Let GsDriverEntry seed the /GS stack cookie
FindWdk appends /ENTRY:GsDriverEntry, but the /ENTRY:DriverEntry added here landed later on the link line and won. GsDriverEntry exists solely to call __security_init_cookie() before DriverEntry, so the driver shipped with __security_cookie left at the MSVC compile-time default 0x00002b992ddfa232 while /GS was still instrumenting 18 frames -- including debug_print, get_proc_address_wrap and vm_execute_function, the three functions that parse module- and IOCTL-supplied data. Every canary in them was a constant an attacker already knows. GsDriverEntry tail-calls DriverEntry, so dropping the override is enough. Verified on the linked image: the entry point is now GsDriverEntry and __security_init_cookie is referenced.
N
namazso committed
7d5e35f6f63c61d1fe176e5e4c38f7ca16b7b443
Parent: 9066a8a