LoadEnclaveImage "A device attached to the system is not functioning"

Question

I'm trying to load a signed DLL into a VBS enclave and LoadEnclaveImage is returning A device attached to the system is not functioning.

Hyper-V, Secure Boot, & TPM 2.0 are all functioning, so I'm not quite sure as to what the error is referring to.

Sample Code:

if (IsEnclaveTypeSupported(ENCLAVE_TYPE_VBS))
{
    DWORD lpError = 0;
    ENCLAVE_CREATE_INFO_VBS vci = { 0 };
    vci.Flags = 1;

    PVOID enclave = CreateEnclave(GetCurrentProcess(),
        NULL,
        1024 * 1024 * 2,
        NULL,
        ENCLAVE_TYPE_VBS,
        &vci,
        sizeof(ENCLAVE_CREATE_INFO_VBS),
        &lpError);

    if (enclave != NULL)
    {
        auto lib = LoadLibrary(L"kernelbase.dll");
        auto addr = (__LoadEnclaveImage)GetProcAddress(lib, "LoadEnclaveImageW");

        if (addr(enclave, L"...\testme.dll"))
        {
            printf("Worked!\n");
        }
        else {
            printf("Failed to load image\n");
            printf(GetLastErrorAsString().c_str());
        }

    }
    else
    {
        printf(GetLastErrorAsString().c_str());
    }
}
else {
    printf("VBS not supported\n");
}

Jackson_T · Accepted Answer · 2019-11-02T20:34:23.677

I got the same general error when loading a signed DLL, so I looked for usages of LoadEnclaveImageW in other system binaries using Static Import Finder, and found it in SgrmBroker.exe where it loads "SgrmEnclave_secure.dll". Attempting to use LoadEnclaveImageW with that DLL was successful.

Digging deeper into the PE structure of the "SgrmEnclave_secure.dll" file, we can see that a value is defined for EnclaveConfigurationPointer in the IMAGE_LOAD_CONFIG_DIRECTORY64 structure (see screenshot from PE-bear).

This pointer points to an IMAGE_ENCLAVE_CONFIG64 structure and this screenshot shows what it looks like when parsed in Ghidra. The ImportList member is an RVA for a series of IMAGE_ENCLAVE_IMPORT structures.

So it looks like these structures need to be defined in the PE. This can be done using the /ENCLAVE option in the linker. Not sure if there are additional requirements. Should you get further with this, I'd be interested to know.

LoadEnclaveImage "A device attached to the system is not functioning"

1 Answers1