Repository navigation
Do enclaves require vertdll.dll module in IAT? #148
Description
Activity
Hey Rafael Rivera (@riverar), yes that's correct. Your enclave must include vertdll.dll in its IAT by linking the vertdll.lib import library or it will not load.
The "vert" in "vertdll" stands for VSM enclave runtime, so think of it as mandatory for all vbs enclaves to function.
Reacted by Rafael RiveraThanks for confirming Branden Bonaby (@bbonaby). Beware the libs are just import libs and if you don't call any of the contained functions, it will not be put into the IAT. So you may want to add this requirement to the dev docs somehow! (And your tooling here needs to force inclusion.)
I recognize this may be a niche scenario--you'd certainly hope enclave devs would be calling at least one of those functions. But was certainly a nasty gotcha for my hello-world!
Branden Bonaby (@bbonaby) - can you make a recommended doc fix based on Rafael Rivera (@riverar) suggestion?
Recognizing my scenario is niche, perhaps this will do? MicrosoftDocs/sdk-api#2145
Is everything covered in the VBS Enclaves development guide here? Step 6 under compiling talks about the required DLLs. If that is accurate, a note pointing to that doc could be added to the API doc.
Alvin Ashcraft (@alvinashcraft) Yes and no.
The guide instructs users to link against
vertdll.lib, but this alone doesn't guarantee the library will be loaded. The library only gets loaded if the enclave DLL actually calls at least one API from vertdll. (I'm eliding msvc compiler/linker details here.) Most users naturally call these APIs, so they don't encounter problems but I'm an edge case. In my scenario, I created a simple hello-world DLL that didn't use any vertdll APIs, which meant vertdll was excluded from the Import Address Table (IAT) of the enclave DLL and never got loaded.Because of the niche nature of this, I suggested a really minor edit. Not sure there's ROI on doing much more and apologies in advance for sucking up folk's time. Thanks in advance for the enclave work!
After creating a stripped down miniature Enclave, I discovered
InitializeEnclavefails with0x8007007E. After hours of pulling my hair out, it appears initialization of enclaves requires vertdll.dll in the enclave IAT. Can you confirm this is the case? (I used a hollow enclave with a DllMain and a single return 42 test function, which ultimately resulted in a DLL with no imported functions.