call %TC_WINDDK_ROOT%\bin\setenv %TC_WINDDK_ROOT% %TC_BUILD_TYPE% %TC_BUILD_ARCH% no_oacr || exit /B %errorlevel%

popd

:: Build

Copyright (c) 2008-2012 TrueCrypt Developers Association and which is governed

by the TrueCrypt License 3.0.

and all other portions of this file are Copyright (c) 2013-2016 IDRIX

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

#include "Wipe.h"

#include "DriveFilter.h"

#include "Boot/Windows/BootCommon.h"

static BOOL DeviceFilterActive = FALSE;

BOOL BootArgsValid = FALSE;

BootArguments BootArgs;

static BOOL BootDriveSignatureValid = FALSE;

static KMUTEX MountMutex;

PKTHREAD DecoySystemWipeThread = NULL;

static NTSTATUS DecoySystemWipeResult;

NTSTATUS LoadBootArguments ()

{

NTSTATUS status = STATUS_UNSUCCESSFUL;

PHYSICAL_ADDRESS bootArgsAddr;

byte *mappedBootArgs;

KeInitializeMutex (&MountMutex, 0);

{

Dump ("Checking BootArguments at 0x%x\n", bootArgsAddr.LowPart);

mappedBootArgs = MmMapIoSpace (bootArgsAddr, sizeof (BootArguments), MmCached);

// Sanity check: for valid boot argument, the password is less than 64 bytes long

if (bootArguments->BootPassword.Length <= MAX_PASSWORD)

{

BootArgs = *bootArguments;

BootArgsValid = TRUE;

Extension = (DriveFilterExtension *) filterDeviceObject->DeviceExtension;

memset (Extension, 0, sizeof (DriveFilterExtension));

if (!NT_SUCCESS (status))

{

goto err;

Extension->IsDriveFilterDevice = Extension->Queue.IsFilterDevice = TRUE;

Extension->DeviceObject = Extension->Queue.DeviceObject = filterDeviceObject;

Extension->Pdo = pdo;

Extension->Queue.LowerDeviceObject = Extension->LowerDeviceObject;

IoInitializeRemoveLock (&Extension->Queue.RemoveLock, 'LRCV', 0, 0);

{

Dump ("Dismounting drive\n");

ASSERT (Extension->DriveMounted);

if (stopIoQueue && EncryptedIoQueueIsRunning (&Extension->Queue))

EncryptedIoQueueStop (&Extension->Queue);

// TC_BOOT_SECTOR_USER_CONFIG_OFFSET = 438

//

// we have: TC_BOOT_SECTOR_USER_MESSAGE_OFFSET = TC_BOOT_SECTOR_OUTER_VOLUME_BAK_HEADER_CRC_OFFSET + TC_BOOT_SECTOR_OUTER_VOLUME_BAK_HEADER_CRC_SIZE

WHIRLPOOL_init (&whirlpool);

sha512_begin (&sha2);

// read the first 512 bytes

status = TCReadDevice (LowerDeviceObject, ioBuffer, offset, TC_SECTOR_SIZE_BIOS);

if (NT_SUCCESS (status))

{

sha512_hash (ioBuffer, TC_BOOT_SECTOR_PIM_VALUE_OFFSET, &sha2);

sha512_hash (ioBuffer + TC_BOOT_SECTOR_USER_MESSAGE_OFFSET + TC_BOOT_SECTOR_USER_MESSAGE_MAX_LENGTH, (TC_BOOT_SECTOR_USER_CONFIG_OFFSET - (TC_BOOT_SECTOR_USER_MESSAGE_OFFSET + TC_BOOT_SECTOR_USER_MESSAGE_MAX_LENGTH)), &sha2);

{

remainingBytes -= bytesToRead;

offset.QuadPart += bytesToRead;

sha512_hash (ioBuffer, bytesToRead, &sha2);

}

else

WHIRLPOOL_finalize (&whirlpool, BootLoaderFingerprint);

sha512_end (&BootLoaderFingerprint [WHIRLPOOL_DIGESTSIZE], &sha2);

}

}

else

{

char *header;

int pkcs5_prf = 0, pim = 0;

byte *mappedCryptoInfo = NULL;

Dump ("MountDrive pdo=%p\n", Extension->Pdo);

ASSERT (KeGetCurrentIrql() == PASSIVE_LEVEL);

goto ret;

}

{

#ifdef DEBUG

Dump ("Wiping memory %x %d\n", cryptoInfoAddress.LowPart, BootArgs.CryptoInfoLength);

#endif

/* Get the parameters used for booting to speed up driver startup and avoid testing irrelevant PRFs */

BOOT_CRYPTO_HEADER* pBootCryptoInfo = (BOOT_CRYPTO_HEADER*) mappedCryptoInfo;

Hash* pHash = HashGet(pBootCryptoInfo->pkcs5);

pkcs5_prf = pBootCryptoInfo->pkcs5;

}

}

// calculate Fingerprint

ComputeBootLoaderFingerprint (Extension->LowerDeviceObject, header);

if (Extension->Queue.CryptoInfo->hiddenVolume)

{

int64 hiddenPartitionOffset = BootArgs.HiddenSystemPartitionStart;

Dump ("Hidden volume start offset = %I64d\n", Extension->Queue.CryptoInfo->EncryptedAreaStart.Value + hiddenPartitionOffset);

Extension->HiddenSystem = TRUE;

Extension->Queue.RemapEncryptedArea = TRUE;

Extension->Queue.RemappedAreaOffset = hiddenPartitionOffset + Extension->Queue.CryptoInfo->EncryptedAreaStart.Value - BootArgs.DecoySystemPartitionStart;

Extension->Queue.RemappedAreaDataUnitOffset = Extension->Queue.CryptoInfo->EncryptedAreaStart.Value / ENCRYPTION_DATA_UNIT_SIZE - BootArgs.DecoySystemPartitionStart / ENCRYPTION_DATA_UNIT_SIZE;

Extension->Queue.CryptoInfo->EncryptedAreaStart.Value = BootArgs.DecoySystemPartitionStart;

if (Extension->Queue.CryptoInfo->VolumeSize.Value > hiddenPartitionOffset - BootArgs.DecoySystemPartitionStart)

TC_THROW_FATAL_EXCEPTION;

}

status = SendDeviceIoControlRequest (Extension->LowerDeviceObject, IOCTL_DISK_GET_LENGTH_INFO, NULL, 0, &BootDriveLength, sizeof (BootDriveLength));

if (!NT_SUCCESS (status))

{

Dump ("Failed to get drive length - error %x\n", status);

}

else

Extension->Queue.MaxReadAheadOffset = BootDriveLength;

status = EncryptedIoQueueStart (&Extension->Queue);

if (!NT_SUCCESS (status))

TC_BUG_CHECK (status);

Dump ("Saving: ConfiguredEncryptedAreaStart=%I64d (%I64d) ConfiguredEncryptedAreaEnd=%I64d (%I64d)\n", Extension->ConfiguredEncryptedAreaStart / 1024 / 1024, Extension->ConfiguredEncryptedAreaStart, Extension->ConfiguredEncryptedAreaEnd / 1024 / 1024, Extension->ConfiguredEncryptedAreaEnd);

Dump ("Saving: EncryptedAreaStart=%I64d (%I64d) EncryptedAreaEnd=%I64d (%I64d)\n", Extension->Queue.EncryptedAreaStart / 1024 / 1024, Extension->Queue.EncryptedAreaStart, Extension->Queue.EncryptedAreaEnd / 1024 / 1024, Extension->Queue.EncryptedAreaEnd);

if (Extension->Queue.EncryptedAreaStart == -1 || Extension->Queue.EncryptedAreaEnd == -1

|| Extension->Queue.EncryptedAreaEnd <= Extension->Queue.EncryptedAreaStart)

{

}

KeInitializeEvent (&Extension->MountWorkItemCompletedEvent, SynchronizationEvent, FALSE);

KeWaitForSingleObject (&Extension->MountWorkItemCompletedEvent, Executive, KernelMode, FALSE, NULL);

IoFreeWorkItem (workItem);

if (Extension->BootDrive)

{

status = EncryptedIoQueueAddIrp (&Extension->Queue, Irp);

if (status != STATUS_PENDING)

TCCompleteDiskIrp (Irp, status, 0);

{

Dump ("Header reopened\n");

ComputeBootLoaderFingerprint (BootDriveFilterExtension->LowerDeviceObject, header);

BootDriveFilterExtension->Queue.CryptoInfo->header_creation_time = BootDriveFilterExtension->HeaderCryptoInfo->header_creation_time;

BootDriveFilterExtension->Queue.CryptoInfo->pkcs5 = BootDriveFilterExtension->HeaderCryptoInfo->pkcs5;

BootDriveFilterExtension->Queue.CryptoInfo->noIterations = BootDriveFilterExtension->HeaderCryptoInfo->noIterations;

if (writeB)

return (*OriginalHiberDriverWriteFunctionsB[filterNumber]) (writeOffset, encryptedDataMdl);

return (*OriginalHiberDriverWriteFunctionsA[filterNumber]) (arg0WriteA, writeOffset, encryptedDataMdl, arg3WriteA);

}

byte *wipeBuffer = NULL;

byte wipeRandChars[TC_WIPE_RAND_CHAR_COUNT];

byte wipeRandCharsUpdate[TC_WIPE_RAND_CHAR_COUNT];

KIRQL irql;

NTSTATUS status;

// wipeRandCharsUpdate instead of relying on uninitialized stack memory

LARGE_INTEGER iSeed;

KeQuerySystemTime( &iSeed );

burn (digest, SHA512_DIGESTSIZE);

burn (&tctx, sizeof (tctx));

}

burn (&iSeed, sizeof(iSeed));

SetupResult = STATUS_UNSUCCESSFUL;

}

EncryptedIoQueueResumeFromHold (&Extension->Queue);

Dump ("EncryptedAreaStart=%I64d\n", Extension->Queue.EncryptedAreaStart);

Dump ("EncryptedAreaEnd=%I64d\n", Extension->Queue.EncryptedAreaEnd);

Dump ("ConfiguredEncryptedAreaStart=%I64d\n", Extension->ConfiguredEncryptedAreaStart);

}

EncryptDataUnits (wipeBuffer, &dataUnit, setupBlockSize / ENCRYPTION_DATA_UNIT_SIZE, Extension->Queue.CryptoInfo);

}

status = TCWriteDevice (BootDriveFilterExtension->LowerDeviceObject, wipeBuffer, offset, setupBlockSize);

}

}

}

}

else

SetupInProgress = TRUE;

status = TCStartThread (SetupThreadProc, DeviceObject, &EncryptionSetupThread);

if (!NT_SUCCESS (status))

SetupInProgress = FALSE;

bootEncStatus->HiddenSysLeakProtectionCount = HiddenSysLeakProtectionCount;

bootEncStatus->HiddenSystem = Extension->HiddenSystem;

if (Extension->HiddenSystem)

bootEncStatus->HiddenSystemPartitionStart = BootArgs.HiddenSystemPartitionStart;

}

irp->IoStatus.Information = 0;

if (BootArgsValid && BootDriveFound && BootDriveFilterExtension && BootDriveFilterExtension->DriveMounted && BootDriveFilterExtension->HeaderCryptoInfo)

{

/* compute the fingerprint again and check if it is the same as the one retrieved during boot */

char *header = TCalloc (TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);

}

else

{

}

}

}

DecoySystemWipeResult = STATUS_INSUFFICIENT_RESOURCES;

goto ret;

}

wipeRandBuffer = TCalloc (TC_ENCRYPTION_SETUP_IO_BLOCK_SIZE);

if (!wipeRandBuffer)

{

}

memcpy (wipeCryptoInfo->k2, WipeDecoyRequest.WipeKey + EAGetKeySize (ea), EAGetKeySize (ea));

if (!EAInitMode (wipeCryptoInfo))

{

DecoySystemWipeResult = STATUS_INVALID_PARAMETER;

burn (WipeDecoyRequest.WipeKey, sizeof (WipeDecoyRequest.WipeKey));

offset.QuadPart = Extension->ConfiguredEncryptedAreaStart;

Dump ("Wiping decoy system: start offset = %I64d\n", offset.QuadPart);

while (!DecoySystemWipeThreadAbortRequested)

DecoySystemWipeInProgress = TRUE;

status = TCStartThread (DecoySystemWipeThreadProc, DeviceObject, &DecoySystemWipeThread);

if (!NT_SUCCESS (status))

DecoySystemWipeInProgress = FALSE;

}

else

wipeStatus->WipedAreaEnd = DecoySystemWipedAreaEnd;

irp->IoStatus.Information = sizeof (DecoySystemWipeStatus);

irp->IoStatus.Status = STATUS_SUCCESS;

}

// Check dump volume is located within the scope of system encryption

status = SendDeviceIoControlRequest (filterExtension->DeviceObject, IOCTL_DISK_GET_PARTITION_INFO, NULL, 0, &partitionInfo, sizeof (partitionInfo));

if (!NT_SUCCESS (status))

DumpPartitionOffset = partitionInfo.StartingOffset;

PsGetVersion (&OsMajorVersion, &OsMinorVersion, NULL, NULL);

// Load dump filter if the main driver is already loaded

if (NT_SUCCESS (TCDeviceIoControl (NT_ROOT_PREFIX, TC_IOCTL_GET_DRIVER_VERSION, NULL, 0, &version, sizeof (version))))

return DumpFilterEntry ((PFILTER_EXTENSION) DriverObject, (PFILTER_INITIALIZATION_DATA) RegistryPath);

NTSTATUS DriverAddDevice (PDRIVER_OBJECT driverObject, PDEVICE_OBJECT pdo)

{

char nameInfoBuffer[128];

POBJECT_NAME_INFORMATION nameInfo = (POBJECT_NAME_INFORMATION) nameInfoBuffer;

ULONG nameInfoSize;

PEXTENSION Extension;

NTSTATUS ntStatus;

ULONG devChars = 0;

WCHAR dosname[32];

#endif

TCGetNTNameFromNumber (ntname, sizeof(ntname),mount->nDosDriveNo);

RtlInitUnicodeString (&ntUnicodeString, ntname);

TCGetDosNameFromNumber (dosname, sizeof(dosname),mount->nDosDriveNo, DeviceNamespaceDefault);

#endif

devChars |= mount->bMountReadOnly ? FILE_READ_ONLY_DEVICE : 0;

devChars |= mount->bMountRemovable ? FILE_REMOVABLE_MEDIA : 0;

Dump ("Creating device nt=%ls dos=%ls\n", ntname, dosname);

ntStatus = IoCreateDevice (

DriverObject, /* Our Driver Object */

KeReleaseMutex (&RootDeviceControlMutex, FALSE);

}

NTSTATUS ProcessVolumeDeviceControlIrp (PDEVICE_OBJECT DeviceObject, PEXTENSION Extension, PIRP Irp)

{

{

case IOCTL_MOUNTDEV_QUERY_DEVICE_NAME:

if (!ValidateIOBufferSize (Irp, sizeof (MOUNTDEV_NAME), ValidateOutput))

{

Irp->IoStatus.Information = sizeof (MOUNTDEV_NAME);

break;

case IOCTL_MOUNTDEV_QUERY_UNIQUE_ID:

if (!ValidateIOBufferSize (Irp, sizeof (MOUNTDEV_UNIQUE_ID), ValidateOutput))

{

Irp->IoStatus.Information = sizeof (MOUNTDEV_UNIQUE_ID);

break;

case IOCTL_MOUNTDEV_QUERY_SUGGESTED_LINK_NAME:

{

ULONG outLength;

UNICODE_STRING ntUnicodeString;

case IOCTL_DISK_GET_MEDIA_TYPES:

case IOCTL_DISK_GET_DRIVE_GEOMETRY:

/* Return the drive geometry for the disk. Note that we

return values which were made up to suit the disk size. */

if (ValidateIOBufferSize (Irp, sizeof (DISK_GEOMETRY), ValidateOutput))

break;

case IOCTL_STORAGE_QUERY_PROPERTY:

if (EnableExtendedIoctlSupport)

{

if (ValidateIOBufferSize (Irp, sizeof (STORAGE_PROPERTY_QUERY), ValidateInput))

break;

case IOCTL_DISK_GET_PARTITION_INFO:

if (ValidateIOBufferSize (Irp, sizeof (PARTITION_INFORMATION), ValidateOutput))

{

PPARTITION_INFORMATION outputBuffer = (PPARTITION_INFORMATION)

break;

case IOCTL_DISK_GET_PARTITION_INFO_EX:

if (ValidateIOBufferSize (Irp, sizeof (PARTITION_INFORMATION_EX), ValidateOutput))

{

PPARTITION_INFORMATION_EX outputBuffer = (PPARTITION_INFORMATION_EX) Irp->AssociatedIrp.SystemBuffer;

break;

case IOCTL_DISK_GET_DRIVE_LAYOUT:

if (ValidateIOBufferSize (Irp, sizeof (DRIVE_LAYOUT_INFORMATION), ValidateOutput))

{

PDRIVE_LAYOUT_INFORMATION outputBuffer = (PDRIVE_LAYOUT_INFORMATION)

break;

case IOCTL_DISK_GET_LENGTH_INFO:

if (!ValidateIOBufferSize (Irp, sizeof (GET_LENGTH_INFORMATION), ValidateOutput))

{

Irp->IoStatus.Status = STATUS_BUFFER_OVERFLOW;

break;

case IOCTL_DISK_VERIFY:

if (ValidateIOBufferSize (Irp, sizeof (VERIFY_INFORMATION), ValidateInput))

{

HRESULT hResult;

case IOCTL_DISK_CHECK_VERIFY:

case IOCTL_STORAGE_CHECK_VERIFY:

{

Irp->IoStatus.Status = STATUS_SUCCESS;

Irp->IoStatus.Information = 0;

break;

case IOCTL_DISK_IS_WRITABLE:

{

if (Extension->bReadOnly)

Irp->IoStatus.Status = STATUS_MEDIA_WRITE_PROTECTED;

break;

case IOCTL_VOLUME_ONLINE:

Irp->IoStatus.Status = STATUS_SUCCESS;

Irp->IoStatus.Information = 0;

break;

case IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS:

// Vista's filesystem defragmenter fails if IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS does not succeed.

if (!(OsMajorVersion == 6 && OsMinorVersion == 0))

{

break;

default:

return TCCompleteIrp (Irp, STATUS_INVALID_DEVICE_REQUEST, 0);

}

if (!NT_SUCCESS (Irp->IoStatus.Status))

{

Dump ("IOCTL error 0x%08x (0x%x %d)\n",

}

if (!NT_SUCCESS (Irp->IoStatus.Status))

{

switch (irpSp->Parameters.DeviceIoControl.IoControlCode)