Derived from source code of TrueCrypt 7.1a, which is

Copyright (c) 2008-2012 TrueCrypt Developers Association and which is governed

by the TrueCrypt License 3.0.

Modifications and additions to the original source code (contained in this file)

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

code distribution packages.

*/

int nStatus = ERR_SUCCESS;

PCRYPTO_INFO cryptoInfo = NULL;

PCRYPTO_INFO cryptoInfo2 = NULL;

HANDLE dev = INVALID_HANDLE_VALUE;

DWORD dwError;

WCHAR dosDev[TC_MAX_PATH] = {0};

WCHAR devName[MAX_PATH] = {0};

int driveLetter = -1;

WCHAR deviceName[MAX_PATH];

uint64 dataAreaSize;

if (!CheckRequirementsForNonSysInPlaceEnc (hwndDlg, volParams->volumePath, FALSE))

return ERR_DONT_REPORT;

if (!header)

return ERR_OUTOFMEMORY;

VirtualLock (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);

nStatus = ERR_OS_ERROR;

goto closing_seq;

}

// Write the backup header to the partition

{

nStatus = ERR_OS_ERROR;

goto closing_seq;

}

nStatus = ERR_OS_ERROR;

goto closing_seq;

}

// Write the fake hidden backup header to the partition

{

nStatus = ERR_OS_ERROR;

goto closing_seq;

}

WipeAlgorithmId wipeAlgorithm,

volatile BOOL *bTryToCorrectReadErrors)

{

PCRYPTO_INFO masterCryptoInfo = NULL, headerCryptoInfo = NULL, tmpCryptoInfo = NULL;

UINT64_STRUCT unitNo;

WCHAR dosDev[TC_MAX_PATH] = {0};

WCHAR devName[MAX_PATH] = {0};

WCHAR deviceName[MAX_PATH];

int nStatus = ERR_SUCCESS;

__int64 deviceSize;

Password *password = volParams->password;

int pkcs5_prf = volParams->pkcs5;

int pim = volParams->pim;

DISK_GEOMETRY driveGeometry;

HWND hwndDlg = volParams->hwndDlg;

BOOL bIsRamEncryptionEnabled = IsRamEncryptionEnabled();

bInPlaceEncNonSysResumed = TRUE;

if (!buf)

{

nStatus = ERR_OUTOFMEMORY;

goto closing_seq;

}

if (!header)

{

nStatus = ERR_OUTOFMEMORY;

goto closing_seq;

}

VirtualLock (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);

if (wipeAlgorithm != TC_WIPE_NONE)

{

if (!wipeBuffer)

{

nStatus = ERR_OUTOFMEMORY;

goto closing_seq;

}

nStatus = OpenBackupHeader (dev, devicePath, password, pkcs5_prf, pim, &masterCryptoInfo, headerCryptoInfo, deviceSize);

if (nStatus != ERR_SUCCESS)

goto closing_seq;

if (bIsRamEncryptionEnabled)

{

VcProtectKeys (masterCryptoInfo, VcGetEncryptionID (masterCryptoInfo));

VcProtectKeys (headerCryptoInfo, VcGetEncryptionID (headerCryptoInfo));

}

remainingBytes = masterCryptoInfo->VolumeSize.Value - masterCryptoInfo->EncryptedAreaLength.Value;

lastHeaderUpdateDistance = 0;

}

// Encrypt the plaintext in RAM

// If enabled, wipe the area to which we will write the ciphertext

if (wipeAlgorithm != TC_WIPE_NONE)

{

int wipePassCount = GetWipePassCount (wipeAlgorithm);

if (wipePassCount <= 0)

{

SetLastError (ERROR_INVALID_PARAMETER);

for (wipePass = 1; wipePass <= wipePassCount; ++wipePass)

{

if (!WipeBuffer (wipeAlgorithm, wipeRandChars, wipePass, wipeBuffer, workChunkSize))

{

{

}

EncryptDataUnits (wipeBuffer, &unitNo, workChunkSize / ENCRYPTION_DATA_UNIT_SIZE, masterCryptoInfo);

memcpy (wipeRandCharsUpdate, wipeBuffer, sizeof (wipeRandCharsUpdate));

}

dwError = GetLastError();

// Undo failed write operation

if (workChunkSize > TC_VOLUME_DATA_OFFSET && MoveFilePointer (dev, offset))

{

WriteFile (dev, buf + TC_VOLUME_DATA_OFFSET, workChunkSize - TC_VOLUME_DATA_OFFSET, &n, NULL);

}

SetLastError (dwError);

nStatus = ERR_OS_ERROR;

dwError = GetLastError();

// Undo failed write operation

if (workChunkSize > TC_VOLUME_DATA_OFFSET && MoveFilePointer (dev, offset))

{

WriteFile (dev, buf + TC_VOLUME_DATA_OFFSET, workChunkSize - TC_VOLUME_DATA_OFFSET, &n, NULL);

}

SetLastError (dwError);

nStatus = ERR_OS_ERROR;

for (int wipePass = 0; wipePass < (wipeAlgorithm == TC_WIPE_NONE ? 1 : PRAND_HEADER_WIPE_PASSES); wipePass++)

{

PCRYPTO_INFO dummyInfo = NULL;

CRYPTO_INFO tmpCI;

PCRYPTO_INFO cryptoInfoBackup = NULL;

if (bIsRamEncryptionEnabled)

{

VirtualLock (&tmpCI, sizeof(tmpCI));

memcpy (&tmpCI, masterCryptoInfo, sizeof (CRYPTO_INFO));

VcUnprotectKeys (&tmpCI, VcGetEncryptionID (masterCryptoInfo));

cryptoInfoBackup = masterCryptoInfo;

masterCryptoInfo = &tmpCI;

}

nStatus = CreateVolumeHeaderInMemory (hwndDlg, FALSE,

header,

headerCryptoInfo->ea,

headerCryptoInfo->mode,

masterCryptoInfo->RequiredProgramVersion,

masterCryptoInfo->HeaderFlags | TC_HEADER_FLAG_NONSYS_INPLACE_ENC,

masterCryptoInfo->SectorSize,

wipeAlgorithm == TC_WIPE_NONE ? FALSE : (wipePass < PRAND_HEADER_WIPE_PASSES - 1));

if (bIsRamEncryptionEnabled)

{

masterCryptoInfo = cryptoInfoBackup;

burn (&tmpCI, sizeof (CRYPTO_INFO));

VirtualUnlock (&tmpCI, sizeof(tmpCI));

}

if (nStatus != ERR_SUCCESS)

goto closing_seq;

offset.QuadPart = TC_VOLUME_HEADER_OFFSET;

if (MoveFilePointer (dev, offset) == 0

{

nStatus = ERR_OS_ERROR;

goto closing_seq;

}

if (bIsRamEncryptionEnabled)

{

VirtualLock (&tmpCI, sizeof(tmpCI));

memcpy (&tmpCI, headerCryptoInfo, sizeof (CRYPTO_INFO));

VcUnprotectKeys (&tmpCI, VcGetEncryptionID (headerCryptoInfo));

cryptoInfoBackup = headerCryptoInfo;

headerCryptoInfo = &tmpCI;

}

// Fill the reserved sectors of the header area with random data

nStatus = WriteRandomDataToReservedHeaderAreas (hwndDlg, dev, headerCryptoInfo, masterCryptoInfo->VolumeSize.Value, TRUE, FALSE);

if (bIsRamEncryptionEnabled)

{

headerCryptoInfo = cryptoInfoBackup;

burn (&tmpCI, sizeof (CRYPTO_INFO));

VirtualUnlock (&tmpCI, sizeof(tmpCI));

}

if (nStatus != ERR_SUCCESS)

goto closing_seq;

// write fake hidden volume header to protect against attacks that use statistical entropy

crypto_close (dummyInfo);

offset.QuadPart += TC_HIDDEN_VOLUME_HEADER_OFFSET;

if (MoveFilePointer (dev, offset) == 0

{

nStatus = ERR_OS_ERROR;

goto closing_seq;

}

}

{

HANDLE dev = INVALID_HANDLE_VALUE;

PCRYPTO_INFO masterCryptoInfo = NULL, headerCryptoInfo = NULL;

UINT64_STRUCT unitNo;

char *buf = NULL;

WCHAR dosDev[TC_MAX_PATH] = {0};

WCHAR devName[MAX_PATH] = {0};

WCHAR deviceName[MAX_PATH];

int nStatus = ERR_SUCCESS;

__int64 deviceSize;

Password *password = volParams->password;

HWND hwndDlg = volParams->hwndDlg;

int pkcs5_prf = volParams->pkcs5;

int pim = volParams->pim;

DISK_GEOMETRY driveGeometry;

BOOL bIsRamEncryptionEnabled = IsRamEncryptionEnabled();

buf = (char *) TCalloc (TC_MAX_NONSYS_INPLACE_ENC_WORK_CHUNK_SIZE);

if (!buf)

{

if (driveLetter == -1

|| !UnmountVolume (hwndDlg, driveLetter, TRUE))

{

handleWin32Error (hwndDlg, SRC_POS);

}

}

StringCchCopyW (deviceName, ARRAYSIZE(deviceName), devicePath);

}

sectorSize = driveGeometry.BytesPerSector;

if (!tmpSectorBuf)

{

nStatus = ERR_OUTOFMEMORY;

goto closing_seq;

}

nStatus = OpenBackupHeader (dev, devicePath, password, pkcs5_prf, pim, &masterCryptoInfo, headerCryptoInfo, deviceSize);

if (nStatus != ERR_SUCCESS)

goto closing_seq;

if (bIsRamEncryptionEnabled)

{

VcProtectKeys (masterCryptoInfo, VcGetEncryptionID (masterCryptoInfo));

VcProtectKeys (headerCryptoInfo, VcGetEncryptionID (headerCryptoInfo));

}

if (masterCryptoInfo->LegacyVolume)

{

Error ("NONSYS_INPLACE_DECRYPTION_BAD_VOL_FORMAT", hwndDlg);

nStatus = ERR_DONT_REPORT;

}

}

// Decrypt the ciphertext in RAM

// Conceal initial portion of the filesystem

int FastVolumeHeaderUpdate (HANDLE dev, CRYPTO_INFO *headerCryptoInfo, CRYPTO_INFO *masterCryptoInfo, __int64 deviceSize)

{

LARGE_INTEGER offset;

DWORD n;

int nStatus = ERR_SUCCESS;

DWORD dwError;

uint32 headerCrc32;

PCRYPTO_INFO pCryptoInfo = headerCryptoInfo;

BOOL bIsRamEncryptionEnabled = IsRamEncryptionEnabled();

if (!header)

return ERR_OUTOFMEMORY;

VirtualLock (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);

offset.QuadPart = deviceSize - TC_VOLUME_HEADER_GROUP_SIZE;

if (MoveFilePointer (dev, offset) == 0

|| !ReadEffectiveVolumeHeader (TRUE, dev, header, &n) || n < TC_VOLUME_HEADER_EFFECTIVE_SIZE)

{

nStatus = ERR_OS_ERROR;

goto closing_seq;

}

if (bIsRamEncryptionEnabled)

{

pCryptoInfo = crypto_open();

if (!pCryptoInfo)

{

}

memcpy (pCryptoInfo, headerCryptoInfo, sizeof (CRYPTO_INFO));

VcUnprotectKeys (pCryptoInfo, VcGetEncryptionID (headerCryptoInfo));

}

DecryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, pCryptoInfo);

if (GetHeaderField32 (header, TC_HEADER_OFFSET_MAGIC) != 0x56455241)

// We need to ensure the TC_HEADER_FLAG_NONSYS_INPLACE_ENC flag bit is set, because if volumes created by TC-format

// were decrypted in place, it would be possible to mount them partially encrypted and it wouldn't be possible

// to resume interrupted decryption after the wizard exits.

masterCryptoInfo->HeaderFlags |= TC_HEADER_FLAG_NONSYS_INPLACE_ENC;

mputLong (fieldPos, (masterCryptoInfo->HeaderFlags));

headerCrc32 = GetCrc32 (header + TC_HEADER_OFFSET_MAGIC, TC_HEADER_OFFSET_HEADER_CRC - TC_HEADER_OFFSET_MAGIC);

mputLong (fieldPos, headerCrc32);

EncryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, pCryptoInfo);

closing_seq:

dwError = GetLastError();

if (bIsRamEncryptionEnabled && pCryptoInfo)

{

crypto_close(pCryptoInfo);

}

burn (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);

VirtualUnlock (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);

TCfree (header);

if (!bResult)

{

if (!bForcedAllowed)

{

if (!bSilent)

return ERR_DONT_REPORT;

}

if (bForcedRequiresConfirmation

&& !bSilent

{

return ERR_DONT_REPORT;

}

}

}

if (!bResult)

{

if (!bSilent)

return ERR_DONT_REPORT;

}

return ERR_SUCCESS;

// This approach of moving the file pointer relatively (instead of absolutely) was implemented

// as a workaround to address the performance issues related to in-place encryption. When using

// SetFilePointerEx() with FILE_BEGIN as the reference point, reaching the end of large drives

// during in-place encryption can cause significant slowdowns. By moving the file pointer

// relatively, these performance issues are mitigated.

BOOL MoveFilePointer (HANDLE dev, LARGE_INTEGER offset)

{

LARGE_INTEGER currOffset;

LARGE_INTEGER diffOffset;

currOffset.QuadPart = 0;

}

// Repairs damaged sectors (i.e. those with read errors) by zeroing them.

// Note that this operating fails if there are any write errors.

int ZeroUnreadableSectors (HANDLE dev, LARGE_INTEGER startOffset, int64 size, int sectorSize, uint64 *zeroedSectorCount)

{

int nStatus;

DWORD n;

int64 sectorCount;

LARGE_INTEGER workOffset;

DWORD dwError;

workOffset.QuadPart = startOffset.QuadPart;

if (!sectorBuffer)

return ERR_OUTOFMEMORY;

if (!MoveFilePointer(dev, workOffset))

static int OpenBackupHeader (HANDLE dev, const wchar_t *devicePath, Password *password, int pkcs5, int pim, PCRYPTO_INFO *retMasterCryptoInfo, CRYPTO_INFO *headerCryptoInfo, __int64 deviceSize)

{

LARGE_INTEGER offset;

DWORD n;

int nStatus = ERR_SUCCESS;

DWORD dwError;

if (!header)

return ERR_OUTOFMEMORY;

VirtualLock (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);

offset.QuadPart = deviceSize - TC_VOLUME_HEADER_GROUP_SIZE;

if (MoveFilePointer (dev, offset) == 0

{

nStatus = ERR_OS_ERROR;

goto closing_seq;

}

static BOOL GetFreeClusterBeforeThreshold (HANDLE volumeHandle, int64 *freeCluster, int64 clusterThreshold)

{

const int bitmapSize = 65536;

VOLUME_BITMAP_BUFFER *bitmap = (VOLUME_BITMAP_BUFFER *) bitmapBuffer;

STARTING_LCN_INPUT_BUFFER startLcn;

startLcn.StartingLcn.QuadPart = 0;

DWORD bytesReturned;