Do enclaves require vertdll.dll module in IAT?

[riverar]

After creating a stripped down miniature Enclave, I discovered InitializeEnclave fails with 0x8007007E. After hours of pulling my hair out, it appears initialization of enclaves requires vertdll.dll in the enclave IAT. Can you confirm this is the case? (I used a hollow enclave with a DllMain and a single return 42 test function, which ultimately resulted in a DLL with no imported functions.

[bbonaby]

Hey @riverar, yes that's correct. Your enclave must include vertdll.dll in its IAT by linking the vertdll.lib import library or it will not load.

The "vert" in "vertdll" stands for VSM enclave runtime, so think of it as mandatory for all vbs enclaves to function.

[riverar]

Thanks for confirming @bbonaby. Beware the libs are just import libs and if you don't call any of the contained functions, it will not be put into the IAT. So you may want to add this requirement to the dev docs somehow! (And your tooling here needs to force inclusion.)

I recognize this may be a niche scenario--you'd certainly hope enclave devs would be calling at least one of those functions. But was certainly a nasty gotcha for my hello-world!

[AdamBraden]

@bbonaby - can you make a recommended doc fix based on @riverar suggestion?

[riverar]

Recognizing my scenario is niche, perhaps this will do? MicrosoftDocs/sdk-api#2145

[alvinashcraft]

Is everything covered in the VBS Enclaves development guide here? Step 6 under compiling talks about the required DLLs. If that is accurate, a note pointing to that doc could be added to the API doc.

[riverar]

@alvinashcraft Yes and no.

The guide instructs users to link against vertdll.lib, but this alone doesn't guarantee the library will be loaded. The library only gets loaded if the enclave DLL actually calls at least one API from vertdll. (I'm eliding msvc compiler/linker details here.) Most users naturally call these APIs, so they don't encounter problems but I'm an edge case. In my scenario, I created a simple hello-world DLL that didn't use any vertdll APIs, which meant vertdll was excluded from the Import Address Table (IAT) of the enclave DLL and never got loaded.

Because of the niche nature of this, I suggested a really minor edit. Not sure there's ROI on doing much more and apologies in advance for sucking up folk's time. Thanks in advance for the enclave work!