/*

Legal Notice: Some portions of the source code contained in this file were

governed by the TrueCrypt License 3.0, also from the source code of

Encryption for the Masses 2.02a, which is Copyright (c) 1998-2000 Paul Le Roux

and all other portions of this file are Copyright (c) 2013-2016 IDRIX

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

SYSENC_COMMAND_CREATE_HIDDEN_OS_ELEV

};

{

int NumberOfSysDrives; // Number of drives that contain an operating system. -1: unknown, 1: one, 2: two or more

int MultipleSystemsOnDrive; // Multiple systems are installed on the drive where the currently running system resides. -1: unknown, 0: no, 1: yes

#define SYSENC_PAUSE_RETRY_INTERVAL 100

#define SYSENC_PAUSE_RETRIES 200

#define SYSENC_DRIVE_ANALYSIS_ETA (4*60000)

BootEncryption *BootEncObj = NULL;

HBITMAP hbmWizardBitmapRescaled = NULL;

wchar_t OrigKeyboardLayout [8+1] = L"00000409";

#ifndef _DEBUG

BOOL bWarnDeviceFormatAdvanced = TRUE;

volatile BOOL bSparseFileSwitch = FALSE;

volatile BOOL quickFormat = FALSE; /* WARNING: Meaning of this variable depends on bSparseFileSwitch. If bSparseFileSwitch is TRUE, this variable represents the sparse file flag. */

volatile int clusterSize = 0;

SYSENC_MULTIBOOT_CFG SysEncMultiBootCfg;

vector <HostDevice> DeferredNonSysInPlaceEncDevices;

// in wait dialog mechanism

void CALLBACK ResumeInPlaceEncWaitThreadProc(void* pArg, HWND hwndDlg)

while (true)

{

if ((int)ShellExecute (MainDlg, L"runas", modPath, (wstring(L"/q UAC ") + arguments).c_str(), NULL, SW_SHOWNORMAL) > 32)

exit (0);

}

else

}

CloseNonSysInplaceEncMutex ();

// Device wipe

// IMPORTANT: This function may be called only by Format (other modules can only _read_ the status).

// Returns TRUE if successful (otherwise FALSE)

{

if (!CreateSysEncMutex ())

{

// may be called only after CreateSysEncMutex() returns TRUE. It returns TRUE if successful (otherwise FALSE).

static BOOL ChangeWizardMode (int newWizardMode)

{

{

if (WizardMode == WIZARD_MODE_SYS_DEVICE || newWizardMode == WIZARD_MODE_SYS_DEVICE)

{

// If the previous mode was different, the password may have been typed using a different

// keyboard layout (which might confuse the user and cause other problems if system encryption

// was or will be involved).

}

if (newWizardMode != WIZARD_MODE_NONSYS_DEVICE)

bDevice = (WizardMode != WIZARD_MODE_FILE_CONTAINER);

&& !bHiddenOS)

{

}

return TRUE;

// Determines whether the wizard directly affects system encryption in any way.

// Note, for example, that when the user enters a password for a hidden volume that is to host a hidden OS,

// this function has to be called instead of checking the value of WizardMode.

static BOOL SysEncInEffect (void)

{

static BOOL CreatingHiddenSysVol (void)

{

&& bHiddenVol && !bHiddenVolHost);

}

StringCbCopyA (langid, sizeof(langid), "en");

if (pbSettingsModified && strcmp (langid, GetPreferredLangId ()))

}

else

{

MoveEditToCombo (GetDlgItem (hCurPage, IDC_COMBO_BOX), bHistory);

SaveSettings (hCurPage);

}

{

SaveSettings (NULL);

}

return (SystemEncryptionStatus == SYSENC_STATUS_ENCRYPTING

|| SystemEncryptionStatus == SYSENC_STATUS_DECRYPTING

(

(

locBootEncStatus.ConfiguredEncryptedAreaStart != locBootEncStatus.EncryptedAreaStart

|| locBootEncStatus.ConfiguredEncryptedAreaEnd != locBootEncStatus.EncryptedAreaEnd

// The config file with status was lost or not written correctly

if (!ResolveUnknownSysEncDirection ())

{

NormalCursor ();

return FALSE;

}

}

else

{

Error ("SYS_ENCRYPTION_OR_DECRYPTION_IN_PROGRESS", MainDlg);

NormalCursor ();

return FALSE;

{

// If the config file with status was lost or not written correctly, we

// don't know whether to encrypt or decrypt (but we know that encryption or

// or cancel

if (!ResolveUnknownSysEncDirection ())

{

NormalCursor ();

return FALSE;

}

}

else

{

Error ("SETUP_FAILED_BOOT_DRIVE_ENCRYPTED", MainDlg);

NormalCursor ();

return FALSE;

}

catch (Exception &e)

{

e.Show (MainDlg);

NormalCursor ();

return FALSE;

Warning ("WDE_EXTENDED_PARTITIONS_WARNING", MainDlg);

}

}

&& !bWholeSysDrive)

bWholeSysDrive = (AskYesNo ("WHOLE_SYC_DEVICE_RECOM", MainDlg) == IDYES);

}

if (!bHiddenVol)

{

// Skip SYSENC_SPAN_PAGE and SYSENC_TYPE_PAGE as the user already made the choice

}

else

{

if (bDirectSysEncModeCommand == SYSENC_COMMAND_CREATE_HIDDEN_OS_ELEV)

{

// Some of the requirements for hidden OS should have already been checked by the wizard process

// could bypass the checks by using the undocumented CLI switch. Moreover, some requirements

// can be checked only at this point (when we are elevated).

try

}

// This function should be used to resolve inconsistencies that might lead to a deadlock (inability to encrypt or

// data ("volume header"), the TrueCrypt boot loader, restores the original system loader (if available),

// unregisters the boot driver, etc. Note that if the system partition/drive is encrypted, it will start decrypting

// it in the background (therefore, it should be used when the system partition/drive is not encrypted, ideally).

if (locBootEncStatus.DriveMounted)

{

// Remove the header

locBootEncStatus = BootEncObj->GetStatus();

while (locBootEncStatus.SetupInProgress)

else if (wcscmp (name, L"Serpent") == 0)

{

StringCbPrintfW (hyperLink, sizeof(hyperLink) / 2, GetString ("MORE_INFO_ABOUT"), name);

SetWindowTextW (GetDlgItem (hwndDlg, IDC_BOX_HELP), GetString ("SERPENT_HELP"));

}

else if (wcscmp (name, L"Twofish") == 0)

while (i = EAGetPreviousCipher(nIndex, i))

{

cipherIDs[cnt] = i;

}

switch (cnt) // Number of ciphers in the cascade

{

case 2:

CipherGetName (cipherIDs[1]),

CipherGetKeySize (cipherIDs[1])*8,

CipherGetName (cipherIDs[0]),

break;

case 3:

CipherGetName (cipherIDs[2]),

CipherGetKeySize (cipherIDs[2])*8,

CipherGetName (cipherIDs[1]),

{

// Change of volume size may make some file systems allowed or disallowed, so the default filesystem must

// be reselected.

nLastVolumeSize = nVolumeSize;

}

}

return;

}

|| locBootEncStatus.EncryptedAreaStart == -1)

{

UpdateProgressBarProc (0);

return;

}

|| locBootEncStatus.ConfiguredEncryptedAreaStart == -1)

return;

- locBootEncStatus.ConfiguredEncryptedAreaStart + 1,

(locBootEncStatus.EncryptedAreaEnd == locBootEncStatus.EncryptedAreaStart || locBootEncStatus.EncryptedAreaEnd == -1) ?

0 : locBootEncStatus.EncryptedAreaEnd - locBootEncStatus.EncryptedAreaStart + 1,

return;

}

&& SystemEncryptionStatus == SYSENC_STATUS_ENCRYPTING);

SetWindowTextW (GetDlgItem (hCurPage, IDC_PAUSE),

Error ("FAILED_TO_INTERRUPT_SYSTEM_ENCRYPTION", MainDlg);

return;

}

UpdateSysEncControls ();

EnableWindow (GetDlgItem (hCurPage, IDC_PAUSE), TRUE);

}

{

case SYSENC_STATUS_ENCRYPTING:

break;

case SYSENC_STATUS_DECRYPTING:

if (locBootEncStatus.DriveMounted) // If the drive is not encrypted we will just deinstall

break;

}

return FALSE;

}

&& tmpbDevice);

}

// boot partition and the first partition behind it. If there's none or if an error occurs, returns FALSE.

static BOOL CheckGapBetweenSysAndHiddenOS (void)

{

{

SystemDriveConfiguration sysDriveCfg = BootEncObj->GetSystemDriveConfiguration();

+ sysDriveCfg.SystemPartition.Info.PartitionLength.QuadPart

+ 64 * BYTES_PER_MB

+ 128 * BYTES_PER_KB

WaitCursor ();

int waitThreshold = 100; // Do not block GUI events for more than 10 seconds. IMPORTANT: This prevents deadlocks when the thread calls us back e.g. to update GUI!

while (bVolTransformThreadRunning || bVolTransformThreadToRun)

{

MSG guiMsg;

lastbInPlaceEncNonSysResumed = bInPlaceEncNonSysResumed;

}

&& NonSysInplaceEncStatus != NONSYS_INPLACE_ENC_STATUS_FINALIZING

&& NonSysInplaceEncStatus != NONSYS_INPLACE_ENC_STATUS_FINISHED);

EnableWindow (GetDlgItem (MainDlg, IDC_NEXT), !(bVolTransformThreadRunning || bVolTransformThreadToRun) && !bFirstNonSysInPlaceEncResumeDone);

EnableWindow (GetDlgItem (MainDlg, IDC_PREV), !(bVolTransformThreadRunning || bVolTransformThreadToRun) && !bInPlaceEncNonSysResumed);

|| NonSysInplaceEncStatus == NONSYS_INPLACE_ENC_STATUS_RESIZING

|| NonSysInplaceEncStatus == NONSYS_INPLACE_ENC_STATUS_FINALIZING

|| NonSysInplaceEncStatus == NONSYS_INPLACE_ENC_STATUS_FINISHED));

int nonSysInplaceEncStatus = NonSysInplaceEncStatus;

__int64 totalSize = NonSysInplaceEncTotalSize;

&& (nonSysInplaceEncStatus == NONSYS_INPLACE_ENC_STATUS_ENCRYPTING

|| nonSysInplaceEncStatus == NONSYS_INPLACE_ENC_STATUS_DECRYPTING

|| nonSysInplaceEncStatus == NONSYS_INPLACE_ENC_STATUS_FINALIZING

void DisplayRandPool (HWND hwndDlg, HWND hPoolDisplay, BOOL bShow)

wchar_t tmp[4];

unsigned char tmpByte;

int col, row;

else if (bUseMask)

{

/* use mask to compute a randomized ASCII representation */

lastRandPool[row * RANDPOOL_DISPLAY_COLUMNS + col]) ^ maskRandPool [row * RANDPOOL_DISPLAY_COLUMNS + col];

tmp[0] = (wchar_t) (((tmpByte >> 4) % 6) + L'*');

tmp[1] = (wchar_t) (((tmpByte & 0x0F) % 6) + L'*');

if (bHiddenOS && IsHiddenOSRunning())

{

DecoySystemWipeStatus decoySysPartitionWipeStatus;

try

try

{

bDeviceWipeInProgress = TRUE;

}

return;

}

|| BootEncStatus.ConfiguredEncryptedAreaStart == -1)

return;

int nStatus;

DWORD dwWin32FormatError;

BOOL bHidden;

volatile FORMAT_VOL_PARAMETERS *volParams = (FORMAT_VOL_PARAMETERS *) malloc (sizeof(FORMAT_VOL_PARAMETERS));

if (volParams == NULL)

// NOP - Final steps for in-place decryption are handled with the TC_APPMSG_NONSYS_INPLACE_ENC_FINISHED message.

}

}

{

Info("FORMAT_FINISHED_INFO", hwndDlg);

{

/* We've just created an outer volume (to host a hidden volume within) */

bHiddenVolFinished = FALSE;

nHiddenVolHostSize = nVolumeSize;

if (hCurPage != NULL)

{

// WARNING: nCurPageNo must be set to a non-existent ID here before wiping the password fields below in

// not null-terminated.

nCurPageNo = -1;

// Place here any actions that need to be performed at the latest possible time when leaving a wizard page

// (i.e. right before "destroying" the page). Also, code that needs to be executed both on IDC_NEXT and

switch (nLastPageNo)

{

{

wchar_t tmp[MAX_PASSWORD+1];

// not in the IDC_PREV or IDC_NEXT sections) in order to prevent certain race conditions

// when keyfiles are used.

wmemset (tmp, 'X', MAX_PASSWORD);

EnableWindow (GetDlgItem(hCurPage, IDC_NO_HISTORY), !bHistoryCmdLine);

GetWindowTextLength (GetDlgItem (hCurPage, IDC_COMBO_BOX)) > 0);

break;

MoveWindow (hCurPage, rD.left, rD.top, rW.right - rW.left, rW.bottom - rW.top, TRUE);

ShowWindow (hCurPage, SW_SHOWNORMAL);

// ensures that the page is fully rendered (otherwise it would remain blank, until the message box

// is closed).

switch (nPageNo)

else

nResourceString = "DISK_FREE_GB";

}

{

if (bHiddenVol && !bHiddenVolHost) // If it's a hidden volume

nResourceString = "MAX_HIDVOL_SIZE_TB";

switch (AskMultiChoice ((void **) tmpStr, TRUE, MainDlg))

{

case 1:

// NOP

break;

else

{

// The hidden volume must be as large as the system partition

SetWindowTextW (GetDlgItem (hwndDlg, IDC_BOX_HELP), GetString ("HIDDEN_OS_PRE_CIPHER_HELP"));

}

// For now, we keep RIPEMD160 for system encryption

if (((hid == RIPEMD160) || !HashIsDeprecated (hid)) && HashForSystemEncryption (hid))

AddComboPair (GetDlgItem (hwndDlg, IDC_COMBO_BOX_HASH_ALGO), HashGetName(hid), hid);

}

else

{

wchar_t str[1000];

hPasswordInputField = GetDlgItem (hwndDlg, IDC_PASSWORD);

if (SysEncInEffect ())

{

SetPassword (hwndDlg, IDC_VERIFY, szVerify);

SetFocus (GetDlgItem (hwndDlg, IDC_PASSWORD));

SetCheckBox (hwndDlg, IDC_PIM_ENABLE, PimEnable);

SetCheckBox (hwndDlg, IDC_KEYFILES_ENABLE, KeyFilesEnable && !SysEncInEffect());

SetWindowTextW (GetDlgItem (GetParent (hwndDlg), IDC_BOX_TITLE), GetString ("WIPE_MODE_TITLE"));

SetWindowTextW (GetDlgItem (hwndDlg, IDT_WIPE_MODE_INFO), GetString ("INPLACE_ENC_WIPE_MODE_INFO"));

SystemEncryptionStatus == SYSENC_STATUS_DECRYPTING && !bInPlaceEncNonSys,

TRUE,

FALSE);

try

{

StringCbPrintfW (finalMsg, sizeof(finalMsg),

BootEncObj->GetSystemDriveConfiguration().DriveNumber);

}

catch (Exception &e)

EnableWindow (GetDlgItem (GetParent (hwndDlg), IDC_PREV), TRUE);

EnableWindow (GetDlgItem (GetParent (hwndDlg), IDC_NEXT), FALSE);

foreach (const HostDevice &device, DeferredNonSysInPlaceEncDevices)

{

SendMessage (GetDlgItem (hwndDlg, IDC_LIST_BOX), LB_ADDSTRING, 0, (LPARAM) device.Path.c_str());

}

// Deselect all

SendMessage (GetDlgItem (hwndDlg, IDC_LIST_BOX), LB_SETCURSEL, (WPARAM) -1, 0);

}

SetWindowTextW (GetDlgItem (GetParent (hwndDlg), IDCANCEL), GetString ("CANCEL"));

// the window accidentally or clicking Cancel. The user is forced to click Finish to assign at least the pre-selected free drive letter.

// This is critical because inexperienced users would not know how to access data on the decrypted volume without a drive letter.

EnableWindow (GetDlgItem (GetParent (hwndDlg), IDCANCEL), FALSE);

DisableCloseButton (MainDlg);

bConfirmQuit = TRUE; // Alt-F4 will still work but the user will be prompted to confirm the action.

// This is critical because inexperienced users would not know how to access data on the decrypted volume. We cannot allow exit

// until a drive letter is freed up and assigned to the decrypted volume.

uint64 dataAreaSize = GetVolumeDataAreaSize (bHiddenVol && !bHiddenVolHost, nVolumeSize);

{

if (dataAreaSize >= TC_MIN_NTFS_FS_SIZE && dataAreaSize <= TC_MAX_NTFS_FS_SIZE)

{

// Determine the maximum recommended total size of files that can be copied to the outer volume

// while leaving enough space for the hidden volume, which must contain a clone of the OS

// -50% reserve for filesystem "peculiarities"

StringCbPrintfW (szMaxRecomOuterVolFillSize, sizeof(szMaxRecomOuterVolFillSize), L"%I64d %s", maxRecomOuterVolFillSize / BYTES_PER_MB, GetString ("MB"));

}

else

StringCbPrintfW (msg, sizeof(msg), GetString ("HIDVOL_HOST_FILLING_HELP"), hiddenVolHostDriveNo + 'A');

SetWindowTextW (GetDlgItem (hwndDlg, IDC_BOX_HELP), msg);

SetWindowTextW (GetDlgItem (GetParent (hwndDlg), IDC_BOX_TITLE), GetString ("HIDVOL_HOST_FILLING_TITLE"));

}

{

if (bHiddenOS)

SetWindowTextW (GetDlgItem (hwndDlg, IDC_BOX_HELP), GetString ("SYSENC_HIDDEN_VOL_FORMAT_FINISHED_HELP"));

if (hw == CBN_SELCHANGE)

{

nWipeMode = (WipeAlgorithmId) SendMessage (GetDlgItem (hCurPage, IDC_WIPE_MODE),

SendMessage (GetDlgItem (hCurPage, IDC_WIPE_MODE), CB_GETCURSEL, 0, 0),

0);

{

case NONSYS_INPLACE_ENC_RESUME_PARTITION_SEL_PAGE:

&& (hw == LBN_SELCHANGE || hw == LBN_DBLCLK))

{

BOOL tmpbDevice = FALSE;

if (hw == CBN_SELCHANGE)

{

nWipeMode = (WipeAlgorithmId) SendMessage (GetDlgItem (hCurPage, IDC_WIPE_MODE),

SendMessage (GetDlgItem (hCurPage, IDC_WIPE_MODE), CB_GETCURSEL, 0, 0),

0);

for (c = EAGetLastCipher (nVolumeEA); c != 0; c = EAGetPreviousCipher (nVolumeEA, c))

{

GetParent (hwndDlg), (DLGPROC) CipherTestDialogProc, (LPARAM) c);

}

return 1;

if (lw == IDC_BENCHMARK && nCurPageNo == CIPHER_PAGE)

{

// Reduce CPU load

bRandmixEnabled = FALSE;

DialogBoxParamW (hInst,

if (hw == CBN_EDITCHANGE && nCurPageNo == VOLUME_LOCATION_PAGE)

{

GetWindowTextLength (GetDlgItem (hCurPage, IDC_COMBO_BOX)) > 0);

bDeviceTransformModeChoiceMade = FALSE;

return 1;

}

if (hw == CBN_SELCHANGE && nCurPageNo == VOLUME_LOCATION_PAGE)

{

LPARAM nIndex;

return 1;

}

if (hw == EN_CHANGE && nCurPageNo == SIZE_PAGE)

{

VerifySizeAndUpdate (hwndDlg, FALSE);

return 1;

}

if (hw == EN_CHANGE && nCurPageNo == PASSWORD_PAGE)

{

VerifyPasswordAndUpdate (hwndDlg, GetDlgItem (GetParent (hwndDlg), IDC_NEXT),

}

return 1;

}

|| nCurPageNo == NONSYS_INPLACE_ENC_RESUME_PASSWORD_PAGE)

{

if (lw == IDC_KEY_FILES)

bHiddenVolDirect = FALSE;

return 1;

}

if (hw == CBN_SELCHANGE && nCurPageNo == CIPHER_PAGE)

{

switch (lw)

if (bSparseFileSwitch)

{

if (AskWarnYesNo("CONFIRM_SPARSE_FILE", MainDlg) == IDNO)

}

else

{

if (AskWarnYesNo("WARN_QUICK_FORMAT", MainDlg) == IDNO)

}

return 1;

}

SetWindowText (GetDlgItem (hCurPage, IDC_DISK_KEY), showKeys ? L"" : L"******************************** ");

return 1;

}

&& (nCurPageNo == SYSENC_COLLECTING_RANDOM_DATA_PAGE || nCurPageNo == NONSYS_INPLACE_ENC_RAND_DATA_PAGE))

{

showKeys = IsButtonChecked (GetDlgItem (hCurPage, IDC_DISPLAY_POOL_CONTENTS));

return 1;

}

|| nCurPageNo == DEVICE_WIPE_MODE_PAGE)

&& hw == CBN_SELCHANGE)

{

nWipeMode = (WipeAlgorithmId) SendMessage (GetDlgItem (hCurPage, IDC_WIPE_MODE),

SendMessage (GetDlgItem (hCurPage, IDC_WIPE_MODE), CB_GETCURSEL, 0, 0),

0);

if (IsTrueCryptInstallerRunning())

AbortProcess ("TC_INSTALLER_IS_RUNNING");

if (ScreenDPI != USER_DEFAULT_SCREEN_DPI)

{

hbmWizardBitmapRescaled = RenderBitmap (MAKEINTRESOURCE (IDB_WIZARD),

if (CmdVolumePassword.Length == 0)

AbortProcess ("ERR_PASSWORD_MISSING");

if (CmdVolumeFileSize == 0)

AbortProcess ("ERR_SIZE_MISSING");

handleWin32Error (hwndDlg, SRC_POS);

exit (1);

}

if (CmdSparseFileSwitch)

{

/* Check if the host file system supports sparse files */

dataAreaSize = GetVolumeDataAreaSize (bHiddenVol && !bHiddenVolHost, nVolumeSize);

(dataAreaSize < TC_MIN_NTFS_FS_SIZE || dataAreaSize > TC_MAX_NTFS_FS_SIZE)

)

{

AbortProcess ("ERR_NTFS_INVALID_VOLUME_SIZE");

}

(dataAreaSize < TC_MIN_EXFAT_FS_SIZE || dataAreaSize > TC_MAX_EXFAT_FS_SIZE)

)

{

AbortProcess ("ERR_EXFAT_INVALID_VOLUME_SIZE");

}

(dataAreaSize < TC_MIN_FAT_FS_SIZE || dataAreaSize > (TC_MAX_FAT_SECTOR_COUNT * GetFormatSectorSize()))

)

{

}

if (volumePassword.Length > 0)

// Check password length (check also done for outer volume which is not the case in TrueCrypt).

if (!CheckPasswordLength (NULL, volumePassword.Length, volumePim, FALSE, Silent, Silent))

{

{

// Availability of in-place encryption (which is pre-selected by default whenever

// possible) makes partition-hosted volume creation safer.

}

#ifdef _DEBUG

{

e.Show (hwndDlg);

}

ManageStartupSeqWiz (TRUE, L"");

ChangeSystemEncryptionStatus (SYSENC_STATUS_NONE);

if (bHiddenOS && IsHiddenOSRunning())

{

DecoySystemWipeStatus decoySysPartitionWipeStatus;

StringCbCopyW (deviceName, sizeof(deviceName), szDiskFile);

{

// No drive letter is assigned to the device

MessageBeep (MB_OK);

{

// System encryption/decryption in progress

"SYSTEM_DECRYPTION_DEFER_CONFIRM" : "SYSTEM_ENCRYPTION_DEFER_CONFIRM", MainDlg) == IDYES)

{

if (nCurPageNo == SYSENC_PRETEST_RESULT_PAGE)

{

if (nMultiBoot > 1)

{

if (AskWarnNoYes ("MULTI_BOOT_FOR_ADVANCED_ONLY", hwndDlg) == IDNO)

return 1;

else if (nMultiBoot <= 1)

{

// Single-boot (not creating a hidden OS)

// Skip irrelevant pages

nNewPageNo = CIPHER_PAGE - 1;

}

{

// 2 or more drives contain an OS

}

else if (Get2RadButtonPageAnswer () == 1)

{

// Only 1 drive contains an OS

if (bWholeSysDrive)

{

}

else

{

&& AskWarnNoYes ("EXE_FILE_EXTENSION_CONFIRM", hwndDlg) == IDNO)

{

NormalCursor ();

volumePassword.Length = (unsigned __int32) strlen ((char *) volumePassword.Text);

if (volumePassword.Length > 0)

// Password character encoding

if (SysEncInEffect () && !CheckPasswordCharEncoding (GetDlgItem (hCurPage, IDC_PASSWORD), NULL))

{

if (!GetPassword (hCurPage, IDC_PASSWORD, szRawPassword, sizeof (szRawPassword), TRUE))

return 1;

{

if (KeyFilesEnable)

{

if (bKeyboardLayoutChanged)

{

// Restore the original keyboard layout

Warning ("CANNOT_RESTORE_KEYBOARD_LAYOUT", hwndDlg);

else

bKeyboardLayoutChanged = FALSE;

nNewPageNo = PIM_PAGE;

volumePim = 0;

{

nNewPageNo = SYSENC_COLLECTING_RANDOM_DATA_PAGE - 1; // Skip irrelevant pages

}

nNewPageNo = NONSYS_INPLACE_ENC_RAND_DATA_PAGE - 1; // Skip irrelevant pages

}

else if (WizardMode != WIZARD_MODE_SYS_DEVICE

|| CreatingHiddenSysVol()) // If we're creating a hidden volume for a hidden OS, we don't need to format it with any filesystem (the entire OS will be copied to the hidden volume sector by sector).

{

nNewPageNo = FORMAT_PAGE - 1; // Skip irrelevant pages

}

if (volumePassword.Length > 0)

// Password character encoding

if (SysEncInEffect() && (volumePim > MAX_BOOT_PIM_VALUE))

{

}

}

{

nNewPageNo = SYSENC_COLLECTING_RANDOM_DATA_PAGE - 1; // Skip irrelevant pages

nNewPageNo = NONSYS_INPLACE_ENC_RAND_DATA_PAGE - 1; // Skip irrelevant pages

}

else if (WizardMode != WIZARD_MODE_SYS_DEVICE

|| CreatingHiddenSysVol()) // If we're creating a hidden volume for a hidden OS, we don't need to format it with any filesystem (the entire OS will be copied to the hidden volume sector by sector).

{

nNewPageNo = FORMAT_PAGE - 1; // Skip irrelevant pages

{

KeyFilesApply (hwndDlg, &volumePassword, FirstKeyFile, NULL);

}

if (!bInPlaceEncNonSys)

{

WaitCursor ();

// scan the volume bitmap

if (!IsAdmin () && IsUacSupported ())

retCode = UacAnalyzeHiddenVolumeHost (hwndDlg, &hiddenVolHostDriveNo, GetVolumeDataAreaSize (FALSE, nHiddenVolHostSize), &realClusterSize, &nbrFreeClusters);

{

hiddenVolHostDriveNo = -1;

bHiddenVolFinished = FALSE;

// Clear the outer volume password

/* Scan all available partitions to discover all partitions where non-system in-place

encryption/decryption has been interrupted. */

NormalCursor ();

}

else

{

We will try to mount it using the backup header, which we require to work (i.e. be non-damaged) before we start writing

backup header will contain the only copy of the master key). */

int driveNo = -1;

if (IsMountedVolume (szFileName))

{

driveNo = GetMountedVolumeDriveNo (szFileName);

if (nNeedToStoreFilesOver4GB != Get2RadButtonPageAnswer())

fileSystem = FILESYS_NONE; // The user may have gone back and changed the answer, so default file system must be reselected

nNeedToStoreFilesOver4GB = Get2RadButtonPageAnswer();

nNewPageNo = FORMAT_PAGE - 1; // Skip irrelevant pages

{

wchar_t szTmp[8000];

IsWindowsIsoBurnerAvailable () ? L"" : GetString ("RESCUE_DISK_CHECK_FAILED_SENTENCE_APPENDIX"));

ErrorDirect (szTmp, hwndDlg);

else if (nCurPageNo == SYSENC_WIPE_MODE_PAGE

|| nCurPageNo == NONSYS_INPLACE_ENC_WIPE_MODE_PAGE)

{

&& AskWarnYesNo ("WIPE_MODE_WARN", hwndDlg) == IDNO)

return 1;

}

return 1;

bConfirmQuitSysEncPretest = TRUE;

if (!bHiddenOS) // This text is not tailored to hidden OS

TextInfoDialogBox (TC_TBXID_SYS_ENCRYPTION_PRETEST);

/* Add the main TrueCrypt app to the system startup sequence (the TrueCrypt Background Task), which

inconsistent hidden OS installs (TrueCrypt upgraded in the decoy system but not in the hidden one), etc.

Note that this must be done before calling ChangeSystemEncryptionStatus(), which broadcasts the change,

so that the main app (if it's running with different cached settings) will not overwrite our new

if (bHiddenOS)

{

/* When we are going to create a hidden OS, the system encryption status is set

configuration file and its properties somehow leaks somewhere outside the system

partition (which will be wiped later on) indicating that a hidden OS has been created

on the computer. Instead, we update our raw config flags in the master boot record

BOOL bDrvLetterAssignResult = FALSE;

int tmpDriveLetter = (int) SendMessage (GetDlgItem (hCurPage, IDC_DRIVE_LETTER_LIST),

SendMessage (GetDlgItem (hCurPage, IDC_DRIVE_LETTER_LIST), CB_GETCURSEL, 0, 0),

0);

szDriveLetter,

szDiskFile);

{

if (SetVolumeMountPoint (rootPath, uniqVolName) == 0)

bDrvLetterAssignResult = FALSE;

if (bVolTransformThreadRunning || bVolTransformThreadToRun)

return 1;

bVolTransformThreadCancel = FALSE;

bVolTransformThreadToRun = TRUE;

{

// Creating a non-hidden volume under a hidden OS

{

WarningDirect ((wstring (GetString ("CANNOT_CREATE_NON_HIDDEN_NTFS_VOLUMES_UNDER_HIDDEN_OS"))

+ L"\n\n"

hiddenVolHostDriveNo = -1;

nMaximumHiddenVolSize = 0;

{

if (bHiddenOS && (fileSystem == FILESYS_NTFS)

&& (double) nVolumeSize / GetSystemPartitionSize() < MIN_HIDDENOS_DECOY_PARTITION_SIZE_RATIO_NTFS)

}

else if (bHiddenVol)

{

// whether to create a sparse file, it must be set to FALSE).

}

if (fileSystem == FILESYS_FAT && clusterSize > 0)

{

BOOL fixed = FALSE;

&& nVolumeSize / (clusterSize * GetFormatSectorSize()) > 0x2000000)

{

clusterSize *= 2;

return 1;

// Hidden volume for hidden OS has been created. Now we will prepare our boot loader

try

{

WaitCursor();

/* Hidden volume host successfully mounted as read-only */

// scan the volume bitmap

if (!IsAdmin () && IsUacSupported ())

retCode = UacAnalyzeHiddenVolumeHost (hwndDlg, &hiddenVolHostDriveNo, GetVolumeDataAreaSize (FALSE, nHiddenVolHostSize), &realClusterSize, &nbrFreeClusters);

if (bHiddenOS)

nNewPageNo = SYSENC_HIDDEN_OS_REQ_CHECK_PAGE + 1;

else if (bWholeSysDrive)

else

}

else if (nCurPageNo == SYSENC_MULTI_BOOT_NONWIN_BOOT_LOADER_PAGE)

{

// Skip irrelevant pages.

// Note that we're ignoring nMultiBoot here, as the multi-boot question pages are skipped

// when creating a hidden OS (only a single message box is displayed with requirements).

}

else

{

nNewPageNo = SYSENC_MULTI_BOOT_MODE_PAGE + 1; // Skip irrelevant pages

}

else if (!bHiddenVol)

else if (bHiddenVolHost)

nNewPageNo = HIDDEN_VOL_HOST_PRE_CIPHER_PAGE + 1; // Skip the info on the hidden volume

}

{

if (nNeedToStoreFilesOver4GB != Get2RadButtonPageAnswer())

fileSystem = FILESYS_NONE; // The user may have gone back and changed the answer, so default file system must be reselected

nNeedToStoreFilesOver4GB = Get2RadButtonPageAnswer();

nNewPageNo = (PimEnable? PIM_PAGE : PASSWORD_PAGE) + 1; // Skip PIM page if it is not enabled

if (bKeyboardLayoutChanged)

{

// Restore the original keyboard layout

Warning ("CANNOT_RESTORE_KEYBOARD_LAYOUT", hwndDlg);

else

bKeyboardLayoutChanged = FALSE;

nNewPageNo = FILESYS_PAGE + 1;

}

else

}

}

{ OptionDynamic, L"/dynamic", NULL, FALSE },

{ OptionForce, L"/force", NULL, FALSE },

{ CommandResumeSysEncLogOn, L"/acsysenc", L"/a", TRUE },

{ CommandResumeSysEnc, L"/csysenc", L"/c", TRUE },

{ CommandDecryptSysEnc, L"/dsysenc", L"/d", TRUE },

{ CommandEncDev, L"/encdev", L"/e", TRUE },

{ CommandResumeNonSysInplaceLogOn, L"/prinplace", L"/p", TRUE },

{ CommandInplaceDec, L"/inplacedec", NULL, TRUE },

{ CommandResumeInplaceDec, L"/resumeinplacedec",NULL, TRUE },

{ CommandResumeInplace, L"/zinplace", L"/z", TRUE }

as.args = args;

as.arg_cnt = sizeof(args)/ sizeof(args[0]);

x = GetArgumentID (&as, lpszCommandLineArgs[i]);

switch (x)

if (iLen > 0)

CmdVolumePassword.Length = (unsigned __int32) (iLen - 1);

else

}

else

AbortProcess ("COMMAND_LINE_ERROR");

{

wchar_t szTmp[32] = {0};

if (HAS_ARGUMENT == GetArgumentValue (lpszCommandLineArgs,

&& (wcslen (szTmp) >= 2)

)

{

szTmp [wcslen (szTmp) - 1] = 0;

CmdVolumeFileSize = _wcstoui64(szTmp, &endPtr, 0);

|| endPtr == szTmp || *endPtr != L'\0')

{

AbortProcess ("COMMAND_LINE_ERROR");

break;

case CommandResumeSysEnc:

// From now on, we should be the only instance of the TC wizard allowed to deal with system encryption

if (CreateSysEncMutex ())

}

}

break;

case OptionTokenLib:

if (GetArgumentValue (lpszCommandLineArgs, &i, nNoCommandLineArgs, SecurityTokenLibraryPath, ARRAYSIZE (SecurityTokenLibraryPath)) == HAS_ARGUMENT)

InitSecurityTokenLibrary(hwndDlg);

// FAT12/FAT16/FAT32

// Retrieve the cluster size

// Get the map of the clusters that are free and in use on the outer volume.

// The map will be scanned to determine the size of the uninterrupted block of free

if (bIsNtfs && bHiddenVolDirect && GetVolumeDataAreaSize (FALSE, hiddenVolHostSize) <= TC_MAX_FAT_SECTOR_COUNT * GetFormatSectorSize())

Info ("HIDDEN_VOL_HOST_NTFS", hwndDlg);

&dwTotalNumberOfClusters))

{

handleWin32Error (hwndDlg, SRC_POS);

&lpInBuffer,

sizeof(lpInBuffer),

lpOutBuffer,

&lBytesReturned,

NULL))

{

rmnd = (BYTE) (lpOutBuffer->BitmapSize.QuadPart % 8);

&& ((lpOutBuffer->Buffer[lpOutBuffer->BitmapSize.QuadPart / 8] & ((1 << rmnd)-1) ) != 0))

{

*nbrFreeClusters = 0;

{

if (lpOutBuffer->Buffer[bitmapCnt] != 0)

{

// These are ignored because there is always a cluster reserve added anyway.

break;

}

}

// Tasks that need to be performed after the WM_INITDIALOG message for the SYSENC_ENCRYPTION_PAGE dialog is

static void AfterSysEncProgressWMInitTasks (HWND hwndDlg)

{

try

}

// For example, any tasks that may invoke the UAC prompt (otherwise the UAC dialog box would not be on top).

static void AfterWMInitTasks (HWND hwndDlg)

{

}

else if (bDirectSysEncMode)

{

// SystemEncryptionStatus is SYSENC_STATUS_ENCRYPTING or SYSENC_STATUS_DECRYPTING, the

// system drive is not 'mounted' and drive filter is active. Possible causes: 1) The drive had

// been decrypted in the pre-boot environment. 2) The OS is not located on the lowest partition,

// system partition and then pressed Esc in the boot loader screen. 3) Corrupted or stale config

// file. 4) Damaged system.

Warning ("SYSTEM_ENCRYPTION_SCHEDULED_BUT_PBA_FAILED", hwndDlg);

EndMainDlg (MainDlg);

return;

{

// If the config file with status was lost or not written correctly, we

// don't know whether to encrypt or decrypt (but we know that encryption or

// or cancel

if (!ResolveUnknownSysEncDirection ())

{

if (SysEncryptionOrDecryptionRequired ())

{

// System partition/drive encryption process already initiated but is incomplete.

// the process and start encrypting.

ChangeSystemEncryptionStatus (SYSENC_STATUS_ENCRYPTING);

}

else if ((SystemEncryptionStatus == SYSENC_STATUS_NONE || SystemEncryptionStatus == SYSENC_STATUS_DECRYPTING)

&& (BootEncStatus.DriveMounted || BootEncStatus.VolumeHeaderPresent))

{

// The pretest may have been in progress but we can't be sure (it is not in the config file).

// Another possibility is that the user had finished decrypting the drive, but the config file

// deinstall. Otherwise, the result might be some kind of deadlock.

if (CreateSysEncMutex ()) // If no other instance is currently taking care of system encryption

if (bDirectSysEncMode && CreateSysEncMutex ())

{

// creation phase actually) and possible inconsistencies.

switch (SystemEncryptionStatus)

{

// The hidden OS has been booted for the first time since the user started installing a

// new decoy OS (presumably, our MBR config flags have been erased).

// As for things we are responsible for, the process of hidden OS creation is completed

// (the rest is up to the user).

ChangeSystemEncryptionStatus (SYSENC_STATUS_NONE);

EndMainDlg (MainDlg);

return;

}

{

BOOL bAnswerTerminate = FALSE, bAnswerRetry = FALSE;

or hidden OS cloning has been interrupted (and non-hidden OS is running)

or wiping of the original OS has not been started (and non-hidden OS is running) */

else

{

// Hidden OS cloning was interrupted or wiping of the original OS has not been started

char *tmpStr[] = {0,

hiddenOSCreationPhase == TC_HIDDEN_OS_CREATION_PHASE_WIPING ? "OS_WIPING_NOT_FINISHED_ASK" : "HIDDEN_OS_CREATION_NOT_FINISHED_ASK",

"HIDDEN_OS_CREATION_NOT_FINISHED_CHOICE_RETRY",

// We re-register the driver for boot because the user may have selected

// "Last Known Good Configuration" from the Windows boot menu.

// the hidden OS needs our boot driver and it will be a clone of this OS).

try

{

EndMainDlg (MainDlg);

return;

}

{

// User doesn't want to take any action now

if (Randinit ())

{

DWORD dwLastError = GetLastError ();

if (CryptoAPILastError == ERROR_SUCCESS)

StringCbPrintfW (szTmp, sizeof(szTmp), GetString ("INIT_RAND"), SRC_POS, dwLastError);

else

AbortProcess ("ERR_SELF_TESTS_FAILED");

/* Create the main dialog box */

(LPARAM)lpszCommandLine);

FinalizeApp ();