#include "Language.h"

#include "Keyfiles.h"

#include "Pkcs5.h"

#include "Random.h"

#include "Registry.h"

#include "SecurityToken.h"

#include "Tests.h"

#include "Volumes.h"

#include "Wipe.h"

#include "Xml.h"

#include "Xts.h"

#include "Boot/Windows/BootCommon.h"

#include "Progress.h"

#include "zip.h"

#include "rdrand.h"

#include "jitterentropy.h"

#ifdef TCMOUNT

#include "Mount/Mount.h"

#include "Mount/resource.h"

#endif

#ifdef VOLFORMAT

#include "Format/Tcformat.h"

#endif

#ifdef SETUP

#include "Setup/Setup.h"

#endif

#include <Setupapi.h>

#include <Softpub.h>

#include <WinTrust.h>

#include <strsafe.h>

#pragma comment( lib, "setupapi.lib" )

#ifndef TTI_INFO_LARGE

#define TTI_INFO_LARGE 4

#endif

#ifndef TTI_WARNING_LARGE

#define TTI_WARNING_LARGE 5

#endif

#ifndef TTI_ERROR_LARGE

#define TTI_ERROR_LARGE 6

#endif

/* GPT Partition Type GUIDs */

#define LOCAL_DEFINE_GUID(name, l, w1, w2, b1, b2, b3, b4, b5, b6, b7, b8) const GUID name = {l, w1, w2, b1, b2, b3, b4, b5, b6, b7, b8}

LOCAL_DEFINE_GUID(PARTITION_ENTRY_UNUSED_GUID, 0x00000000L, 0x0000, 0x0000, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00); // Entry unused

LOCAL_DEFINE_GUID(PARTITION_SYSTEM_GUID, 0xC12A7328L, 0xF81F, 0x11D2, 0xBA, 0x4B, 0x00, 0xA0, 0xC9, 0x3E, 0xC9, 0x3B); // EFI system partition

LOCAL_DEFINE_GUID(PARTITION_MSFT_RESERVED_GUID, 0xE3C9E316L, 0x0B5C, 0x4DB8, 0x81, 0x7D, 0xF9, 0x2D, 0xF0, 0x02, 0x15, 0xAE); // Microsoft reserved space

LOCAL_DEFINE_GUID(PARTITION_BASIC_DATA_GUID, 0xEBD0A0A2L, 0xB9E5, 0x4433, 0x87, 0xC0, 0x68, 0xB6, 0xB7, 0x26, 0x99, 0xC7); // Basic data partition

LOCAL_DEFINE_GUID(PARTITION_LDM_METADATA_GUID, 0x5808C8AAL, 0x7E8F, 0x42E0, 0x85, 0xD2, 0xE1, 0xE9, 0x04, 0x34, 0xCF, 0xB3); // Logical Disk Manager metadata partition

LOCAL_DEFINE_GUID(PARTITION_LDM_DATA_GUID, 0xAF9B60A0L, 0x1431, 0x4F62, 0xBC, 0x68, 0x33, 0x11, 0x71, 0x4A, 0x69, 0xAD); // Logical Disk Manager data partition

LOCAL_DEFINE_GUID(PARTITION_MSFT_RECOVERY_GUID, 0xDE94BBA4L, 0x06D1, 0x4D40, 0xA1, 0x6A, 0xBF, 0xD5, 0x01, 0x79, 0xD6, 0xAC); // Microsoft recovery partition

LOCAL_DEFINE_GUID(PARTITION_CLUSTER_GUID, 0xdb97dba9L, 0x0840, 0x4bae, 0x97, 0xf0, 0xff, 0xb9, 0xa3, 0x27, 0xc7, 0xe1); // Cluster metadata partition

#ifndef PROCESSOR_ARCHITECTURE_ARM64

#define PROCESSOR_ARCHITECTURE_ARM64 12

#endif

#ifndef IMAGE_FILE_MACHINE_ARM64

#define IMAGE_FILE_MACHINE_ARM64 0xAA64

#endif

using namespace VeraCrypt;

else

{

// when installed, force using English as default language

SetPreferredLangId ("en");

}

}

LoadLanguageFile ();

#ifndef SETUP

// UAC elevation moniker cannot be used in portable mode.

// A new instance of the application must be created with elevated privileges.

if (IsNonInstallMode () && !IsAdmin () && IsUacSupported ())

{

if (wcsstr (lpszCommandLine, L"/q UAC ") == lpszCommandLine)

{

Error ("UAC_INIT_ERROR", NULL);

exit (1);

}

if (LaunchElevatedProcess (NULL, modPath, lpszCommandLine))

exit (0);

else

exit (1);

}

#endif

SetUnhandledExceptionFilter (ExceptionHandler);

_set_invalid_parameter_handler (InvalidParameterHandler);

RemoteSession = GetSystemMetrics (SM_REMOTESESSION) != 0;

#ifndef VC_SKIP_OS_DRIVER_REQ_CHECK

{

MessageBoxW (NULL, GetString ("UNSUPPORTED_OS"), lpszTitle, MB_ICONSTOP);

exit (1);

}

#else

// in TESTSIGNING mode, we support only Windows Vista, Windows 7, Windows 8/8.1

if ( !IsOSVersionAtLeast(WIN_VISTA, 0)

#ifndef SETUP

|| IsOSVersionAtLeast(WIN_10, 0)

#else

|| (IsOSVersionAtLeast(WIN_10, 0) && !bMakePackage)

#endif

)

{

MessageBoxW (NULL, L"TESTSIGNING version of VeraCrypt targets only Windows Vista, Windows 7 and Windows 8/8.1.\n\nPlease use the standard version of VeraCrypt instead.", lpszTitle, MB_ICONSTOP);

exit (1);

}

else if ( !IsTestSigningModeEnabled()

#ifdef SETUP

&& !bMakePackage

#endif

)

{

MessageBoxW (NULL, L"Test-Signing Mode, which is required to run VeraCrypt TESTSIGNING binaries, is not enabled in Windows.\n\nExecution aborted!", lpszTitle, MB_ICONSTOP);

exit (1);

}

#endif

else

{

// Service pack check & warnings about critical MS issues

switch (nCurrentOS)

{

case WIN_XP:

if (CurrentOSServicePack < 1)

{

// Returns TRUE if the operating system is at least reqMinOS and service pack at least reqMinServicePack.

// Example 1: IsOSVersionAtLeast (WIN_VISTA, 1) called under Windows 2008, returns TRUE.

// Example 2: IsOSVersionAtLeast (WIN_XP, 3) called under Windows XP SP1, returns FALSE.

// Example 3: IsOSVersionAtLeast (WIN_XP, 3) called under Windows Vista SP1, returns TRUE.

BOOL IsOSVersionAtLeast (OSVersionEnum reqMinOS, int reqMinServicePack)

{

/* When updating this function, update IsOSAtLeast() in Ntdriver.c too. */

if (CurrentOSMajor <= 0)

TC_THROW_FATAL_EXCEPTION;

int major = 0, minor = 0;

switch (reqMinOS)

{

case WIN_2000: major = 5; minor = 0; break;

case WIN_XP: major = 5; minor = 1; break;

case WIN_SERVER_2003: major = 5; minor = 2; break;

case WIN_VISTA: major = 6; minor = 0; break;

case WIN_7: major = 6; minor = 1; break;

case WIN_8: major = 6; minor = 2; break;

case WIN_8_1: major = 6; minor = 3; break;

case WIN_10: major = 10; minor = 0; break;

default:

TC_THROW_FATAL_EXCEPTION;

break;

}

return ((CurrentOSMajor << 16 | CurrentOSMinor << 8 | CurrentOSServicePack)

>= (major << 16 | minor << 8 | reqMinServicePack));

}

BOOL Is64BitOs()

{

#ifdef _WIN64

return TRUE;

#else

static BOOL isWow64 = FALSE;

static BOOL valid = FALSE;

typedef BOOL(__stdcall* LPFN_ISWOW64PROCESS) (HANDLE hProcess, PBOOL Wow64Process);

typedef BOOL(__stdcall* LPFN_ISWOW64PROCESS2)(

HANDLE hProcess,

USHORT* pProcessMachine,

USHORT* pNativeMachine

);

LPFN_ISWOW64PROCESS fnIsWow64Process;

LPFN_ISWOW64PROCESS2 fnIsWow64Process2;

if (valid)

return isWow64;

fnIsWow64Process = (LPFN_ISWOW64PROCESS)GetProcAddress(GetModuleHandle(L"kernel32"), "IsWow64Process");

fnIsWow64Process2 = (LPFN_ISWOW64PROCESS2)GetProcAddress(GetModuleHandle(L"kernel32"), "IsWow64Process2");

if (fnIsWow64Process2)

{

USHORT processMachine, nativeMachine;

if (!fnIsWow64Process2(GetCurrentProcess(), &processMachine, &nativeMachine))

isWow64 = FALSE;

else

{

if (IMAGE_FILE_MACHINE_ARM64 == nativeMachine || IMAGE_FILE_MACHINE_AMD64 == nativeMachine || IMAGE_FILE_MACHINE_IA64 == nativeMachine || IMAGE_FILE_MACHINE_ALPHA64 == nativeMachine)

isWow64 = TRUE;

}

}

else if (fnIsWow64Process != NULL)

}

CloseDesktop (hSecureDesk);

// get the new list of ctfmon.exe processes in order to find the ID of the

// ctfmon.exe instance that corresponds to the desktop we create so that

// we can kill it, otherwise it would remain running

GetCtfMonProcessIdList (ctfmonAfterList);

for (map<DWORD, BOOL>::iterator It = ctfmonAfterList.begin();

It != ctfmonAfterList.end(); It++)

{

if (ctfmonBeforeList[It->first] != TRUE)

{

// Kill process

KillProcess (It->first);

}

}

}

burn (szDesktopName, sizeof (szDesktopName));

}

}

if (!bSuccess)

{

// fallback to displaying in normal desktop

retValue = DialogBoxParamW (hInstance, lpTemplateName, hWndParent, lpDialogFunc, dwInitParam);

}

return retValue;

}

#endif

static BOOL InitializeWintrust()

{

if (!hWinTrustLib)

{

wchar_t szPath[MAX_PATH] = {0};

if (GetSystemDirectory(szPath, MAX_PATH))

StringCchCatW (szPath, MAX_PATH, L"\\Wintrust.dll");

else

StringCchCopyW (szPath, MAX_PATH, L"C:\\Windows\\System32\\Wintrust.dll");

hWinTrustLib = LoadLibrary (szPath);

if (hWinTrustLib)

{

WinVerifyTrustFn = (WINVERIFYTRUST) GetProcAddress (hWinTrustLib, "WinVerifyTrust");

WTHelperProvDataFromStateDataFn = (WTHELPERPROVDATAFROMSTATEDATA) GetProcAddress (hWinTrustLib, "WTHelperProvDataFromStateData");

WTHelperGetProvSignerFromChainFn = (WTHELPERGETPROVSIGNERFROMCHAIN) GetProcAddress (hWinTrustLib, "WTHelperGetProvSignerFromChain");

WTHelperGetProvCertFromChainFn = (WTHELPERGETPROVCERTFROMCHAIN) GetProcAddress (hWinTrustLib, "WTHelperGetProvCertFromChain");

if ( !WinVerifyTrustFn

|| !WTHelperProvDataFromStateDataFn

|| !WTHelperGetProvSignerFromChainFn

|| !WTHelperGetProvCertFromChainFn)

{

FreeLibrary (hWinTrustLib);

hWinTrustLib = NULL;

}

}

}

if (hWinTrustLib)

return TRUE;

else

return FALSE;

}

static void FinalizeWintrust()

{

if (hWinTrustLib)

{

FreeLibrary (hWinTrustLib);

hWinTrustLib = NULL;

}

}

#endif

BOOL VerifyModuleSignature (const wchar_t* path)

{

BOOL bResult = FALSE;

HRESULT hResult;

GUID gActionID = WINTRUST_ACTION_GENERIC_VERIFY_V2;

WINTRUST_FILE_INFO fileInfo = {0};

WINTRUST_DATA WVTData = {0};

wchar_t filePath [TC_MAX_PATH + 1024];

// we check our own authenticode signature only starting from Windows 10 since this is

// the minimal supported OS apart from XP where we can't verify SHA256 signatures

if (!IsOSAtLeast (WIN_10))

return TRUE;

// Strip quotation marks (if any)

if (path [0] == L'"')

{

StringCbCopyW (filePath, sizeof(filePath), path + 1);

}

else

{

StringCbCopyW (filePath, sizeof(filePath), path);

}

// Strip quotation marks (if any)

if (filePath [wcslen (filePath) - 1] == L'"')

filePath [wcslen (filePath) - 1] = 0;

if (!InitializeWintrust ())

return FALSE;

fileInfo.cbStruct = sizeof(WINTRUST_FILE_INFO);

fileInfo.pcwszFilePath = filePath;

fileInfo.hFile = NULL;

WVTData.cbStruct = sizeof(WINTRUST_DATA);

WVTData.dwUIChoice = WTD_UI_NONE;

bResult = TRUE;

}

}

FreeLibrary (hPowrProf);

}

return bResult;

}

/* return TRUE if Windows is in Test Signing mode */

/* ref: https://social.msdn.microsoft.com/Forums/Windowsapps/en-US/e6c1be93-7003-4594-b8e4-18ab4a75d273/detecting-testsigning-onoff-via-api */

BOOL IsTestSigningModeEnabled ()

{

BOOL bEnabled = FALSE;

NtQuerySystemInformationFn NtQuerySystemInformationPtr = (NtQuerySystemInformationFn) GetProcAddress (GetModuleHandle (L"ntdll.dll"), "NtQuerySystemInformation");

if(NtQuerySystemInformationPtr)

{

SYSTEM_CODEINTEGRITY_INFORMATION info = {0};

ULONG cbReturnedData = 0;

info.Length = sizeof(info);

if ( (NtQuerySystemInformationPtr((SYSTEM_INFORMATION_CLASS) SYSTEMCODEINTEGRITYINFORMATION, &info, sizeof(info), &cbReturnedData) >= 0)

&& (cbReturnedData == sizeof(info))

)

{

if ((info.CodeIntegrityOptions & (CODEINTEGRITY_OPTION_TESTSIGN | CODEINTEGRITY_OPTION_ENABLED)) == (CODEINTEGRITY_OPTION_TESTSIGN | CODEINTEGRITY_OPTION_ENABLED))

{

bEnabled = TRUE;

}

}

}

return bEnabled;

}