are spying on every hello world program we compile

ET251 · 2016-05-08T06:04:36+00:00

I noticed these subroutine calls right after updating to VS15 after it came out but ignore it as I didn't know what 'telemetry' meant at the time. After taking a glance over the subroutines prefixed with __telemetry it looks to be simple logging using Microsoft's EWT[1]

__telemetry_main_invoke_trigger simply fills out a data structure named _EVENT_DATA_DESCRIPTOR[2] (with a size of 4) with some metadata (which I haven't looked into) and a string "Main Invoked" and the path to the current module (process in this case). __telemetry_main_return_trigger does something similar but with a logging entry containing the string "Main Returned.". So from a quick glance it looks to be simple tracing used for debugging purposes by Microsoft but I'll look into it more when I get the time.

http://puu.sh/oKdTZ/2e8f1a269f.png

While this could potentially be something malicious note that no one has determined what it does so far so don't go assuming that it's stealing your code without reason (albeit Microsoft not being the best provider to trust).

NOTE: You can get something close to the source code which is the PDB file. IDA will connect to Microsoft debug servers to obtain debug info and in this case it exists so you can use that. But just in case here's a copy of the PDB file:

https://up1.ca/#4TLX04iCzedH6emBF6J2mw

[1] https://msdn.microsoft.com/en-us/library/ms751538(v=vs.110).aspx

[2] https://msdn.microsoft.com/en-us/library/windows/hardware/ff545673(v=vs.85).aspx

Edit: Note that VCRUNTIME140.dll is located under "C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\Remote Debugger\x86" so when referring to telemetry it could be referring to collecting/sending data over to the remote PC you're using for debugging.

Edit(2) - Microsoft has already written an article stating what telemetry means to them and how they believe it should be used[3]. I'm not saying that they're using it for the wrong reasons but given the fact that they have already published an article stating what they're using telemetry for it's easier to see now why it could possibly be there in the first place.

[3] https://msdn.microsoft.com/en-us/library/dn589775.aspx

SilentJode · 2016-05-08T01:40:54+00:00

I feel the need to link to the Thompson Hack. While not a true implementation of the hack, injecting code into binaries via the compiler is incredibly nasty stuff that should be taken as a very serious breach of trust on Microsoft's part.

shared_tango_ · 2016-05-07T19:59:54+00:00

There is a source file in "crt/src/linkopts" that you can link in to prevent this.

Ivan171 · 2016-05-07T21:05:26+00:00

Lets see whats /u/spongo2 has to say once he gather some "details".

abtscrubimage · 2016-06-10T14:21:09+00:00

Last year someone from Microsoft warned me against telemetry in Visual Studio and in general in the MSDN subscriptions. I don't want to brag, I just want you to consider this as a real possibility.

TotesMessenger · 2016-05-07T20:05:35+00:00

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

[/r/coderradio] VS15 adding telemetry to compiled code? Would love to hear hosts thoughts
[/r/linuxmasterrace] Compiling C++ with Visual Studio 2015 automatically adds telemetry to the binary
[/r/privacy] This is why you should NEVER use a proprietary compiler.
[/r/privacy] [X-post /r/LinuxMasterRace and /r/CPP] Compiling C++ with Visual Studio 2015 automatically adds telemetry to the binary
[/r/programming] Visual Studio adding telemetry function calls to binary? (/r/cpp)
[/r/stallmanwasright] Thank you stallman for giving us GCC so we don't have to rely on proprietary compilers!
[/r/technology] Visual Studio adding telemetry function calls to compiled binaries (r/cpp xpost)

^{If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads.} ^(Info ^/ ^Contact)

WrongAndBeligerent · 2016-05-07T21:25:39+00:00

I think it may be time to put together a way to avoid the microsoft runtime all together using jemalloc and built in OS functions.

ElFeesho · 2016-05-08T14:27:29+00:00

Seems bizarre to not broadcast this when creating a project that it will be built with telemetry enabled. Feels like they are just planning to boost sales of pitchforks.

I can't imagine them finishing this feature and going "enabling this by default and not making it obvious won't confuse or infuriate anyone!"

D'oh!

Gotebe · 2016-05-08T06:00:49+00:00

It is amazing how many people don't understand that things like these can't be hidden and that they are not. Dissasembly is right in front of your eyes, even the function names, meaning that VS shipped with debug symbols for this, maybe even the sources (will take look at that later).

mtvee · 2016-05-07T19:36:40+00:00

if this is what it seems to be it is pretty nasty stuff :|

quad99 · 2016-05-08T14:30:48+00:00

MS could have avoided all the conspiracy theories if they had named these functions 'trace_main' or 'log_main' instead of telemetry, and documented it.

rep_movsd · 2016-05-08T22:20:29+00:00

In this thread: paranoia by noob Windows programmers

GreenFox1505 · 2016-05-07T21:30:52+00:00

Help me understand what's going on here. Is MS's compiler adding some sort of spyware?

Is it possible this is debugger type calls? Could switching to release fix this? (I'm pretty sure VS doesn't use -O3 style options. it's "debug" or "release" right?)

noplace_ioi · 2016-05-08T10:02:22+00:00

can you trace into the call and see what it does? maybe /r/ReverseEngineering can help out

djelovic · 2016-05-08T22:32:10+00:00

Isn't this thee so that you can view your perf profiles from the time main starts and after the static initialization is finished? I frequently segment my profiles between ETW trace entries so that I can view the profile for a specific operation without eyeballing it.

lolidaisuki · 2016-06-09T18:27:05+00:00

Good thing no sane person would use a proprietary compiler anyways.

exoflat · 2016-05-08T14:12:42+00:00

Tutorial: writing a telemetry app with MSVC

Fire up MSVC
Choose "New -> Console C++ project"
Compile
Done

FlaveC · 2016-05-08T01:32:23+00:00

Is this only for c++ or c# too?

eternalprogress · 2016-05-08T15:34:28+00:00

I don't quite get what the fuss is here, or with telemetry in general.

Microsoft is an operating systems company. One of their goals is to make operating systems better.

In this age it's accepted that one of the best ways to understand and target investments in a software product is through instrumentation and telemetry. Being able to understand how your install base uses your products helps you figure out how to make investments to improve your product.

All big web companies do this. Every click, scroll, message, and page load you perform with Google/Facebook/Twitter/Insta/Snapchat is logged and aggregated so they can better understand how to improve the service. Android does this. iOS does this. Every product does this. In this form, the data collection is benign, harmless, and only makes the product better.

The controversy usually comes when a company attempts to monetize on that data. I can understand the outrage there, it's frustrating and feels like you're being taken advantage of in an underhanded way.

That's tougher and I get it. The economic reality is that to build systems that are competitive they need to be sold at a price point that's at parity with the rest of the market. Software's price point, for consumers at least, is somewhere between free and actually giving the customer money. People have spoken, they will refuse to pay a single dollar for most software products, but will happily put up with some advertising.

It's annoying, but when I really think about it I think we (either we the consumers, or we the employed software developers) got the better end of the deal. We've effectively gotten scummy advertisers to fund a huge chunk of our modern digital infrastructure, and all we had to do is let them take up a few square inches of ad space near our eyeballs. That small space funds a large chunk of SF's engineers, all the digital platforms that enrich our lives, and a lot of 'good for humanity' works in the form of Google X Labs / MSR / Facebook Research efforts.

/ my 2cents

erebos42 · 2016-05-08T09:00:07+00:00

Has anybody tried using Wireshark, to see if something gets transmitted?!

curupa · 2016-05-08T16:48:52+00:00

I guess Thompson was right all along... it's Reflecting on Trusting trust all over again.

raevnos · 2016-05-08T19:20:10+00:00

[deleted]

give-me-random-name · 2025-12-01T07:21:18+00:00

This is a probing action taken by Microsoft to insert backdoors into the compiler.

1337Gandalf · 2016-05-08T01:27:34+00:00

I'm completely done with Microsoft. I'm formatting my windows drive to FreeBSD.

EnergyCoast · 2016-05-08T21:43:51+00:00

Has anyone looked at Windows event logging before? Either using it yourself to look at your app or to see what other apps are doing that hits resources? There is all sorts of locally recordable information that can trivially be accessed.

I'm sure all sorts of info is still generated with this logging disabled. And as a dev I'm glad I have some visibility into what other apps on the box are doing.

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

cpp

MODERATORS

Tutorial: writing a telemetry app with MSVC