lirent 32440c7104 Drop the user-half top-level NX bit when deriving VR_X ...

Under KVA shadow (KPTI) the kernel CR3 marks user-half PML4Es NX as
hardening, so OR-ing that top-level NX down the walk made every user
region non-executable - even live code (ntdll .text read back r--u).
Ring 3 executes those pages via the user/shadow CR3, which reaches the
same shared lower tables through an NX-clear PML4E, so the kernel
table's user-half PML4E NX is not what enforces user execution. Ignore
it on the user half; sub-PML4E NX (shared between both CR3s) stays
authoritative.

2026-06-26 07:57:26 +03:00

..

codeanalysis.h

Add function-level code diff over caller-supplied views

2026-06-16 20:21:36 +03:00

memmodel.h

Drop the user-half top-level NX bit when deriving VR_X

2026-06-26 07:57:26 +03:00

pmap.h

Add process-scoped scanning algorithms: multi-pattern, code-xref, pointer-map, dissection, snapshot diff

2026-06-16 17:38:10 +03:00

scan.h

Add code-structure analysis: call graph, jump tables, basic blocks, constant xref

2026-06-16 19:52:25 +03:00

siggen.h

Add function inventory (.pdata), signature generation, and export/PDB symbols

2026-06-16 19:27:42 +03:00

sigscan.h

Add process-scoped scanning algorithms: multi-pattern, code-xref, pointer-map, dissection, snapshot diff

2026-06-16 17:38:10 +03:00

snapdiff.h

Add process-scoped scanning algorithms: multi-pattern, code-xref, pointer-map, dissection, snapshot diff

2026-06-16 17:38:10 +03:00

win32.h

Take the kernel cr3 in the read-only win32 constructor

2026-06-20 17:02:29 +03:00

x86dec.h

Add code-structure analysis: call graph, jump tables, basic blocks, constant xref

2026-06-16 19:52:25 +03:00