[FIXED IN SVN] VirtualBox fails to start on Windows 10 14286

Hi guys,

it's that time of the year again – the sizeof(IMAGE_LOAD_CONFIG_DIRECTORY64) has changed.

C:\Program Files\Oracle\VirtualBox>VBoxSDL.exe
: RTLdrOpenWithReader failed: Unknown Status -626 (0xfffffd8e) (Image='\SystemRoot\System32\ntdll.dll').

(Where -626 is VERR_LDRPE_LOAD_CONFIG_SIZE, for the external readers.)

Like in #13665 before, it is related to more "Control Flow Guard" changes (​https://msdn.microsoft.com/en-us/library/windows/desktop/mt637065.aspx). The latest Visual Studio 2015 tools apparently support it already:

C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\bin\>dumpbin.exe /LOADCONFIG C:\Windows\System32\ntdll.dll
Microsoft (R) COFF/PE Dumper Version 14.00.23506.0
Copyright (C) Microsoft Corporation. All rights reserved.
Dump of file C:\Windows\System32\ntdll.dll
File Type: DLL
 Section contains the following load config:
 000000C0 size
 0 time date stamp
 0.00 Version
 0 GlobalFlags Clear
 0 GlobalFlags Set
 0 Critical Section Default Timeout
 0 Decommit Free Block Threshold
 0 Decommit Total Free Threshold
 0000000000000000 Lock Prefix Table
 0 Maximum Allocation Size
 0 Virtual Memory Threshold
 0 Process Heap Flags
 0 Process Affinity Mask
 0 CSD Version
 0000 Reserved
 0000000000000000 Edit list
 0000000180160410 Security Cookie
 000000018015D1D0 Guard CF address of check-function pointer
 0000000180104000 Guard CF address of dispatch-function pointer
 0000000180104008 Guard CF function table
 774 Guard CF function count
 10013500 Guard Flags
 CF Instrumented
 FID table present
 Protect delayload IAT
 Delayload IAT in its own section
 Long jump target table present
 0000 Code Integrity Flags
 0000 Code Integrity Catalog
 00000000 Code Integrity Catalog Offset
 00000000 Code Integrity Reserved
 0000000000000000 Guard CF address taken IAT entry table
 0 Guard CF address taken IAT entry count
 0000000000000000 Guard CF long jump target table
 0 Guard CF long jump target count

I failed to find any public headers or symbols with the updated structure yet, so this might be open for a while.

But if there is some consistency applied to naming the new fields there, the dumpbin output above hints towards this addition to what the latest Windows SDK has:

 ULONGLONG GuardCFAddressTakenIatEntryTable; // VA
 ULONGLONG GuardCFAddressTakenIatEntryCount;
 ULONGLONG GuardCFLongJumpTargetTable; // VA
 ULONGLONG GuardCFLongJumpTargetCount;

VirtualBox Testbuild 5.0.17.105971
Windows 10 Enterprise Insider Preview x64 rs1_release.14286 (and newer)

Thanks and sorry for the trouble!

A minor correction. rs1_release.14291 has hit the public Insider Fast ring and public symbols for WinTypes.pdb are now available on the MS Symbol Server. The fields are actually named without the "CF" part:

 ULONGLONG GuardAddressTakenIatEntryTable; // VA
 ULONGLONG GuardAddressTakenIatEntryCount;
 ULONGLONG GuardLongJumpTargetTable; // VA
 ULONGLONG GuardLongJumpTargetCount;

Thanks for the report! I've updated our structures and PE parser code to handle them.

Here is a test build: https://www.virtualbox.org/download/testcase/VirtualBox-5.0.17-106344-Win.exe

Cool, thank you!

Verified working on:

• VirtualBox test build 5.0.17 r106344
• Windows 10 Enterprise Insider Preview x64 rs1_release.14312

Ticket can be closed as fixed.

Could you please also port the fix to a VirtualBox 4.3.37 Test Build? I cannot upgrade to 5.x yet, but still want to help test the fix on Windows 10 Build 14295 (released to Fast and Slow rings)!

Thanks, Jacob Klein

The latest 4.3 Windows test build has the fix as well. And the 5.0 build is now also properly linked from the test builds page as well.

I confirm that "Oracle VirtualBox v4.3.37 Test Build 106347" does indeed start correctly on Windows 10 Build 14295. Thanks bird and frank!!

Fix is part of VBox 5.0.18.

Is this the same bug? ​http://i.imgur.com/PYmGjQQ.png Started with build 14328 of Win10.

I've just upgraded to build 14328 (released today), and this problem is back with 5.0.18. Previous test build 5.0.17 that I was on doesn't work either.

C:\Program Files\Oracle\VirtualBox>vboxsdl
: RTLdrOpenWithReader failed: Unknown Status -626 (0xfffffd8e) (Image='\SystemRoot\System32\ntdll.dll').
C:\Program Files\Oracle\VirtualBox>vboxmanage --version
5.0.18r106667

This issue is still present with 5.0.19r106806, fwiw, but probably a bit too early to expect a fixed build...

Lol, that did not last long, did it...

Indeed, there is another new pointer-sized value at the end of the structure for ASLR improvements in the latest builds.

Edit: details moved to the new #15337, sorry for the necromancy!

(削除) Reopening to not have a thousand tickets about the same thing - sorry if that's not what you guys prefer (the previous fix already in a release etc.). (削除ここまで)

Ticket #15337 was already opened for the new insider build so please continue the discussion there.