Continuing the discussion started in https://www.osronline.com/showthread.cfm?link=265937
We recently had two drivers pass the latest Windows 2016 HLK tests (file system and file system filter drivers FYI). They passed the new “Hyper-V code integrity” tests with flying colors. Built with Visual Studio 2013 and the Windows 8.1 WDK.
We are happily running with MS-signed drivers. Yeah! Even runs on Windows 2008 because MS sandwiched their SHA-256 signature between our own company SHA-1 and SHA-256 signatures.
But I can’t understand why they passed the code integrity test. Our driver INIT sections, containing DriverEntry (from habit), are marked as “Discardable, Executable, Read, Write”. It’s supposed to be a no-no to have Executable, writable sections these says, but Driver Verifier with flag 0x02000000 enabled for both drivers did not complain. (It DID complain when I called ExAllocatePool() without specifying no-execute, but I fixed that.)
My colleagues on another project were no so lucky. The HLK complained to them about an executable, writable INIT section.
Can anyone explain why Driver Verifier isn’t complaining for my drivers, but IS complaining for my poor colleagues?