Index: /trunk/include/VBox/sup.h
===================================================================
--- /trunk/include/VBox/sup.h	(revision 51977)
+++ /trunk/include/VBox/sup.h	(revision 51978)
@@ -1134,4 +1134,26 @@
 
 /**
+ * Initializes only the bits relevant for the SUPR3HardenedVerify* APIs.
+ *
+ * This is for users that don't necessarily need to initialize the whole of
+ * SUPLib.  There is no harm in calling this one more time.
+ *
+ * @returns VBox status code.
+ * @remarks Currently not counted, so only call once.
+ */
+SUPR3DECL(int) SUPR3HardenedVerifyInit(void);
+
+/**
+ * Reverses the effect of SUPR3HardenedVerifyInit if SUPR3InitEx hasn't been
+ * called.
+ *
+ * Ignored if the support library was initialized using SUPR3Init or
+ * SUPR3InitEx.
+ *
+ * @returns VBox status code.
+ */
+SUPR3DECL(int) SUPR3HardenedVerifyTerm(void);
+
+/**
  * Verifies the integrity of a file, and optionally opens it.
  *
Index: /trunk/src/VBox/HostDrivers/Support/SUPLib.cpp
===================================================================
--- /trunk/src/VBox/HostDrivers/Support/SUPLib.cpp	(revision 51977)
+++ /trunk/src/VBox/HostDrivers/Support/SUPLib.cpp	(revision 51978)
@@ -1467,4 +1467,24 @@
 
 
+SUPR3DECL(int) SUPR3HardenedVerifyInit(void)
+{
+#ifdef RT_OS_WINDOWS
+    if (g_cInits == 0)
+        return suplibOsHardenedVerifyInit();
+#endif
+    return VINF_SUCCESS;
+}
+
+
+SUPR3DECL(int) SUPR3HardenedVerifyTerm(void)
+{
+#ifdef RT_OS_WINDOWS
+    if (g_cInits == 0)
+        return suplibOsHardenedVerifyTerm();
+#endif
+    return VINF_SUCCESS;
+}
+
+
 SUPR3DECL(int) SUPR3HardenedVerifyFile(const char *pszFilename, const char *pszMsg, PRTFILE phFile)
 {
Index: /trunk/src/VBox/HostDrivers/Support/SUPLibInternal.h
===================================================================
--- /trunk/src/VBox/HostDrivers/Support/SUPLibInternal.h	(revision 51977)
+++ /trunk/src/VBox/HostDrivers/Support/SUPLibInternal.h	(revision 51978)
@@ -334,4 +334,6 @@
 int     suplibOsInit(PSUPLIBDATA pThis, bool fPreInited, bool fUnrestricted);
 int     suplibOsTerm(PSUPLIBDATA pThis);
+int     suplibOsHardenedVerifyInit(void);
+int     suplibOsHardenedVerifyTerm(void);
 int     suplibOsIOCtl(PSUPLIBDATA pThis, uintptr_t uFunction, void *pvReq, size_t cbReq);
 int     suplibOsIOCtlFast(PSUPLIBDATA pThis, uintptr_t uFunction, uintptr_t idCpu);
Index: /trunk/src/VBox/HostDrivers/Support/win/SUPLib-win.cpp
===================================================================
--- /trunk/src/VBox/HostDrivers/Support/win/SUPLib-win.cpp	(revision 51977)
+++ /trunk/src/VBox/HostDrivers/Support/win/SUPLib-win.cpp	(revision 51978)
@@ -80,4 +80,33 @@
 #endif
 
+/*******************************************************************************
+*   Global Variables                                                           *
+*******************************************************************************/
+static bool g_fHardenedVerifyInited = false;
+
+
+int suplibOsHardenedVerifyInit(void)
+{
+    if (!g_fHardenedVerifyInited)
+    {
+#if defined(VBOX_WITH_HARDENING) && !defined(IN_SUP_HARDENED_R3) && !defined(IN_SUP_R3_STATIC)
+        supR3HardenedWinInitVersion();
+        int rc = supHardenedWinInitImageVerifier(NULL);
+        if (RT_FAILURE(rc))
+            return rc;
+        supR3HardenedWinResolveVerifyTrustApiAndHookThreadCreation();
+#endif
+        g_fHardenedVerifyInited = true;
+    }
+    return VINF_SUCCESS;
+}
+
+
+int suplibOsHardenedVerifyTerm(void)
+{
+    /** @todo free resources...  */
+    return VINF_SUCCESS;
+}
+
 
 int suplibOsInit(PSUPLIBDATA pThis, bool fPreInited, bool fUnrestricted)
@@ -86,11 +115,7 @@
      * Make sure the image verifier is fully initialized.
      */
-#if defined(VBOX_WITH_HARDENING) && !defined(IN_SUP_HARDENED_R3) && !defined(IN_SUP_R3_STATIC)
-    supR3HardenedWinInitVersion();
-    int rc = supHardenedWinInitImageVerifier(NULL);
+    int rc = suplibOsHardenedVerifyInit();
     if (RT_FAILURE(rc))
         return rc;
-    supR3HardenedWinResolveVerifyTrustApiAndHookThreadCreation();
-#endif
 
     /*
@@ -199,4 +224,5 @@
 }
 
+
 #ifndef IN_SUP_HARDENED_R3
 
Index: /trunk/src/VBox/Main/src-all/ExtPackManagerImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-all/ExtPackManagerImpl.cpp	(revision 51977)
+++ /trunk/src/VBox/Main/src-all/ExtPackManagerImpl.cpp	(revision 51978)
@@ -716,4 +716,11 @@
     m->enmContext                   = a_enmContext;
     m->fMadeReadyCall               = false;
+
+    /*
+     * Make sure the SUPR3Hardened API works (ignoring errors for now).
+     */
+    int rc = SUPR3HardenedVerifyInit();
+    if (RT_FAILURE(rc))
+        LogRel(("SUPR3HardenedVerifyInit failed: %Rrc\n", rc));
 
     /*
Index: /trunk/src/VBox/Main/src-helper-apps/VBoxExtPackHelperApp.cpp
===================================================================
--- /trunk/src/VBox/Main/src-helper-apps/VBoxExtPackHelperApp.cpp	(revision 51977)
+++ /trunk/src/VBox/Main/src-helper-apps/VBoxExtPackHelperApp.cpp	(revision 51978)
@@ -1787,7 +1787,5 @@
         return RTMsgInitFailure(rc);
 
-#ifdef RT_OS_WINDOWS
-    SUPR3InitEx(false /*fUnrestricted*/, NULL); /* Ignore return code, we only need the image verifier bits to work. */
-#endif
+    SUPR3HardenedVerifyInit();
     RTERRINFOSTATIC ErrInfo;
     RTErrInfoInitStatic(&ErrInfo);