fix(windows): harden the ABE payload injection lifecycle (#638)

* fix(windows): harden the ABE payload injection lifecycle

The browser main thread is never resumed, so no window appears and the temp user-data-dir is unnecessary. Payload memory is RW then RX, with an explicit FlushInstructionCache before the remote thread executes it.

* test(windows): use US spelling in offset test

* fix(windows): validate bootstrap parameter encoding

crypto/windows/abe_native/bootstrap/layout.go

@@ -13,11 +13,13 @@ const (
 	KeyOffset            = 0x40
 	KeyLen               = 0x20
 
-	ImpLoadLibraryAOffset   = 0x40
-	ImpGetProcAddressOffset = 0x48
-	ImpVirtualAllocOffset   = 0x50
-	ImpVirtualProtectOffset = 0x58
-	ImpNtFlushICOffset      = 0x60
+	ParamsSize          = 0x30
+	ParamScratchBase    = 0x0
+	ParamLoadLibraryA   = 0x8
+	ParamGetProcAddress = 0x10
+	ParamVirtualAlloc   = 0x18
+	ParamVirtualProtect = 0x20
+	ParamNtFlushIC      = 0x28
 
 	MarkMZFound      = 0x2
 	MarkImportsOK    = 0x5

crypto/windows/abe_native/bootstrap/layout_gen.go

@@ -20,11 +20,13 @@ const (
 	KeyOffset            = C.BOOTSTRAP_KEY_OFFSET
 	KeyLen               = C.BOOTSTRAP_KEY_LEN
 
-	ImpLoadLibraryAOffset   = C.BOOTSTRAP_IMPORT_LOADLIBRARYA_OFFSET
-	ImpGetProcAddressOffset = C.BOOTSTRAP_IMPORT_GETPROCADDRESS_OFFSET
-	ImpVirtualAllocOffset   = C.BOOTSTRAP_IMPORT_VIRTUALALLOC_OFFSET
-	ImpVirtualProtectOffset = C.BOOTSTRAP_IMPORT_VIRTUALPROTECT_OFFSET
-	ImpNtFlushICOffset      = C.BOOTSTRAP_IMPORT_NTFLUSHIC_OFFSET
+	ParamsSize          = C.BOOTSTRAP_PARAMS_SIZE
+	ParamScratchBase    = C.BOOTSTRAP_PARAM_SCRATCH_BASE
+	ParamLoadLibraryA   = C.BOOTSTRAP_PARAM_LOAD_LIBRARY_A
+	ParamGetProcAddress = C.BOOTSTRAP_PARAM_GET_PROC_ADDRESS
+	ParamVirtualAlloc   = C.BOOTSTRAP_PARAM_VIRTUAL_ALLOC
+	ParamVirtualProtect = C.BOOTSTRAP_PARAM_VIRTUAL_PROTECT
+	ParamNtFlushIC      = C.BOOTSTRAP_PARAM_NT_FLUSH_IC
 
 	MarkMZFound      = C.BOOTSTRAP_MARK_MZ_FOUND
 	MarkImportsOK    = C.BOOTSTRAP_MARK_IMPORTS_OK