diff options
| -rw-r--r-- | src/Common/BootEncryption.cpp | 5 | ||||
| -rw-r--r-- | src/Driver/DriveFilter.c | 37 |
2 files changed, 35 insertions, 7 deletions
diff --git a/src/Common/BootEncryption.cpp b/src/Common/BootEncryption.cpp index d9570062..5da2988e 100644 --- a/src/Common/BootEncryption.cpp +++ b/src/Common/BootEncryption.cpp @@ -1561,14 +1561,19 @@ namespace VeraCrypt // compare values
if (0 == memcmp (fingerprint, expectedFingerprint, sizeof (expectedFingerprint)))
{
bRet = true;
}
}
+ catch (SystemException &e)
+ {
+ if (!bSilent && (GetLastError () != ERROR_INVALID_IMAGE_HASH))
+ e.Show (ParentWindow);
+ }
catch (Exception& e)
{
if (!bSilent)
e.Show (ParentWindow);
}
return bRet;
diff --git a/src/Driver/DriveFilter.c b/src/Driver/DriveFilter.c index 4b9117eb..566aacda 100644 --- a/src/Driver/DriveFilter.c +++ b/src/Driver/DriveFilter.c @@ -1760,25 +1760,48 @@ void GetBootLoaderVersion (PIRP irp, PIO_STACK_LOCATION irpSp) }
}
void GetBootLoaderFingerprint (PIRP irp, PIO_STACK_LOCATION irpSp)
{
if (ValidateIOBufferSize (irp, sizeof (BootLoaderFingerprintRequest), ValidateOutput))
{
- if (BootArgsValid)
+ irp->IoStatus.Information = 0;
+ if (BootArgsValid && BootDriveFound && BootDriveFilterExtension && BootDriveFilterExtension->DriveMounted && BootDriveFilterExtension->HeaderCryptoInfo)
{
- BootLoaderFingerprintRequest *bootLoaderFingerprint = (BootLoaderFingerprintRequest *) irp->AssociatedIrp.SystemBuffer;
- memcpy (bootLoaderFingerprint->Fingerprint, BootLoaderFingerprint, sizeof (BootLoaderFingerprint));
- irp->IoStatus.Information = sizeof (BootLoaderFingerprintRequest);
- irp->IoStatus.Status = STATUS_SUCCESS;
+ BootLoaderFingerprintRequest *bootLoaderFingerprint = (BootLoaderFingerprintRequest *) irp->AssociatedIrp.SystemBuffer;
+
+ /* compute the fingerprint again and check if it is the same as the one retrieved during boot */
+ char *header = TCalloc (TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);
+ if (!header)
+ {
+ irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
+ }
+ else
+ {
+ memcpy (bootLoaderFingerprint->Fingerprint, BootLoaderFingerprint, sizeof (BootLoaderFingerprint));
+ ComputeBootLoaderFingerprint (BootDriveFilterExtension->LowerDeviceObject, header);
+
+ burn (header, TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);
+ TCfree (header);
+
+ if (0 == memcmp (bootLoaderFingerprint->Fingerprint, BootLoaderFingerprint, sizeof (BootLoaderFingerprint)))
+ {
+ irp->IoStatus.Information = sizeof (BootLoaderFingerprintRequest);
+ irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ else
+ {
+ /* fingerprint mismatch.*/
+ irp->IoStatus.Status = STATUS_INVALID_IMAGE_HASH;
+ }
+ }
}
else
{
- irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
- irp->IoStatus.Information = 0;
+ irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
}
}
}
void GetBootEncryptionAlgorithmName (PIRP irp, PIO_STACK_LOCATION irpSp)
{
if (ValidateIOBufferSize (irp, sizeof (GetBootEncryptionAlgorithmNameRequest), ValidateOutput))
|