Mysterious Windows 10 driver verifier assertion

NTDEV
1

My driver calls ExAllocatePoolWithTag to get a NonPagedPool buffer of about 40 bytes. However, when this code is run in Windows 10 with verifier on, the below prompt occurs in the debugger. Does anyone know what this means?

*********** Verifier Detected a Code Integrity Issue ************
**
** The caller 0xFFFFF8001464153B specified an executable pool type 0x0 (tag 0x6c6d6f6e).
**
*****************************************************************

*** Verifier assertion failed ***
(B)reak, (I)gnore, (W)arn only, (R)emove assert?

2

With Windows 10 they started enforcing the requirement that drivers allocate
memory with no execute, see
https://msdn.microsoft.com/en-us/library/windows/hardware/ff559707(v=vs.85
%29.aspx?f=255&MSPPError=-2147217396 Basically for Windows 10 use
NonPagedPoolNx.

Don Burn
Windows Driver Consulting
Website: http://www.windrvr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Tuesday, February 02, 2016 9:16 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Mysterious Windows 10 driver verifier assertion

My driver calls ExAllocatePoolWithTag to get a NonPagedPool buffer of about
40 bytes. However, when this code is run in Windows 10 with verifier on, the
below prompt occurs in the debugger. Does anyone know what this means?

*********** Verifier Detected a Code Integrity Issue ************
**
** The caller 0xFFFFF8001464153B specified an executable pool type 0x0 (tag
0x6c6d6f6e).
**
*****************************************************************

*** Verifier assertion failed ***
(B)reak, (I)gnore, (W)arn only, (R)emove assert?

NTDEV is sponsored by OSR

Visit the list online at:
http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at
http:</http:></http:></http:>

3

Check the documentation on the POOL_TYPE parameter. On Windows 8 and later, you should use NonPagedPoolNx instead of NonPagedPool, as the latter is now equivalent to NonPagedPoolExecute which will give you a block of executable memory (which presumably you don’t really need).

Jeff

4

We use a single binary for Windows 7 and later. What happens if NonPagedPoolNx is specified in Windows 7? Seems to do the right thing, but if it is undefined behavior then a RtlGetVersion version check for Windows 8 or later can be implemented if necessary.

5

Yeah, I think NonPagedPoolNx is undefined in Windows 7 so you’ll need to do a version check.

Jeff

6

Use NonPagedPoolNx instead of NonPagedPool

wrote in message news:xxxxx@ntdev…
> My driver calls ExAllocatePoolWithTag to get a NonPagedPool buffer of about 40 bytes. However, when this code is run in Windows 10 with verifier on, the below prompt occurs in the debugger. Does anyone know what this means?
>
>
> Verifier Detected a Code Integrity Issue*
>
> The caller 0xFFFFF8001464153B specified an executable pool type 0x0 (tag 0x6c6d6f6e).
>
>***************************************************************
>
> Verifier assertion failed
> (B)reak, (I)gnore, (W)arn only, (R)emove assert?
>
>

7

>RtlGetVersion

RtlIsNtDdiVersionAvailable is the correct call.

Just call it in DriverEntry and set your own global MyNonPagedPool.

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

8

I am also getting this error.

I got this error when I did MmGetSystemAddressForMdlSafe() on a
MDL that was passed to me by an MS kernel component. Not sure how I am involved here.

MmGetMdlVirtualAddress() on the same MDL didn’t throw this error.

Also I am l am already using the NonPagedPoolNx for the memory I am allocating elsewhere, not related to above code. DV caught this for me in this case.

9

Actually there is a much easier mechanism to use if you’re distributing the
same driver for both Windows 7 and later version -
https://msdn.microsoft.com/en-us/library/windows/hardware/hh920402(v=vs.85).aspx

You just define a macro POOL_NX_OPTIN=1 and make the following call in your
DriverEntry function: ExInitializeDriverRuntime(DrvRtPoolNxOptIn) - you do
this before allocating any memory.

If you do these steps you can leave your allocations using NonPagedPool and
they’ll be NonPagedPoolNx on Windows8 and later and remain NonPagedPool on
Windows 7.

On 3 February 2016 at 08:31, Maxim S. Shatskih
wrote:

> >RtlGetVersion
>
> RtlIsNtDdiVersionAvailable is the correct call.
>
> Just call it in DriverEntry and set your own global MyNonPagedPool.
>
> –
> Maxim S. Shatskih
> Microsoft MVP on File System And Storage
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: <
> http://www.osronline.com/showlists.cfm?list=ntdev&gt;
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>