Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

Monthly Seminars at OSR Headquarters

East Coast USA
Windows Internals and SW Drivers, Dulles (Sterling) VA, 13 November 2017

Kernel Debugging & Crash Analysis for Windows, Nashua (Amherst) NH, 4 December 2017

Writing WDF Drivers I: Core Concepts, Nashua (Amherst) NH, 8 January 2018

WDF Drivers II: Advanced Implementation Techniques, Nashua (Amherst) NH, 15 January 2018


Go Back   OSR Online Lists > ntdev
Welcome, Guest
You must login to post to this list
  Message 1 of 8  
09 Jan 18 02:06
Steve Walkin
xxxxxx@gmail.com
Join Date: 13 Jan 2015
Posts To This List: 9
Non-zero Code Integrity statistic found: Execute Pool Type Count

When I ran HLK for my old WDM driver for WIndows 10 64, I have got failures for HVCI code integrity test as below, "WDTF_TEST : Non-zero Code Integrity statistic found: Execute Pool Type Count: == 71" Could anybody help me to identify these violations in the code? How to verify the actual allocations for IRP/MDL/MEMORY in my driver code, which making these failure count.? Driver was built with WDK 7.
  Message 2 of 8  
09 Jan 18 06:20
Aleh Kazakevich
xxxxxx@mail.ru
Join Date: 27 Jul 2015
Posts To This List: 50
Non-zero Code Integrity statistic found: Execute Pool Type Count

Steve Walkin wrote: > > Could anybody help me to identify these violations in the code? Use the 'Code Integrity Check' option of the Driver Verifier (Windows 10).
  Message 3 of 8  
09 Jan 18 07:11
Scott Noone
xxxxxx@osr.com
Join Date:
Posts To This List: 1349
List Moderator
Non-zero Code Integrity statistic found: Execute Pool Type Count

You?ll inevitably need to use POOL_NX_OPTIN: https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/single-binary-op t-in-pool-nx-optin -scott OSR @OSRDrivers
  Message 4 of 8  
09 Jan 18 12:45
Tim Roberts
xxxxxx@probo.com
Join Date: 28 Jan 2005
Posts To This List: 11741
Non-zero Code Integrity statistic found: Execute Pool Type Count

xxxxx@gmail.com wrote: > When I ran HLK for my old WDM driver for WIndows 10 64, I have got failures for HVCI code integrity test as below, > > "WDTF_TEST : Non-zero Code Integrity statistic found: Execute Pool Type Count: == 71" > > Could anybody help me to identify these violations in the code? > How to verify the actual allocations for IRP/MDL/MEMORY in my driver code, which making these failure count.? I'd like to expand on Scott's answer, which is the correct one. The issue here is that, traditionally, memory allocations with ExAllocatePool have been done with PagedPool or NonPagedPool.  Those types allocate R/W/X pages.  In Windows 8, Microsoft added the NonPagedPoolNx type, which allocated R/W pages that cannot be executed.  Starting with Windows 10, you are now REQUIRED to use NonPagedPoolNx. That presents a problem for multi-platform drivers, because NonPagedPoolNx is not valid in Windows 7.  Scott's reference describes that workaround. Personally, I do not understand why Microsoft didn't simply redefine NonPagedPool to mean R/W and add a new type, NonPagedPoolExecute.  That would have been a MUCH less impactful solution.  Those very, very few drivers that need R/W/X pages would have caused an easily correctable BSOD, while the overwhelming majority of drivers that only needed R/W could have continued life unimpeded. -- Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc.
  Message 5 of 8  
10 Jan 18 04:25
Steve Walkin
xxxxxx@gmail.com
Join Date: 13 Jan 2015
Posts To This List: 9
Non-zero Code Integrity statistic found: Execute Pool Type Count

Thanks for your reply and suggestions, Aleh, Scott & Tim. Let me see whether I can get it fixed with it.
  Message 6 of 8  
10 Jan 18 09:00
Mark Roddy
xxxxxx@gmail.com
Join Date: 25 Feb 2000
Posts To This List: 4048
Non-zero Code Integrity statistic found: Execute Pool Type Count

I think the annoying reason to not make the much simpler change was to retain compatibility binary with existing code, even if that code presented a security risk. Although if it was my driver that suddenly stopped working I would not find this annoying. Mark Roddy On Tue, Jan 9, 2018 at 12:44 PM, xxxxx@probo.com <xxxxx@lists.osr.com> wrote: > xxxxx@gmail.com wrote: > > When I ran HLK for my old WDM driver for WIndows 10 64, I have got > failures for HVCI code integrity test as below, > > > > "WDTF_TEST : Non-zero Code Integrity statistic found: Execute Pool Type > Count: == 71" > > > > Could anybody help me to identify these violations in the code? > > How to verify the actual allocations for IRP/MDL/MEMORY in my driver > code, which making these failure count.? <...excess quoted lines suppressed...> --
  Message 7 of 8  
Yesterday 00:16
Steve Walkin
xxxxxx@gmail.com
Join Date: 13 Jan 2015
Posts To This List: 9
Non-zero Code Integrity statistic found: Execute Pool Type Count

I have used NonPagedPoolNx and thereby I am able to stripe out the Execute Pool Type Count completely. Thanks. But I still have errors on "Section Alignment Failures =8" and "Execute-Write Section Count=1". The "Execute-Write Section Count=1" appearing only in Windows 10 10586 build, whereas all the later builds does not showing this error. Any further insight for me resolve these failures.
  Message 8 of 8  
Yesterday 00:19
Aleh Kazakevich
xxxxxx@mail.ru
Join Date: 27 Jul 2015
Posts To This List: 50
Non-zero Code Integrity statistic found: Execute Pool Type Count

Driver Compatibility with Device Guard https://docs.microsoft.com/en-us/windows-hardware/test/hlk/testref/driver-compati bility-with-device-guard How to build compatible drivers ... * Don't use sections that are both writable and executable * Section Alignment must be a multiple of 0x1000 (PAGE_SIZE). E.g. DRIVER_ALIGNMENT=0x1000
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntdev list to be able to post.

All times are GMT -5. The time now is 04:21.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license