int EncryptionItemCount = 0;

int EncryptionFragmentSize = 0;

PDEVICE_OBJECT VirtualVolumeDeviceObjects[MAX_MOUNTED_VOLUME_DRIVE_NUMBER + 1];

BOOL AlignValue (ULONG ulValue, ULONG ulAlignment, ULONG *pulResult)

WHIRLPOOL_add ((unsigned char *) &(iSeed2.QuadPart), sizeof(iSeed2.QuadPart), &tctx);

if (KeQueryInterruptTimePrecisePtr)

{

WHIRLPOOL_add ((unsigned char *) &(iSeed.QuadPart), sizeof(iSeed.QuadPart), &tctx);

WHIRLPOOL_add ((unsigned char *) &(iSeed2.QuadPart), sizeof(iSeed2.QuadPart), &tctx);

}

}

{

PKEY_VALUE_PARTIAL_INFORMATION startKeyValue;

LONG version;

int i;

// KeAreAllApcsDisabled is available starting from Windows Server 2003

if ((OsMajorVersion > 5) || (OsMajorVersion == 5 && OsMinorVersion >= 2))

UNICODE_STRING KeAreAllApcsDisabledFuncName;

RtlInitUnicodeString(&KeAreAllApcsDisabledFuncName, L"KeAreAllApcsDisabled");

}

// KeSaveExtendedProcessorState/KeRestoreExtendedProcessorState are available starting from Windows 7

RtlInitUnicodeString(&groupCountFuncName, L"KeQueryActiveGroupCount");

RtlInitUnicodeString(&procCountFuncName, L"KeQueryActiveProcessorCountEx");

RtlInitUnicodeString(&setAffinityFuncName, L"KeSetSystemGroupAffinityThread");

}

// ExGetFirmwareEnvironmentVariable is available starting from Windows 8

if ((OsMajorVersion > 6) || (OsMajorVersion == 6 && OsMinorVersion >= 2))

{

UNICODE_STRING funcName;

RtlInitUnicodeString(&funcName, L"ExGetFirmwareEnvironmentVariable");

}

// KeQueryInterruptTimePrecise is available starting from Windows 8.1

{

UNICODE_STRING funcName;

RtlInitUnicodeString(&funcName, L"KeQueryInterruptTimePrecise");

}

// Load dump filter if the main driver is already loaded

TCDriverObject = DriverObject;

SelfTestsPassed = AutoTestAlgorithms();

// Enable device class filters and load boot arguments if the driver is set to start at system boot

{

{

if (!SelfTestsPassed)

{

// in case of system encryption, if self-tests fail, disable all extended CPU

// features and try again in order to workaround faulty configurations

SelfTestsPassed = AutoTestAlgorithms();

// BUG CHECK if the self-tests still fail

if (!SelfTestsPassed)

}

VolumeClassFilterRegistered = IsVolumeClassFilterRegistered();

DriverObject->DriverExtension->AddDevice = DriverAddDevice;

}

}

{

}

for (i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; ++i)

{

}

DriverObject->DriverUnload = TCUnloadDriver;

}

NTSTATUS ProcessVolumeDeviceControlIrp (PDEVICE_OBJECT DeviceObject, PEXTENSION Extension, PIRP Irp)

{

PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (Irp);

switch (irpSp->Parameters.DeviceIoControl.IoControlCode)

{

else

{

ULONG outLength;

PMOUNTDEV_UNIQUE_ID outputBuffer = (PMOUNTDEV_UNIQUE_ID) Irp->AssociatedIrp.SystemBuffer;

RtlStringCbCopyA (volId, sizeof(volId),TC_UNIQUE_ID_PREFIX);

if (ValidateIOBufferSize (Irp, minOutputSize, ValidateOutput))

{

BOOL bFullBuffer = (irpSp->Parameters.DeviceIoControl.OutputBufferLength >= fullOutputSize)? TRUE : FALSE;

PDISK_GEOMETRY_EX outputBuffer = (PDISK_GEOMETRY_EX) Irp->AssociatedIrp.SystemBuffer;

Dump ("ProcessVolumeDeviceControlIrp (IOCTL_DISK_GET_DRIVE_LAYOUT)\n");

if (ValidateIOBufferSize (Irp, sizeof (DRIVE_LAYOUT_INFORMATION), ValidateOutput))

{

BOOL bFullBuffer = (irpSp->Parameters.DeviceIoControl.OutputBufferLength >= (sizeof (DRIVE_LAYOUT_INFORMATION) + 3*sizeof(PARTITION_INFORMATION)))? TRUE : FALSE;

PDRIVE_LAYOUT_INFORMATION outputBuffer = (PDRIVE_LAYOUT_INFORMATION)

Irp->AssociatedIrp.SystemBuffer;

{

if (ValidateIOBufferSize (Irp, sizeof (DRIVE_LAYOUT_INFORMATION_EX), ValidateOutput))

{

BOOL bFullBuffer = (irpSp->Parameters.DeviceIoControl.OutputBufferLength >= (sizeof (DRIVE_LAYOUT_INFORMATION_EX) + 3*sizeof(PARTITION_INFORMATION_EX)))? TRUE : FALSE;

PDRIVE_LAYOUT_INFORMATION_EX outputBuffer = (PDRIVE_LAYOUT_INFORMATION_EX)

Irp->AssociatedIrp.SystemBuffer;

case IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS:

Dump ("ProcessVolumeDeviceControlIrp (IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS)\n");

// Vista's, Windows 8.1 and later filesystem defragmenter fails if IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS does not succeed.

{

Irp->IoStatus.Status = STATUS_SUCCESS;

}

break;

{

if (ValidateIOBufferSize (Irp, sizeof (DEVICE_MANAGE_DATA_SET_ATTRIBUTES), ValidateInput))

{

DWORD inputLength = irpSp->Parameters.DeviceIoControl.InputBufferLength;

PDEVICE_MANAGE_DATA_SET_ATTRIBUTES pInputAttrs = (PDEVICE_MANAGE_DATA_SET_ATTRIBUTES) Irp->AssociatedIrp.SystemBuffer;

DEVICE_DATA_MANAGEMENT_SET_ACTION action = pInputAttrs->Action;

{

PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (Irp);

NTSTATUS ntStatus;

switch (irpSp->Parameters.DeviceIoControl.IoControlCode)

{

case TC_IOCTL_IS_DRIVER_UNLOAD_DISABLED:

if (ValidateIOBufferSize (Irp, sizeof (int), ValidateOutput))

{

*(int *) Irp->AssociatedIrp.SystemBuffer = DriverUnloadDisabled;

IO_STATUS_BLOCK IoStatus;

LARGE_INTEGER offset;

ACCESS_MASK access = FILE_READ_ATTRIBUTES;

if (!ValidateIOBufferSize (Irp, sizeof (OPEN_TEST_STRUCT), ValidateInputOutput))

break;

if (readBuffer[510] == 0x55 && readBuffer[511] == 0xaa)

{

for (i = 0; i < 4; ++i)

{

if (readBuffer[446 + i * 16 + 4] == PARTITION_LDM)

{

RESOLVE_SYMLINK_STRUCT *resolve = (RESOLVE_SYMLINK_STRUCT *) Irp->AssociatedIrp.SystemBuffer;

{

EnsureNullTerminatedString (resolve->symLinkName, sizeof (resolve->symLinkName));

resolve->targetName,

sizeof (resolve->targetName));

Irp->IoStatus.Information = sizeof (RESOLVE_SYMLINK_STRUCT);

}

}

break;

DISK_PARTITION_INFO_STRUCT *info = (DISK_PARTITION_INFO_STRUCT *) Irp->AssociatedIrp.SystemBuffer;

{

PARTITION_INFORMATION_EX pi;

EnsureNullTerminatedString (info->deviceName, sizeof (info->deviceName));

{

memset (&info->partInfo, 0, sizeof (info->partInfo));

else

{

// Windows 2000 does not support IOCTL_DISK_GET_PARTITION_INFO_EX

info->IsGPT = FALSE;

}

{

GET_LENGTH_INFORMATION lengthInfo;

{

memset (&info->partInfo, 0, sizeof (info->partInfo));

info->partInfo.PartitionLength = lengthInfo.Length;

info->IsDynamic = FALSE;

{

# define IOCTL_VOLUME_IS_DYNAMIC CTL_CODE(IOCTL_VOLUME_BASE, 18, METHOD_BUFFERED, FILE_ANY_ACCESS)

if (!NT_SUCCESS (TCDeviceIoControl (info->deviceName, IOCTL_VOLUME_IS_DYNAMIC, NULL, 0, &info->IsDynamic, sizeof (info->IsDynamic))))

}

Irp->IoStatus.Information = sizeof (DISK_PARTITION_INFO_STRUCT);

}

}

break;

{

DISK_GEOMETRY_STRUCT *g = (DISK_GEOMETRY_STRUCT *) Irp->AssociatedIrp.SystemBuffer;

{

EnsureNullTerminatedString (g->deviceName, sizeof (g->deviceName));

Dump ("Calling IOCTL_DISK_GET_DRIVE_GEOMETRY on %ls\n", g->deviceName);

IOCTL_DISK_GET_DRIVE_GEOMETRY,

NULL, 0, &g->diskGeometry, sizeof (g->diskGeometry));

Irp->IoStatus.Information = sizeof (DISK_GEOMETRY_STRUCT);

}

}

break;

{

DISK_GEOMETRY_EX_STRUCT *g = (DISK_GEOMETRY_EX_STRUCT *) Irp->AssociatedIrp.SystemBuffer;

{

PVOID buffer = TCalloc (256); // enough for DISK_GEOMETRY_EX and padded data

if (buffer)

{

EnsureNullTerminatedString (g->deviceName, sizeof (g->deviceName));

Dump ("Calling IOCTL_DISK_GET_DRIVE_GEOMETRY_EX on %ls\n", g->deviceName);

IOCTL_DISK_GET_DRIVE_GEOMETRY_EX,

NULL, 0, buffer, 256);

{

PDISK_GEOMETRY_EX pGeo = (PDISK_GEOMETRY_EX) buffer;

memcpy (&g->diskGeometry, &pGeo->Geometry, sizeof (DISK_GEOMETRY));

{

DISK_GEOMETRY dg = {0};

Dump ("Failed. Calling IOCTL_DISK_GET_DRIVE_GEOMETRY on %ls\n", g->deviceName);

IOCTL_DISK_GET_DRIVE_GEOMETRY,

NULL, 0, &dg, sizeof (dg));

{

g->DiskSize.QuadPart = dg.Cylinders.QuadPart * dg.SectorsPerTrack * dg.TracksPerCylinder * dg.BytesPerSector;

{

}

}

}

TCfree (buffer);

Irp->IoStatus.Information = sizeof (DISK_GEOMETRY_EX_STRUCT);

}

else

{

if (ValidateIOBufferSize (Irp, sizeof (MOUNT_STRUCT), ValidateInputOutput))

{

MOUNT_STRUCT *mount = (MOUNT_STRUCT *) Irp->AssociatedIrp.SystemBuffer;

if ((irpSp->Parameters.DeviceIoControl.InputBufferLength != sizeof (MOUNT_STRUCT))

|| mount->VolumePassword.Length > MAX_PASSWORD || mount->ProtectedHidVolPassword.Length > MAX_PASSWORD

{

UNMOUNT_STRUCT *unmount = (UNMOUNT_STRUCT *) Irp->AssociatedIrp.SystemBuffer;

PDEVICE_OBJECT ListDevice = GetVirtualVolumeDeviceObject (unmount->nDosDriveNo);

if (irpSp->Parameters.DeviceIoControl.InputBufferLength != sizeof (UNMOUNT_STRUCT))

{

if (ValidateIOBufferSize (Irp, sizeof (UNMOUNT_STRUCT), ValidateInputOutput))

{

UNMOUNT_STRUCT *unmount = (UNMOUNT_STRUCT *) Irp->AssociatedIrp.SystemBuffer;

if (irpSp->Parameters.DeviceIoControl.InputBufferLength != sizeof (UNMOUNT_STRUCT))

{

break;

case VC_IOCTL_EMERGENCY_CLEAR_ALL_KEYS:

WipeCache();

break;

break;

case TC_IOCTL_GET_BOOT_ENCRYPTION_STATUS:

break;

case TC_IOCTL_GET_BOOT_ENCRYPTION_SETUP_RESULT:

break;

case TC_IOCTL_GET_BOOT_DRIVE_VOLUME_PROPERTIES:

break;

case TC_IOCTL_GET_BOOT_LOADER_VERSION:

break;

case TC_IOCTL_REOPEN_BOOT_VOLUME_HEADER:

break;

case VC_IOCTL_GET_BOOT_LOADER_FINGERPRINT:

break;

case TC_IOCTL_GET_BOOT_ENCRYPTION_ALGORITHM_NAME:

break;

case TC_IOCTL_IS_HIDDEN_SYSTEM_RUNNING:

break;

case TC_IOCTL_GET_DECOY_SYSTEM_WIPE_STATUS:

break;

case TC_IOCTL_WRITE_BOOT_DRIVE_SECTOR:

if (Extension->SecurityClientContextValid)

{

UNICODE_STRING name;

RtlInitUnicodeString (&name, L"PsDereferenceImpersonationToken");

if (!PsDereferenceImpersonationTokenD)

TC_BUG_CHECK (STATUS_NOT_IMPLEMENTED);

VOID TCUnloadDriver (PDRIVER_OBJECT DriverObject)

{

Dump ("TCUnloadDriver BEGIN\n");

OnShutdownPending();

if (IsBootDriveMounted())

static VOID TCDeviceIoControlWorkItemRoutine (PDEVICE_OBJECT rootDeviceObject, TCDeviceIoControlWorkItemArgs *arg)

{

arg->Status = TCDeviceIoControl (arg->deviceName, arg->IoControlCode, arg->InputBuffer, arg->InputBufferSize, arg->OutputBuffer, arg->OutputBufferSize);

KeSetEvent (&arg->WorkItemCompletedEvent, IO_NO_INCREMENT, FALSE);

}

static VOID SendDeviceIoControlRequestWorkItemRoutine (PDEVICE_OBJECT rootDeviceObject, SendDeviceIoControlRequestWorkItemArgs *arg)

{

arg->Status = SendDeviceIoControlRequest (arg->deviceObject, arg->ioControlCode, arg->inputBuffer, arg->inputBufferSize, arg->outputBuffer, arg->outputBufferSize);

KeSetEvent (&arg->WorkItemCompletedEvent, IO_NO_INCREMENT, FALSE);

}

static VOID UpdateFsVolumeInformationWorkItemRoutine (PDEVICE_OBJECT rootDeviceObject, UpdateFsVolumeInformationWorkItemArgs *arg)

{

arg->Status = UpdateFsVolumeInformation (arg->mount, arg->NewExtension);

KeSetEvent (&arg->WorkItemCompletedEvent, IO_NO_INCREMENT, FALSE);

}

static VOID UnmountDeviceWorkItemRoutine (PDEVICE_OBJECT rootDeviceObject, UnmountDeviceWorkItemArgs *arg)

{

arg->Status = UnmountDevice (arg->unmountRequest, arg->deviceObject, arg->ignoreOpenFiles);

KeSetEvent (&arg->WorkItemCompletedEvent, IO_NO_INCREMENT, FALSE);

}