Enable the NX compatibility flag by default.

BUILDING

@@ -78,6 +78,9 @@ Variables you could set to customize the build:
 - OSLABEL
  This is the label that will be put in BOOT$(EFI_ARCH).CSV for your OS.
  By default this is the same value as EFIDIR .
+- POST_PROCESS_PE_FLAGS
+ This allows you to add flags to the invocation of "post-process-pe", for
+ example to disable the NX compatibility flag.
 
 Vendor SBAT data:
 It will sometimes be requested by reviewers that a build includes extra

Make.defaults

@@ -139,6 +139,8 @@ CFLAGS = $(FEATUREFLAGS) \
  $(INCLUDES) \
  $(DEFINES)
 
+POST_PROCESS_PE_FLAGS =
+
 ifneq ($(origin OVERRIDE_SECURITY_POLICY), undefined)
  DEFINES += -DOVERRIDE_SECURITY_POLICY
 endif

Makefile

@@ -255,7 +255,7 @@ endif
  -j .rela* -j .dyn -j .reloc -j .eh_frame \
  -j .vendor_cert -j .sbat -j .sbatlevel \
  $(FORMAT) $< $@
- ./post-process-pe -vv $@
+ ./post-process-pe -vv $(POST_PROCESS_PE_FLAGS) $@
 
 ifneq ($(origin ENABLE_SHIM_HASH),undefined)
 %.hash : %.efi

post-process-pe.c

@@ -42,7 +42,7 @@ static int verbosity;
  0; \
  })
 
-static bool set_nx_compat = false;
+static bool set_nx_compat = true;
 
 typedef uint8_t UINT8;
 typedef uint16_t UINT16;