Quantcast
Channel: Active questions tagged kernel - Stack Overflow
Viewing all articles
Browse latest Browse all 6334

What impact does a discardable section have in a kernel driver if it is marked RWX?

$
0
0

I'm intrigued by the DISCARDABLE flag in the section flags in PE files, specifically in the context of Windows drivers (in this case NDIS). I noticed that the INIT section was marked as RWX in a driver I'm reviewing, which seems odd - good security practice says you should adopt a W^X policy.

The dump of the section is as follows:

Name      Virtual Size  Virtual Addr  Raw Size      Raw Addr      Reloc Addr    LineNums      RelocCount    LineNumCount  CharacteristicsINIT      00000B7E      0000E000      00000C00      0000B200      00000000      00000000      0000          0000          E2000020

The characteristics map to:

  • IMAGE_SCN_MEM_EXECUTE
  • IMAGE_SCN_MEM_READ
  • IMAGE_SCN_MEM_WRITE
  • IMAGE_SCN_MEM_DISCARDABLE
  • IMAGE_SCN_CNT_CODE

The INIT section seems to contain the driver entry, which implies that it might be used to ensure that the driver entry function resides in nonpaged memory, whereas the rest of the code is allowed to be paged. I'm not entirely sure, though. I can see no evidence in the driver code to say that the developers explicitly set the page flags, or forced the driver entry into a separate section, so it looks like the compiler did it automatically. I also manually flipped the writeable flag in the driver binary to test it out, and it works fine without writing enabled, so that implies that having it RWX is unnecessary.

So, my questions are:

  • What is the INIT section used for in the context of a Windows driver and why is it marked discardable?
  • How are discardable sections treated in the Windows kernel? I have some idea of how ReactOS handles them but that's still fuzzy and not massively helpful.
  • Why would the compiler move the driver entry to an INIT section?
  • Why would the compiler mark the section as RWX, when RX is sufficient and RWX may constitute a security issue?

References I've looked at so far:


EDIT, 2022: I forgot to update this, but a while after I posted this question I passed it on to Microsoft and it did turn out to be a bug in the MSVC linker. They were mistakenly marking the discard section that contained DriverEntry as RWX. The issue was fixed in VS2015.


Viewing all articles
Browse latest Browse all 6334

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>