diff --git a/lib/env_windowsKernelModeWin8_1.c b/lib/env_windowsKernelModeWin8_1.c
index 698cdac..f3129dc 100644
--- a/lib/env_windowsKernelModeWin8_1.c
+++ b/lib/env_windowsKernelModeWin8_1.c
@@ -41,6 +41,7 @@ VOID
SYMCRYPT_CALL
SymCryptInitEnvWindowsKernelmodeWin8_1nLater( UINT32 version )
{
+ __declspec(no_init_all)
RTL_OSVERSIONINFOW verInfo;
if( g_SymCryptFlags & SYMCRYPT_FLAG_LIB_INITIALIZED )
diff --git a/lib/symcrypt.vcxproj b/lib/symcrypt.vcxproj
index dbe50b9..e11d1e3 100644
--- a/lib/symcrypt.vcxproj
+++ b/lib/symcrypt.vcxproj
@@ -10,7 +10,7 @@
lib
$(SolutionDir)msbuild\
$(SolutionDir)
- true
+ true
$(ProjectDir);$(IncludePath);
@@ -167,7 +167,7 @@
-
+
diff --git a/modules/windows/kernel/entropy_accumulator.c b/modules/windows/kernel/entropy_accumulator.c
index 45d2bc9..17a32bf 100644
--- a/modules/windows/kernel/entropy_accumulator.c
+++ b/modules/windows/kernel/entropy_accumulator.c
@@ -222,9 +222,7 @@ SymCryptEntropyAccumulatorAccumulateSample(
// As we know nSamplesAccumulated is a multiple of 128, we can just align to the nearest byte
bufferIndex = (nSamplesAccumulated & (SYMCRYPT_ENTROPY_ACCUMULATOR_SAMPLES_PER_BUFFER - 1)) / 8;
- // use memset here because the compiler can't optimize it away, and it should have the best codegen.
- // SymCryptWipeKnownSize would also work but it is not optimized for buffers this large.
- memset( &pState->buffer[bufferIndex], 0, SYMCRYPT_ENTROPY_ACCUMULATOR_SEGMENT_SIZE );
+ SymCryptWipeKnownSize( &pState->buffer[bufferIndex], SYMCRYPT_ENTROPY_ACCUMULATOR_SEGMENT_SIZE );
pState->nDPCScheduleFailures++;
}
diff --git a/modules/windows/kernel/main.c b/modules/windows/kernel/main.c
index cbaf22d..78adb5c 100644
--- a/modules/windows/kernel/main.c
+++ b/modules/windows/kernel/main.c
@@ -20,24 +20,13 @@ SYMCRYPT_ENVIRONMENT_WINDOWS_KERNELMODE_LATEST;
#define FIPS_SERVICE_DESC_SHOW_VERSION
#include "../lib/status_indicator.h"
-// Our DriverEntry function is not used, as this module acts as an export driver which is linked
-// directly to the kernel. In other words, it's not initialized by WDF, and we don't create any
-// device objects or use other WDF functions. However, we need to define the function to be able
-// to link with some of the KMDF libs.
-NTSTATUS
-DriverEntry(
- _In_ struct _DRIVER_OBJECT* DriverObject,
- _In_ PUNICODE_STRING RegistryPath
- )
-{
- UNREFERENCED_PARAMETER( DriverObject );
- UNREFERENCED_PARAMETER( RegistryPath );
-
- return STATUS_SUCCESS;
-}
+void __cdecl __security_init_cookie(void);
VOID SYMCRYPT_CALL SymCryptModuleInit(UINT32 api, UINT32 minor)
{
+ // Initialize the /GS flag stack overflow cookie
+ __security_init_cookie();
+
if (api != SYMCRYPT_CODE_VERSION_API ||
(api == SYMCRYPT_CODE_VERSION_API && minor > SYMCRYPT_CODE_VERSION_MINOR))
{
diff --git a/modules/windows/kernel/symcryptk.vcxproj b/modules/windows/kernel/symcryptk.vcxproj
index d5d22dc..b08693c 100644
--- a/modules/windows/kernel/symcryptk.vcxproj
+++ b/modules/windows/kernel/symcryptk.vcxproj
@@ -36,7 +36,7 @@
kmdll
$(SolutionDir)msbuild\
$(SolutionDir)
- true
+ true
@@ -59,7 +59,7 @@
true
UseLinkTimeCodeGeneration
%(AdditionalDependencies);ntoskrnl.lib
- GsDriverEntry
+ true
diff --git a/msbuild/symcrypt.undocked.props b/msbuild/symcrypt.undocked.props
index 876d27f..bedc5ce 100644
--- a/msbuild/symcrypt.undocked.props
+++ b/msbuild/symcrypt.undocked.props
@@ -28,34 +28,12 @@
MultiByte
true
/Gy %(AdditionalOptions)
-
- /kernel
- %(AdditionalOptions)
-
true
SYMCRYPT_MASM;%(PreprocessorDefinitions)
/Gy %(AdditionalOptions)
-
-
- /nodefaultlib:libcmt.lib
- /nodefaultlib:libcmtd.lib
- %(AdditionalOptions)
-
-
- /d2:-guardcfgdispatch
- /guard:exportsuppress
- /kernel
- /NOOPTIDATA
- /merge:.gfids=GFIDS
- /merge:.orpc=.text
- /merge:_RDATA=.rdata
- /section:GFIDS,d
- %(AdditionalOptions)
-
-
@@ -77,47 +55,24 @@
MultiThreadedDLL
-
-
- _AMD64_;%(PreprocessorDefinitions)
-
- %(AdditionalOptions) /cbstring-
-
-
-
- /guard:retpoline /IGNORE:4287 %(AdditionalOptions)
-
-
-
+
StdCall
- _X86_;%(PreprocessorDefinitions)
true
-
-
- _ARM64_;%(PreprocessorDefinitions)
-
-
SYMCRYPT_CPU_AMD64
- SYMCRYPT_CPU_X86
+ SYMCRYPT_CPU_X86
-
- SYMCRYPT_CPU_ARM64
+
+ SYMCRYPT_CPU_ARM64
@@ -142,13 +97,11 @@
-
+
-
-
- -machine arm64ec
-
+
+
diff --git a/msbuild/windows.undocked.props b/msbuild/windows.undocked.props
index 9c18923..5ce8156 100644
--- a/msbuild/windows.undocked.props
+++ b/msbuild/windows.undocked.props
@@ -6,16 +6,13 @@
$(SolutionDir)
0
false
-
+ false
+
true
-
- true
-
- true
-
-
+
+
Debug
Win32
@@ -50,34 +47,6 @@
-
-
-
- Debug
- x64
-
-
- Release
- x64
-
-
- Debug
- ARM64
-
-
- Release
- ARM64
-
-
- Debug
- ARM64EC
-
-
- Release
- ARM64EC
-
-
-
fre
@@ -165,17 +134,21 @@
-
-
- -d2jumptablerdata -d2epilogunwindrequirev2 %(AdditionalOptions)
-
-
-
-
+
true
+
+
+
+ _AMD64_;%(PreprocessorDefinitions)
+ _X86_;%(PreprocessorDefinitions)
+ _ARM64_;%(PreprocessorDefinitions)
+ _AMD64_;_ARM64EC_;%(PreprocessorDefinitions)
+
+
+
@@ -239,6 +212,11 @@
/ZH:SHA_256
/Zp8
+
+ -d2jumptablerdata
+ -d2epilogunwindrequirev2
+ %(AdditionalOptions)
+
/kernel
%(AdditionalOptions)
@@ -293,9 +271,8 @@
/section:GFIDS,d
%(AdditionalOptions)
-
+
/DynamicValueFixupSym:mm_shared_user_data_va=0x7FFE0000
- /guard:xfg
%(AdditionalOptions)
@@ -306,20 +283,13 @@
/highentropyva
%(AdditionalOptions)
-
+
/highentropyva
%(AdditionalOptions)
-
-
-
- /GuardRetpoline
-
-
-
+ Sync
true
diff --git a/unittest/module_windows_sys_um/symcryptkerneltestmodule_um.vcxproj b/unittest/module_windows_sys_um/symcryptkerneltestmodule_um.vcxproj
index 13bcc40..be2bdbe 100644
--- a/unittest/module_windows_sys_um/symcryptkerneltestmodule_um.vcxproj
+++ b/unittest/module_windows_sys_um/symcryptkerneltestmodule_um.vcxproj
@@ -10,7 +10,6 @@
dll
$(SolutionDir)msbuild\
$(SolutionDir)
- false