title: What impact does a discardable section have in a kernel driver if it is marked RWX?
body: <p>I'm intrigued by the <code>DISCARDABLE</code> flag in the section flags in PE files, specifically in the context of Windows drivers (in this case NDIS). I noticed that the <code>INIT</code> section was marked as RWX in a driver I'm reviewing, which seems odd - good security practice says you should adopt a W^X policy.</p>
  <p>The dump of the section is as follows:</p>
  <pre><code>Name      Virtual Size  Virtual Addr  Raw Size      Raw Addr      Reloc Addr    LineNums      RelocCount    LineNumCount  Characteristics
  INIT      00000B7E      0000E000      00000C00      0000B200      00000000      00000000      0000          0000          E2000020
  </code></pre>
  <p>The characteristics map to:</p>
  <ul>
  <li><code>IMAGE_SCN_MEM_EXECUTE</code></li>
  <li><code>IMAGE_SCN_MEM_READ</code></li>
  <li><code>IMAGE_SCN_MEM_WRITE</code></li>
  <li><code>IMAGE_SCN_MEM_DISCARDABLE</code></li>
  <li><code>IMAGE_SCN_CNT_CODE</code></li>
  </ul>
  <p>The <code>INIT</code> section seems to contain the driver entry, which implies that it might be used to ensure that the driver entry function resides in nonpaged memory, whereas the rest of the code is allowed to be paged. I'm not entirely sure, though. I can see no evidence in the driver code to say that the developers explicitly set the page flags, or forced the driver entry into a separate section, so it looks like the compiler did it automatically. I also manually flipped the writeable flag in the driver binary to test it out, and it works fine without writing enabled, so that implies that having it RWX is unnecessary.</p>
  <p>So, my questions are:</p>
  <ul>
  <li>What is the INIT section used for in the context of a Windows driver and why is it marked discardable?</li>
  <li>How are discardable sections treated in the Windows kernel? I have some idea of <a href="http://doxygen.reactos.org/d3/d01/zeropage_8c_a7bc64a293d38f0c26b144fe21e5c75ff.html" rel="nofollow noreferrer">how ReactOS handles them</a> but that's still fuzzy and not massively helpful.</li>
  <li>Why would the compiler move the driver entry to an INIT section?</li>
  <li>Why would the compiler mark the section as RWX, when RX is sufficient and RWX may constitute a security issue?</li>
  </ul>
  <p>References I've looked at so far:</p>
  <ul>
  <li><a href="http://blogs.msdn.com/b/oldnewthing/archive/2012/07/13/10329051.aspx" rel="nofollow noreferrer">What happens when you mark a section as DISCARDABLE? - The Old New Thing</a></li>
  <li><a href="https://en.wikibooks.org/wiki/X86_Disassembly/Windows_Executable_Files" rel="nofollow noreferrer">Windows Executable Files - x86 Disassembly Book</a></li>
  <li><a href="https://msdn.microsoft.com/en-us/library/ff569979.aspx" rel="nofollow noreferrer">Pageable and Discardable Code in a Protocol Driver - MSDN</a></li>
  </ul>
  <hr />
  <p><strong>EDIT, 2022</strong>: I forgot to update this, but a while after I posted this question I passed it on to Microsoft and it did turn out to be a bug in the MSVC linker. They were mistakenly marking the discard section that contained DriverEntry as RWX. The issue was fixed in VS2015.</p>