BOOL BootArgsValid = FALSE;

BootArguments BootArgs;

uint32 BootSecRegionSize = 0;

uint32 BootPkcs5 = 0;

static volatile BOOL BootDriveFound = FALSE;

static DriveFilterExtension *BootDriveFilterExtension = NULL;

static LARGE_INTEGER BootDriveLength;

static BOOL CrashDumpEnabled = FALSE;

static BOOL HibernationEnabled = FALSE;

static BOOL LegacyHibernationDriverFilterActive = FALSE;

static MDL *HibernationWriteBufferMdl = NULL;

static uint32 HibernationPreventionCount = 0;

{

NTSTATUS status = STATUS_UNSUCCESSFUL;

PHYSICAL_ADDRESS bootArgsAddr;

uint16 bootLoaderArgsIndex;

uint64* BootArgsRegionsPtr = bIsEfi? BootArgsRegionsEFI : BootArgsRegionsDefault;

size_t BootArgsRegionsCount = bIsEfi? sizeof(BootArgsRegionsEFI)/ sizeof(BootArgsRegionsEFI[0]) : sizeof(BootArgsRegionsDefault)/ sizeof(BootArgsRegionsDefault[0]);

DumpMem (mappedBootArgs, sizeof (BootArguments));

if (bootArguments->BootLoaderVersion == VERSION_NUM

{

Dump ("BootArguments CRC incorrect\n");

burn (mappedBootArgs, sizeof (BootArguments));

uint32 crc;

PHYSICAL_ADDRESS SecRegionAddress;

SECREGION_BOOT_PARAMS* SecRegionParams = (SECREGION_BOOT_PARAMS*) (mappedCryptoInfo + sizeof(BOOT_CRYPTO_HEADER) + 2);

SecRegionAddress.QuadPart = SecRegionParams->Ptr;

Dump ("SecRegion memory 0x%x %d\n", SecRegionAddress.LowPart, SecRegionParams->Size);

// SecRegion correct?

if( (SecRegionParams->Ptr != 0) && (SecRegionParams->Size > 0)) {

if(crc == SecRegionParams->Crc) {

Dump ("SecRegion crc ok\n");

secRegionData = MmMapIoSpace (SecRegionAddress, SecRegionParams->Size, MmCached);

Dump ("Drive filter encryption keys invalidated!\n");

}

{

NTSTATUS status;

LARGE_INTEGER offset;

// Check disk MBR id and GPT ID if BootSecRegion is available to detect boot drive

if (BootSecRegionData != NULL && BootSecRegionSize >= 1024) {

DCS_DISK_ENTRY_LIST* DeList = (DCS_DISK_ENTRY_LIST*)(BootSecRegionData + 512);

offset.QuadPart = 0;

status = TCReadDevice (Extension->LowerDeviceObject, mbr, offset, TC_SECTOR_SIZE_BIOS);

// Check boot drive signature first (header CRC search could fail if a user restored the header to a non-boot drive)

if (BootDriveSignatureValid)

{

offset.QuadPart = 0;

status = TCReadDevice (Extension->LowerDeviceObject, mbr, offset, TC_SECTOR_SIZE_BIOS);

uint32 crcSaved;

crcSaved = DeList->CRC32;

DeList->CRC32 = 0;

if(crc == crcSaved){

if(DeList->DE[DE_IDX_PWDCACHE].Type == DE_PwdCache) {

uint64 sector = 0;

{

NTSTATUS status = STATUS_SUCCESS;

LARGE_INTEGER offset;

header = TCalloc (TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);

if (!header)

{

uint32 headerCrc32;

uint64 encryptedAreaLength = Extension->Queue.EncryptedAreaEnd + 1 - Extension->Queue.EncryptedAreaStart;

PCRYPTO_INFO pCryptoInfo = Extension->HeaderCryptoInfo;

#ifdef _WIN64

CRYPTO_INFO tmpCI;

typedef struct

{

#ifdef _WIN64

HiberDriverWriteFunctionB WriteFunctionB;

#else

HiberDriverWriteFunctionB WriteFunctionB;

#endif

HiberDriverWriteFunctionA WriteFunctionA;

LARGE_INTEGER PartitionStartOffset;

} HiberDriverContext;

{

LIST_ENTRY ModuleList;

#ifdef _WIN64

#else

#endif

PVOID ModuleBaseAddress;

HiberDriverEntry ModuleEntryAddress;

#ifdef _WIN64

#else

#endif

UNICODE_STRING ModuleName;

} ModuleTableItem;

BOOL headerUpdateRequired = FALSE;

int64 bytesWrittenSinceHeaderUpdate = 0;

KIRQL irql;

NTSTATUS status;

// generate real random values for wipeRandChars and

// wipeRandCharsUpdate instead of relying on uninitialized stack memory

ChaCha20RngCtx rngCtx;

GetDriverRandomSeed (pbSeed, sizeof (pbSeed));

ChaCha20RngInit (&rngCtx, pbSeed, GetDriverRandomSeed, 0);

if (SetupRequest.WipeAlgorithm != TC_WIPE_NONE)

{

int wipePassCount = GetWipePassCount (SetupRequest.WipeAlgorithm);

if (wipePassCount <= 0)

{

ULONG wipeBlockSize = TC_ENCRYPTION_SETUP_IO_BLOCK_SIZE;

CRYPTO_INFO *wipeCryptoInfo = NULL;

int wipePass, wipePassCount;

int ea = Extension->Queue.CryptoInfo->ea;

static DriveFilterExtension *BootDriveFilterExtension = NULL;

static LARGE_INTEGER DumpPartitionOffset;

static SIZE_T WriteFilterBufferSize;

}

{

NTSTATUS status = STATUS_INVALID_PARAMETER;

}

{

if (buffer == queue->FragmentBufferA)

{

BOOL

UpdateBuffer(

uint64 bufferDiskOffset,

uint32 bufferLength,

BOOL doUpadte

{

// Up to three subfragments may be required to handle a partially remapped fragment

int subFragment;

for (subFragment = 0 ; subFragment < 3; ++subFragment)

{

&& (item->OriginalLength & (ENCRYPTION_DATA_UNIT_SIZE - 1)) == 0

&& (item->OriginalOffset.QuadPart & (ENCRYPTION_DATA_UNIT_SIZE - 1)) != 0)

{

ULONG alignedLength;

LARGE_INTEGER alignedOffset;

hResult = ULongAdd(item->OriginalLength, ENCRYPTION_DATA_UNIT_SIZE, &alignedLength);

KEVENT CompletionThreadQueueNotEmptyEvent;

// Fragment buffers

KEVENT FragmentBufferAFreeEvent;

KEVENT FragmentBufferBFreeEvent;

ULONG LastReadLength;

LARGE_INTEGER ReadAheadOffset;

ULONG ReadAheadLength;

LARGE_INTEGER MaxReadAheadOffset;

LONG OutstandingIoCount;

LARGE_INTEGER LastPerformanceCounter;

#endif

SIZE_T SecRegionSize;

volatile BOOL ThreadBlockReadWrite;

ULONG Length;

int64 EncryptedOffset;

ULONG EncryptedLength;

LIST_ENTRY ListEntry;

LIST_ENTRY CompletionListEntry;

SecureBuffer alignedBuffer (alignedSize);

FuseService::ReadVolumeSectors (alignedBuffer, alignedOffset);

}

else

{

}

}

catch (MissingVolumeData&)

if (strcmp (path, FuseService::GetControlPath()) == 0)

{

shared_ptr <Buffer> infoBuf = FuseService::GetVolumeInfo();

if (offset >= (off_t) infoBuf->Size())

return 0;

if (strcmp (path, FuseService::GetVolumeImagePath()) == 0)

{

return size;

}

if (FuseService::AuxDeviceInfoReceived())

return -EACCES;

return size;

}

}

sigaction (SIGTERM, &action, nullptr);

// Wait for the exit of the main service

if (read (SignalHandlerPipe->GetReadFD(), buf, sizeof (buf))) { } // Errors ignored

_exit (0);

void GetDriverRandomSeed (unsigned char* pbRandSeed, size_t cbRandSeed)

{

LARGE_INTEGER iSeed, iSeed2;

WHIRLPOOL_CTX tctx;

size_t count;

if (opentest->bDetectTCBootLoader || opentest->DetectFilesystem || opentest->bComputeVolumeIDs)

{

if (!readBuffer)

{

ntStatus = STATUS_INSUFFICIENT_RESOURCES;

if (NT_SUCCESS (ntStatus))

{

if (!readBuffer)

{

Irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;

NTSTATUS status;

LARGE_INTEGER sysLength;

LARGE_INTEGER offset;

ULONGLONG startTime;

ULONG sectorSize;

NTSTATUS status;

ULONG sectorSize;

ULONG sectorCount;

*zeroedSectorCount = 0;

}

{

NTSTATUS status;

ULONG sectorSize;

BOOL ValidateIOBufferSize (PIRP irp, size_t requiredBufferSize, ValidateIOBufferSizeType type);

NTSTATUS GetDeviceSectorSize (PDEVICE_OBJECT deviceObject, ULONG *bytesPerSector);

NTSTATUS ZeroUnreadableSectors (PDEVICE_OBJECT deviceObject, LARGE_INTEGER startOffset, ULONG size, uint64 *zeroedSectorCount);

BOOL IsVolumeAccessibleByCurrentUser (PEXTENSION volumeDeviceExtension);

void GetElapsedTimeInit (LARGE_INTEGER *lastPerfCounter);

int64 GetElapsedTime (LARGE_INTEGER *lastPerfCounter);

LARGE_INTEGER diskLengthInfo;

DISK_GEOMETRY_EX dg;

STORAGE_PROPERTY_QUERY storagePropertyQuery = {0};

STORAGE_DEVICE_NUMBER storageDeviceNumber;

ntStatus = IoGetDeviceObjectPointer (&FullFileName,