SIGN IN SIGN UP

Let GsDriverEntry seed the /GS stack cookie

FindWdk appends /ENTRY:GsDriverEntry, but the /ENTRY:DriverEntry added
here landed later on the link line and won. GsDriverEntry exists solely
to call __security_init_cookie() before DriverEntry, so the driver
shipped with __security_cookie left at the MSVC compile-time default
0x00002b992ddfa232 while /GS was still instrumenting 18 frames --
including debug_print, get_proc_address_wrap and vm_execute_function,
the three functions that parse module- and IOCTL-supplied data. Every
canary in them was a constant an attacker already knows.

GsDriverEntry tail-calls DriverEntry, so dropping the override is
enough. Verified on the linked image: the entry point is now
GsDriverEntry and __security_init_cookie is referenced.
N
namazso committed
7d5e35f6f63c61d1fe176e5e4c38f7ca16b7b443
Parent: 9066a8a