Update new dvrt type and Load Config filed adapt to Windows11 #374
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
#353 is a great pr as it parses the dvrt structure.
However, here is the problem that it didn't deal with.
18050fe
(#353) missing a comma may cause problems when paring pe3218b71ea
(#353) with declaration in winnt.h, which leads to the array half missingThe most important thing is win11 introduces a new dvrt type called
function override
as one part of retpoline. As mentioned in #353, retpoline is the policy that Microsoft use it to mitigate Spectre v2. In fact, retpoline uses the relocations stored in dvrt and the new typefunction override
describes the function needed to be overridden when the image is loading. Here follows the brief code snippet in winnt.h (WDK ver.10.0.22621.0)For more testing, here I give two cases that both are official drivers in win11 which can be downloaded from msdl directly: