Copyright (c) 2008-2012 TrueCrypt Developers Association and which is governed

by the TrueCrypt License 3.0.

and all other portions of this file are Copyright (c) 2013-2016 IDRIX

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

#define TC_SET_BOOT_ARGUMENTS_SIGNATURE(SG) do { SG[0] = 'T'; SG[1] = 'R'; SG[2] = 'U'; SG[3] = 'E'; SG[4] = 0x11; SG[5] = 0x23; SG[6] = 0x45; SG[7] = 0x66; } while (FALSE)

#define TC_IS_BOOT_ARGUMENTS_SIGNATURE(SG) (SG[0] == 'T' && SG[1] == 'R' && SG[2] == 'U' && SG[3] == 'E' && SG[4] == 0x11 && SG[5] == 0x23 && SG[6] == 0x45 && SG[7] == 0x66)

#endif // TC_HEADER_Boot_BootCommon

#define TC__BOOT_USER_CFG_FLAG_DISABLE_ESC TC_HEX (02)

#define TC__BOOT_USER_CFG_FLAG_DISABLE_HW_ENCRYPTION TC_HEX (04)

#define TC__BOOT_USER_CFG_FLAG_DISABLE_PIM TC_HEX (08)

// The following items are treated as a 2-bit value (apply TC_BOOT_CFG_MASK_HIDDEN_OS_CREATION_PHASE to obtain the value)

#define TC__HIDDEN_OS_CREATION_PHASE_NONE 0

#define TC_BOOT_USER_CFG_FLAG_DISABLE_ESC TC__BOOT_USER_CFG_FLAG_DISABLE_ESC

#define TC_BOOT_USER_CFG_FLAG_DISABLE_HW_ENCRYPTION TC__BOOT_USER_CFG_FLAG_DISABLE_HW_ENCRYPTION

#define TC_BOOT_USER_CFG_FLAG_DISABLE_PIM TC__BOOT_USER_CFG_FLAG_DISABLE_PIM

#define TC_HIDDEN_OS_CREATION_PHASE_NONE TC__HIDDEN_OS_CREATION_PHASE_NONE

#define TC_HIDDEN_OS_CREATION_PHASE_CLONING TC__HIDDEN_OS_CREATION_PHASE_CLONING

#define TC_HIDDEN_OS_CREATION_PHASE_WIPING TC__HIDDEN_OS_CREATION_PHASE_WIPING

#endif // TC_ASM_PREPROCESS

#endif // TC_HEADER_Boot_BootDefs

IDR_RESCUE_LOADER_SERPENT_SHA2 BIN "..\\Boot\\Windows\\Rescue_Serpent_SHA2\\BootLoader.com.gz"

IDR_RESCUE_LOADER_TWOFISH_SHA2 BIN "..\\Boot\\Windows\\Rescue_Twofish_SHA2\\BootLoader.com.gz"

IDR_RESCUE_LOADER_CAMELLIA_SHA2 BIN "..\\Boot\\Windows\\Rescue_Camellia_SHA2\\BootLoader.com.gz"

/////////////////////////////////////////////////////////////////////////////

//

// TEXTINCLUDE

//

BEGIN

"resource.h\0"

END

BEGIN

"#include ""afxres.h""\r\n"

"\0"

END

BEGIN

"\r\n"

"\0"

/*

Legal Notice: Some portions of the source code contained in this file were

governed by the TrueCrypt License 3.0, also from the source code of

Encryption for the Masses 2.02a, which is Copyright (c) 1998-2000 Paul Le Roux

and all other portions of this file are Copyright (c) 2013-2016 IDRIX

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

#include "Xts.h"

#include "Crc.h"

#include "Common/Endian.h"

#include <string.h>

#ifndef TC_WINDOWS_BOOT

#include "EncryptionThreadPool.h"

#endif

#include "Volumes.h"

#include "cpu.h"

#ifndef TC_WINDOWS_BOOT

#if defined(CIPHER_GOST89)

#endif // defined(CIPHER_GOST89)

{ { KUZNYECHIK, 0 }, { XTS, 0 }, 1 },

{ { SERPENT, TWOFISH, AES, 0 }, { XTS, 0 }, 1 },

{ { AES, TWOFISH, SERPENT, 0 }, { XTS, 0 }, 1 },

{ { SERPENT, TWOFISH, 0 }, { XTS, 0 }, 1 },

#else // TC_WINDOWS_BOOT

#ifndef TC_WINDOWS_BOOT

// Hash algorithms

static Hash Hashes[] =

{ STREEBOG, L"Streebog", FALSE, FALSE },

{ 0, 0, 0 }

};

case SERPENT:

serpent_set_key (key, ks);

break;

case TWOFISH:

twofish_set_key ((TwofishInstance *)ks, (const u4byte *)key);

break;

#if !defined (TC_WINDOWS_BOOT) || defined (TC_WINDOWS_BOOT_CAMELLIA)

case CAMELLIA:

camellia_set_key (key, ks);

{

switch (cipher)

{

// In 32-bit kernel mode, due to KeSaveFloatingPointState() overhead, AES instructions can be used only when processing the whole data unit.

#if (defined (_WIN64) || !defined (TC_WINDOWS_DRIVER)) && !defined (TC_WINDOWS_BOOT)

if (IsAesHwCpuSupported())

/* Note: XTS mode could potentially be initialized with a weak key causing all blocks in one data unit

on the volume to be tweaked with zero tweaks (i.e. 512 bytes of the volume would be encrypted in ECB

mode). However, to create a TrueCrypt volume with such a weak key, each human being on Earth would have

that the size of each of the volumes is 1024 terabytes). */

break;

// Unknown/wrong ID

TC_THROW_FATAL_EXCEPTION;

}

do

{

return ea;

}

while (ea = EAGetNext (ea));

int c, i = 0;

while (c = EncryptionAlgorithms[ea].Modes[i++])

{

return EncryptionAlgorithms[ea].Modes[i];

}

int c, i = 0;

while (c = EncryptionAlgorithms[ea].Ciphers[i++])

{

return EncryptionAlgorithms[ea].Ciphers[i];

}

while (c = EncryptionAlgorithms[ea].Ciphers[i++])

{

return EncryptionAlgorithms[ea].Ciphers[i - 2];

}

memset (cryptoInfo, 0, sizeof (CRYPTO_INFO));

VirtualLock (cryptoInfo, sizeof (CRYPTO_INFO));

#endif

if (cryptoInfo != NULL)

{

burn (cryptoInfo, sizeof (CRYPTO_INFO));

VirtualUnlock (cryptoInfo, sizeof (CRYPTO_INFO));

#endif

TCfree (cryptoInfo);

// EncryptBuffer

//

// buf: data to be encrypted; the start of the buffer is assumed to be aligned with the start of a data unit.

// by the largest block size used within the cascade)

void EncryptBuffer (unsigned __int8 *buf, TC_LARGEST_COMPILER_UINT len, PCRYPTO_INFO cryptoInfo)

{

}

break;

// Unknown/wrong ID

TC_THROW_FATAL_EXCEPTION;

}

// unitNo: sequential number of the data unit with which the buffer starts

// nbrUnits: number of data units in the buffer

void EncryptDataUnits (unsigned __int8 *buf, const UINT64_STRUCT *structUnitNo, uint32 nbrUnits, PCRYPTO_INFO ci)

{

EncryptionThreadPoolDoWork (EncryptDataUnitsWork, buf, structUnitNo, nbrUnits, ci);

}

}

break;

// Unknown/wrong ID

TC_THROW_FATAL_EXCEPTION;

}

// DecryptBuffer

//

// buf: data to be decrypted; the start of the buffer is assumed to be aligned with the start of a data unit.

// by the largest block size used within the cascade)

void DecryptBuffer (unsigned __int8 *buf, TC_LARGEST_COMPILER_UINT len, PCRYPTO_INFO cryptoInfo)

{

}

break;

// Unknown/wrong ID

TC_THROW_FATAL_EXCEPTION;

}

// unitNo: sequential number of the data unit with which the buffer starts

// nbrUnits: number of data units in the buffer

void DecryptDataUnits (unsigned __int8 *buf, const UINT64_STRUCT *structUnitNo, uint32 nbrUnits, PCRYPTO_INFO ci)

{

EncryptionThreadPoolDoWork (DecryptDataUnitsWork, buf, structUnitNo, nbrUnits, ci);

}

}

break;

// Unknown/wrong ID

TC_THROW_FATAL_EXCEPTION;

}

if (IsAesHwCpuSupported())

aes_hw_cpu_encrypt ((byte *) ks, data);

else

#elif defined (TC_WINDOWS_BOOT_SERPENT)

serpent_encrypt (data, data, ks);

#elif defined (TC_WINDOWS_BOOT_TWOFISH)

if (IsAesHwCpuSupported())

aes_hw_cpu_decrypt ((byte *) ks + sizeof (aes_encrypt_ctx) + 14 * 16, data);

else

#elif defined (TC_WINDOWS_BOOT_SERPENT)

serpent_decrypt (data, data, ks);

#elif defined (TC_WINDOWS_BOOT_TWOFISH)

/*

Legal Notice: Some portions of the source code contained in this file were

governed by the TrueCrypt License 3.0, also from the source code of

Encryption for the Masses 2.02a, which is Copyright (c) 1998-2000 Paul Le Roux

and all other portions of this file are Copyright (c) 2013-2016 IDRIX

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

#define MASTER_KEYDATA_SIZE 256

// The first PRF to try when mounting

enum

{

SHA512 = FIRST_PRF_ID,

};

// The last PRF to try when mounting and also the number of implemented PRFs

#define RIPEMD160_BLOCKSIZE 64

#define RIPEMD160_DIGESTSIZE 20

{

NONE = 0,

AES,

TWOFISH,

CAMELLIA,

GOST89,

#ifndef TC_WINDOWS_BOOT

uint16 HeaderVersion;

CRYPTOPP_ALIGN_DATA(16) unsigned __int8 master_keydata[MASTER_KEYDATA_SIZE]; /* This holds the volume header area containing concatenated master key(s) and secondary key(s) (XTS mode). For LRW (deprecated/legacy), it contains the tweak key before the master key(s). For CBC (deprecated/legacy), it contains the IV seed before the master key(s). */

CRYPTOPP_ALIGN_DATA(16) unsigned __int8 k2[MASTER_KEYDATA_SIZE]; /* For XTS, this contains the secondary key (if cascade, multiple concatenated). For LRW (deprecated/legacy), it contains the tweak key. For CBC (deprecated/legacy), it contains the IV seed. */

unsigned __int8 salt[PKCS5_SALT_SIZE];

BOOL bTrueCryptMode;

int volumePim;

BOOL bProtectHiddenVolume; // Indicates whether the volume contains a hidden volume to be protected against overwriting

BOOL bHiddenVolProtectionAction; // TRUE if a write operation has been denied by the driver in order to prevent the hidden volume from being overwritten (set to FALSE upon volume mount).

uint64 volDataAreaOffset; // Absolute position, in bytes, of the first data sector of the volume.

uint64 hiddenVolumeSize; // Size of the hidden volume excluding the header (in bytes). Set to 0 for standard volumes.

} CRYPTO_INFO, *PCRYPTO_INFO;

#pragma pack (push)

#pragma pack(1)

/*

Legal Notice: Some portions of the source code contained in this file were

governed by the TrueCrypt License 3.0, also from the source code of

Encryption for the Masses 2.02a, which is Copyright (c) 1998-2000 Paul Le Roux

and all other portions of this file are Copyright (c) 2013-2016 IDRIX

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

{

#endif

# ifndef LITTLE_ENDIAN

# define LITTLE_ENDIAN 1234

( ( unsigned __int32 ) memPtr[ -2 ] << 8 ) | ( unsigned __int32 ) memPtr[ -1 ] )

#define mgetWord(memPtr) \

#define mgetByte(memPtr) \

( ( unsigned char ) *memPtr++ )

unsigned __int32 MirrorBytes32 (unsigned __int32 x);

#ifndef TC_NO_COMPILER_INT64

uint64 MirrorBytes64 (uint64 x);

void LongReverse ( unsigned __int32 *buffer , unsigned byteCount );

#if defined(__cplusplus)

/*

Legal Notice: Some portions of the source code contained in this file were

governed by the TrueCrypt License 3.0, also from the source code of

Encryption for the Masses 2.02a, which is Copyright (c) 1998-2000 Paul Le Roux

and all other portions of this file are Copyright (c) 2013-2016 IDRIX

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

char Pad[3]; // keep 64-bit alignment

} Password;

void VerifyPasswordAndUpdate ( HWND hwndDlg , HWND hButton , HWND hPassword , HWND hVerify , unsigned char *szPassword , char *szVerify, BOOL keyFilesEnabled );

int ChangePwd (const wchar_t *lpszVolume, Password *oldPassword, int old_pkcs5, int old_pim, BOOL truecryptMode, Password *newPassword, int pkcs5, int pim, int wipePassCount, HWND hwndDlg);

#ifdef __cplusplus

}

/*

Legal Notice: Some portions of the source code contained in this file were

governed by the TrueCrypt License 3.0, also from the source code of

Encryption for the Masses 2.02a, which is Copyright (c) 1998-2000 Paul Le Roux

and all other portions of this file are Copyright (c) 2013-2016 IDRIX

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

code distribution packages. */

#include "Tcdefs.h"

#include <memory.h>

#include <stdlib.h>

#include "Rmd160.h"

#ifndef TC_WINDOWS_BOOT

#include "Sha2.h"

char* k = hmac->k;

char* u = hmac->u;

uint32 c;

#ifdef TC_WINDOWS_BOOT

/* In bootloader mode, least significant bit of iterations is a boolean (TRUE for boot derivation mode, FALSE otherwise)

/* iteration 1 */

memcpy (k, salt, salt_len); /* salt */

/* big-endian block number */

memset (&k[salt_len], 0, 3);

k[salt_len + 3] = (char) b;

void derive_key_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, uint32 iterations, char *dk, int dklen)

hmac_sha256_ctx hmac;

sha256_ctx* ctx;

char* buf = hmac.k;

char *k, /* secret key */

int lk, /* length of the key in bytes */

char *d, /* data and also output buffer of at least 64 bytes */

)

{

hmac_sha512_ctx hmac;

/* If the key is longer than the hash algorithm block size,

let key = ripemd160(key), as per HMAC specifications. */

{

RMD160_CTX tctx;

keylen = RIPEMD160_DIGESTSIZE;

burn (&tctx, sizeof(tctx)); // Prevent leaks

/* perform inner RIPEMD-160 */

ctx = &(hmac.inner_digest_ctx);

/* start out by storing key in pads */

memset(k_pad, 0x36, 64);

/* XOR key with ipad and opad values */

{

k_pad[i] ^= key[i];

}

/* perform outer RIPEMD-160 */

ctx = &(hmac.outer_digest_ctx);

memset(k_pad, 0x5c, 64);

{

k_pad[i] ^= key[i];

}

/* iteration 1 */

memcpy (k, salt, salt_len); /* salt */

/* big-endian block number */

memset (&k[salt_len], 0, 3);

k[salt_len + 3] = (char) b;

}

void derive_key_ripemd160 (char *pwd, int pwd_len, char *salt, int salt_len, uint32 iterations, char *dk, int dklen)

int b, l, r;

hmac_ripemd160_ctx hmac;

RMD160_CTX* ctx;

unsigned char tk[RIPEMD160_DIGESTSIZE];

/* If the password is longer than the hash algorithm block size,

let password = ripemd160(password), as per HMAC specifications. */

{

RMD160_CTX tctx;

/* start out by storing key in pads */

memset(k_pad, 0x36, 64);

/* XOR key with ipad and opad values */

{

k_pad[b] ^= pwd[b];

}

/* perform outer RIPEMD-160 */

ctx = &(hmac.outer_digest_ctx);

memset(k_pad, 0x5c, 64);

{

k_pad[b] ^= pwd[b];

}

/* iteration 1 */

memcpy (k, salt, salt_len); /* salt */

/* big-endian block number */

k[salt_len + 3] = (char) b;

hmac_whirlpool_internal (pwd, pwd_len, k, salt_len + 4, hmac);

{

switch (pkcs5_prf_id)

{

return L"HMAC-SHA-512";

return L"HMAC-SHA-256";

return L"HMAC-RIPEMD-160";

return L"HMAC-Whirlpool";

case STREEBOG:

return L"HMAC-STREEBOG";

return L"(Unknown)";

}

}

switch (pkcs5_prf_id)

{

if (truecryptMode)

return bBoot ? 1000 : 2000;

else if (pim == 0)

return bBoot? pim * 2048 : 15000 + pim * 1000;

}

return truecryptMode? 1000 : ((pim == 0)? 500000 : 15000 + pim * 1000);

return truecryptMode? 1000 : ((pim == 0)? 500000 : 15000 + pim * 1000);

case SHA256:

return bBoot? pim * 2048 : 15000 + pim * 1000;

}

if (truecryptMode)

return 1000;

else if (pim == 0)

return bBoot? pim * 2048 : 15000 + pim * 1000;

}

TC_THROW_FATAL_EXCEPTION; // Unknown/wrong ID

}

return 0;

#define IDR_BOOT_LOADER_CAMELLIA_SHA2 563

#define IDR_RESCUE_BOOT_SECTOR_CAMELLIA_SHA2 564

#define IDR_RESCUE_LOADER_CAMELLIA_SHA2 565

#define IDC_HW_AES_LABEL_LINK 5000

#define IDC_HW_AES 5001

#define IDC_PARALLELIZATION_LABEL_LINK 5002

#define IDC_BENCHMARK_PREBOOT 5140

// Next default values for new objects

#ifdef APSTUDIO_INVOKED

#ifndef APSTUDIO_READONLY_SYMBOLS

#define _APS_NO_MFC 1

#define _APS_NEXT_COMMAND_VALUE 40001

#define _APS_NEXT_CONTROL_VALUE 5141

#define _APS_NEXT_SYMED_VALUE 101

#ifndef TCDEFS_H

#define TCDEFS_H

#define TC_APP_NAME "VeraCrypt"

// Version displayed to user

#define LL(x) x##ui64

#endif

#else // !_MSC_VER

#include <inttypes.h>

#define __has_builtin(x) 0 // Compatibility with non-clang compilers

#endif

#ifdef TC_WINDOWS_BOOT

# ifdef __cplusplus

# define TC_THROW_FATAL_EXCEPTION ThrowFatalException (__LINE__)

#elif defined (TC_WINDOWS_DRIVER)

# define TC_THROW_FATAL_EXCEPTION KeBugCheckEx (SECURITY_SYSTEM, __LINE__, 0, 0, 'VC')

#elif (defined(__clang__) && __has_builtin(__builtin_trap)) \

|| (defined(__GNUC__ ) && (__GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 3))) \

|| (__has_builtin(__builtin_trap))

#endif

#else /* !TC_WINDOWS_DRIVER */

#define TCalloc malloc

#define TCfree free

#ifdef _WIN32

# define trace_msg Dump

# elif defined (_WIN32)

# define trace_msg(...) do { char msg[2048]; StringCbPrintfA (msg, sizeof (msg), __VA_ARGS__); OutputDebugString (msg); } while (0)

# endif

# define trace_point trace_msg (__FUNCTION__ ":" TC_TO_STRING(__LINE__) "\n")

# else

# define TC_WAIT_EVENT(EVENT) WaitForSingleObject (EVENT, INFINITE)

#endif

#define burn(mem,size) do { volatile char *burnm = (volatile char *)(mem); size_t burnc = size; RtlSecureZeroMemory (mem, size); while (burnc--) *burnm++ = 0; } while (0)

#else

#define burn(mem,size) do { volatile char *burnm = (volatile char *)(mem); int burnc = size; while (burnc--) *burnm++ = 0; } while (0)

# define max(a,b) (((a) > (b)) ? (a) : (b))

# endif

extern "C"

# endif

void EraseMemory (void *memory, int size);

code distribution packages. */

#include "Tcdefs.h"

#include <fcntl.h>

#include <sys/types.h>

#include <sys/stat.h>

#ifndef DEVICE_DRIVER

#include "Random.h"

#endif

#include "Crc.h"

#include "Crypto.h"

#include "Volumes.h"

#include "Pkcs5.h"

#include <Strsafe.h>

#include "../Boot/Windows/BootCommon.h"

#endif

uint16 headerVersion;

int status = ERR_PARAMETER_INCORRECT;

int primaryKeyOffset;

TC_EVENT keyDerivationCompletedEvent;

TC_EVENT noOutstandingWorkItemEvent;

KeyDerivationWorkItem *keyDerivationWorkItems;

KeyDerivationWorkItem *item;

size_t encryptionThreadCount = GetEncryptionThreadCount();

LONG outstandingWorkItemCount = 0;

int i;

// if no PIM specified, use default value

if (pim < 0)

if (cryptoInfo == NULL)

return ERR_OUTOFMEMORY;

}

/* use thread pool only if no PRF was specified */

if ((selected_pkcs5_prf == 0) && (encryptionThreadCount > 1))

{

#endif

}

VirtualLock (&keyInfo, sizeof (keyInfo));

VirtualLock (&dk, sizeof (dk));

#endif

crypto_loadkey (&keyInfo, password->Text, (int) password->Length);

// skip SHA-256 in case of TrueCrypt mode

if (truecryptMode && (enqPkcs5Prf == SHA256))

continue;

if ((selected_pkcs5_prf == 0) && (encryptionThreadCount > 1))

{

// Enqueue key derivation on thread pool

KeyReady: ;

}

else

{

pkcs5_prf = enqPkcs5Prf;

keyInfo.noIterations = get_pkcs5_iteration_count (enqPkcs5Prf, pim, truecryptMode, bBoot);

burn (&keyInfo, sizeof (keyInfo));

burn (dk, sizeof(dk));

VirtualUnlock (&keyInfo, sizeof (keyInfo));

VirtualUnlock (&dk, sizeof (dk));

#endif

if ((selected_pkcs5_prf == 0) && (encryptionThreadCount > 1))

{

TC_WAIT_EVENT (noOutstandingWorkItemEvent);

burn (keyDerivationWorkItems, sizeof (KeyDerivationWorkItem) * pkcs5PrfCount);

TCfree (keyDerivationWorkItems);

CloseHandle (keyDerivationCompletedEvent);

CloseHandle (noOutstandingWorkItemEvent);

#endif

}

return status;

}

void ComputeBootloaderFingerprint (byte *bootLoaderBuf, unsigned int bootLoaderSize, byte* fingerprint)

{

// compute Whirlpool+SHA512 fingerprint of bootloader including MBR

#endif

// Creates a volume header in memory

int CreateVolumeHeaderInMemory (HWND hwndDlg, BOOL bBoot, char *header, int ea, int mode, Password *password,

int pkcs5_prf, int pim, char *masterKeydata, PCRYPTO_INFO *retInfo,

unsigned __int64 volumeSize, unsigned __int64 hiddenVolumeSize,

unsigned __int64 encryptedAreaStart, unsigned __int64 encryptedAreaLength, uint16 requiredProgramVersion, uint32 headerFlags, uint32 sectorSize, BOOL bWipeMode)

{

unsigned char *p = (unsigned char *) header;

static CRYPTOPP_ALIGN_DATA(16) KEY_INFO keyInfo;

pim = 0;

memset (header, 0, TC_VOLUME_HEADER_EFFECTIVE_SIZE);

VirtualLock (&keyInfo, sizeof (keyInfo));

VirtualLock (&dk, sizeof (dk));

/* Encryption setup */

bytesNeeded = EAGetKeySize (ea) * 2; // Size of primary + secondary key(s)

}

if (!RandgetBytes (hwndDlg, keyInfo.master_keydata, bytesNeeded, TRUE))

{

crypto_close (cryptoInfo);

return ERR_CIPHER_INIT_WEAK_KEY;

cryptoInfo->mode = mode;

// Salt for header key derivation

{

crypto_close (cryptoInfo);

return ERR_CIPHER_INIT_WEAK_KEY;

else

{

// generate a random key

if (!RandgetBytes(hwndDlg, dk, GetMaxPkcs5OutSize(), !bWipeMode))

{

crypto_close (cryptoInfo);

return ERR_CIPHER_INIT_WEAK_KEY;

return 0;

}

BOOL ReadEffectiveVolumeHeader (BOOL device, HANDLE fileHandle, byte *header, DWORD *bytesRead)

{

#if TC_VOLUME_HEADER_EFFECTIVE_SIZE > TC_MAX_VOLUME_SECTOR_SIZE

return nStatus;

}

#endif // !defined (DEVICE_DRIVER) && !defined (TC_WINDOWS_BOOT)

/*

Legal Notice: Some portions of the source code contained in this file were

governed by the TrueCrypt License 3.0, also from the source code of

Encryption for the Masses 2.02a, which is Copyright (c) 1998-2000 Paul Le Roux

and all other portions of this file are Copyright (c) 2013-2016 IDRIX

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

#endif

// Volume header version

// Version number written to volume header during format;

// specifies the minimum program version required to mount the volume

#define HEADER_SALT_OFFSET 0

#define HEADER_ENCRYPTED_DATA_OFFSET PKCS5_SALT_SIZE

#define HEADER_MASTER_KEYDATA_OFFSET 256

#define TC_HEADER_OFFSET_MAGIC 64

#define TC_HEADER_OFFSET_VERSION 68

#define TC_HEADER_OFFSET_REQUIRED_VERSION 70

uint16 GetHeaderField16 (byte *header, int offset);

uint32 GetHeaderField32 (byte *header, int offset);

UINT64_STRUCT GetHeaderField64 (byte *header, int offset);

int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, int pim, PCRYPTO_INFO *retInfo, CRYPTO_INFO *retHeaderCryptoInfo);

#else

int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, int pkcs5_prf, int pim, BOOL truecryptMode, PCRYPTO_INFO *retInfo, CRYPTO_INFO *retHeaderCryptoInfo);

void ComputeBootloaderFingerprint (byte *bootLoaderBuf, unsigned int bootLoaderSize, byte* fingerprint);

#endif

#endif

int CreateVolumeHeaderInMemory (HWND hwndDlg, BOOL bBoot, char *encryptedHeader, int ea, int mode, Password *password, int pkcs5_prf, int pim, char *masterKeydata, PCRYPTO_INFO *retInfo, unsigned __int64 volumeSize, unsigned __int64 hiddenVolumeSize, unsigned __int64 encryptedAreaStart, unsigned __int64 encryptedAreaLength, uint16 requiredProgramVersion, uint32 headerFlags, uint32 sectorSize, BOOL bWipeMode);

BOOL ReadEffectiveVolumeHeader (BOOL device, HANDLE fileHandle, byte *header, DWORD *bytesRead);

BOOL WriteEffectiveVolumeHeader (BOOL device, HANDLE fileHandle, byte *header);

contained in the file License.txt included in VeraCrypt binary and source

code distribution packages.

*/

#include <windows.h>

#include <stdio.h>

#include "Xml.h"

}

{

char attr[2048];

}

{

char *t = xmlNode;

char *e = xmlNode;

if (t == NULL || t > e) return NULL;

e = strchr (t, '"');

l = (int)(e - t);

if (e == NULL || l > xmlAttrValueSize) return NULL;

if (t[0] != '<')

return NULL;

if (t == NULL) return NULL;

t++;

return textDst;

}

int XmlWriteHeader (FILE *file)

{

return fputws (L"<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<VeraCrypt>", file);

{

return fputws (L"\n</VeraCrypt>", file);

}

Copyright (c) 2008-2012 TrueCrypt Developers Association and which is governed

by the TrueCrypt License 3.0.

and all other portions of this file are Copyright (c) 2013-2016 IDRIX

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

char *XmlNextNode (char *xmlNode);

char *XmlFindElement (char *xmlNode, char *nodeName);

char *XmlGetNodeText (char *xmlNode, char *xmlText, int xmlTextSize);

char *XmlQuoteText (const char *textSrc, char *textDst, int textDstMaxSize);

wchar_t *XmlQuoteTextW (const wchar_t *textSrc, wchar_t *textDst, int textDstMaxSize);

#ifdef __cplusplus

}

#endif

/* Adapted for TrueCrypt */

/* Adapted for VeraCrypt */

#include <memory.h>

#include "Common/Tcdefs.h"

#include "Common/Endian.h"

#include "Rmd160.h"

#define G(x, y, z) (z ^ (x & (y^z)))

#define H(x, y, z) (z ^ (x | ~y))

#define I(x, y, z) (y ^ (z & (x^y)))

Subround(J, b2, c2, d2, e2, a2, X[ 3], 12, k5);

Subround(J, a2, b2, c2, d2, e2, X[12], 6, k5);

Subround(I, d2, e2, a2, b2, c2, X[11], 13, k6);

Subround(I, c2, d2, e2, a2, b2, X[ 3], 15, k6);

Subround(I, b2, c2, d2, e2, a2, X[ 7], 7, k6);

Copyright (c) 2008-2012 TrueCrypt Developers Association and which is governed

by the TrueCrypt License 3.0.

and all other portions of this file are Copyright (c) 2013-2016 IDRIX

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

for (pos = 0; pos < 160; ++pos)

{

tmp = a + data[OrderTab[pos]] + KTab[pos >> 4];

switch (pos >> 4)

{

case 0: case 9: tmp += F (b, c, d); break;

#include "Crypto/misc.h"

#endif

#include <memory.h>

// linear transformation

#define LT(i,a,b,c,d,e) {\

*/

#include "Common/Endian.h"

#include "Crypto/misc.h"

#define PLATFORM_BYTE_ORDER BYTE_ORDER

#define IS_LITTLE_ENDIAN LITTLE_ENDIAN

#define UNROLL_SHA2 /* for SHA2 loop unroll */

#endif

#include <string.h> /* for memcpy() etc. */

#include "Sha2.h"

{

#endif

#pragma intrinsic(memcpy)

#endif

* ``The Whirlpool hashing function,''

* NESSIE submission, 2000 (tweaked version, 2001),

* <https://www.cosic.esat.kuleuven.ac.be/nessie/workshop/submissions/whirlpool.zip>

* @author Paulo S.L.M. Barreto

* @author Vincent Rijmen.

*

*

*/

#include "Common/Endian.h"

#include "cpu.h"

#include "Whirlpool.h"

/*

AS2( and esp, -16)

AS2( sub esp, 16*8)

AS_PUSH_IF86( ax)

#if CRYPTOPP_BOOL_X86

#define SSE2_workspace esp+WORD_SZ

#elif CRYPTOPP_BOOL_X32

*/

void WHIRLPOOL_add(const unsigned char * input,

unsigned __int32 sourceBytes,

{

uint64 num, oldCountLo = ctx->countLo, oldCountHi = ctx->countHi;

uint64 len = sourceBytes;

else

{

uint64* dataBuf = ctx->data;

num = oldCountLo & 63;

if (num != 0) // process left over data

/**

* Get the hash value from the hashing state.

* This method uses the invariant: bufferBits < DIGESTBITS

*/

void WHIRLPOOL_finalize(WHIRLPOOL_CTX * const ctx,

{

unsigned int num = ctx->countLo & 63;

uint64* dataBuf = ctx->data;

int CpuId(uint32 input, uint32 output[4])

{

#ifdef CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY

__try

{

__asm

{

mov eax, input

mov [edi+8], ecx

mov [edi+12], edx

}

{

return 0;

}

// function 0 returns the highest basic function understood in EAX

if(input == 0)

{

#if CRYPTOPP_BOOL_X64

return 1;

volatile int result = 1;

#if defined (TC_WINDOWS_DRIVER) && !defined (_WIN64)

KFLOATING_SAVE floatingPointState;

return 0;

#endif

return result;

// longjmp and clobber warnings. Volatile is required.

// http://github.com/weidai11/cryptopp/issues/24

// http://stackoverflow.com/q/7721854

signal(SIGILL, oldHandler);

return result;

#endif

}

(output[3] /*EDX*/ == 0x444D4163);

}

static int TryAESNI ()

{

g_hasAESNI = g_hasSSE2 && (cpuid1[2] & (1<<25));

g_hasCLMUL = g_hasSSE2 && (cpuid1[2] & (1<<1));

// Hypervisor = bit 31 of ECX of CPUID leaf 0x1

// reference: http://artemonsecurity.com/vmde.pdf

if (!g_hasAESNI && (cpuid1[2] & (1<<31)))

{

if (cpuid[2] & (1<<25))

bHasAESNI = 1;

// Hypervisor = bit 31 of ECX of CPUID leaf 0x1

// reference: http://artemonsecurity.com/vmde.pdf

if (!bHasAESNI && (cpuid[2] & (1<<31)))

#else

#if CRYPTOPP_BOOL_SSE2_INTRINSICS_AVAILABLE

#if defined(__cplusplus)

extern "C" {

#endif

#if CRYPTOPP_BOOL_AESNI_INTRINSICS_AVAILABLE

#if defined(__SSSE3__) || defined(__INTEL_COMPILER)

#if defined(__cplusplus)

extern "C" {

#endif

#endif

#if defined(__SSE4_1__) || defined(__INTEL_COMPILER) || defined(_MSC_VER)

#if defined(__cplusplus)

extern "C" {

#endif

#endif

#if (defined(__AES__) && defined(__PCLMUL__)) || defined(__INTEL_COMPILER) || CRYPTOPP_BOOL_AESNI_INTRINSICS_AVAILABLE

#if defined(__cplusplus)

extern "C" {

#endif

#define CRYPTOPP_MISC_H

#include "config.h"

#include <string.h> // for memcpy and memmove

#ifndef _WIN32

#include <strings.h> // for strcasecmp

#define _stricmp strcasecmp

#endif

#if _MSC_VER >= 1400

// VC2005 workaround: disable declarations that conflict with winnt.h

#define _interlockedbittestandset CRYPTOPP_DISABLED_INTRINSIC_1

#define _interlockedbittestandreset CRYPTOPP_DISABLED_INTRINSIC_2

#undef _interlockedbittestandreset64

#endif

#define CRYPTOPP_FAST_ROTATE(x) 1

#define CRYPTOPP_FAST_ROTATE(x) ((x) == 32 | (x) == 64)

#else

#define CRYPTOPP_FAST_ROTATE(x) ((x) == 32)

#define CRYPTOPP_FAST_ROTATE(x) 0

#endif

#pragma intrinsic(memcpy,memset)

#endif

#if defined(__GNUC__) && defined(__linux__)

#define CRYPTOPP_BYTESWAP_AVAILABLE

#include <byteswap.h>

#define CRYPTOPP_BYTESWAP_AVAILABLE

#define bswap_32(x) _byteswap_ulong(x)

#define bswap_64(x) _byteswap_uint64(x)

Copyright (c) 2008-2012 TrueCrypt Developers Association and which is governed

by the TrueCrypt License 3.0.

and all other portions of this file are Copyright (c) 2013-2016 IDRIX

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

BOOL BootArgsValid = FALSE;

BootArguments BootArgs;

static BOOL BootDriveSignatureValid = FALSE;

static KMUTEX MountMutex;

PKTHREAD DecoySystemWipeThread = NULL;

static NTSTATUS DecoySystemWipeResult;

NTSTATUS LoadBootArguments ()

{

NTSTATUS status = STATUS_UNSUCCESSFUL;

PHYSICAL_ADDRESS bootArgsAddr;

byte *mappedBootArgs;

KeInitializeMutex (&MountMutex, 0);

{

Dump ("Checking BootArguments at 0x%x\n", bootArgsAddr.LowPart);

mappedBootArgs = MmMapIoSpace (bootArgsAddr, sizeof (BootArguments), MmCached);

// Sanity check: for valid boot argument, the password is less than 64 bytes long

if (bootArguments->BootPassword.Length <= MAX_PASSWORD)

{

BootArgs = *bootArguments;

BootArgsValid = TRUE;

Extension = (DriveFilterExtension *) filterDeviceObject->DeviceExtension;

memset (Extension, 0, sizeof (DriveFilterExtension));

if (!NT_SUCCESS (status))

{

goto err;

Extension->IsDriveFilterDevice = Extension->Queue.IsFilterDevice = TRUE;

Extension->DeviceObject = Extension->Queue.DeviceObject = filterDeviceObject;

Extension->Pdo = pdo;

Extension->Queue.LowerDeviceObject = Extension->LowerDeviceObject;

IoInitializeRemoveLock (&Extension->Queue.RemoveLock, 'LRCV', 0, 0);

{

Dump ("Dismounting drive\n");

ASSERT (Extension->DriveMounted);

if (stopIoQueue && EncryptedIoQueueIsRunning (&Extension->Queue))

EncryptedIoQueueStop (&Extension->Queue);

// TC_BOOT_SECTOR_USER_CONFIG_OFFSET = 438

//

// we have: TC_BOOT_SECTOR_USER_MESSAGE_OFFSET = TC_BOOT_SECTOR_OUTER_VOLUME_BAK_HEADER_CRC_OFFSET + TC_BOOT_SECTOR_OUTER_VOLUME_BAK_HEADER_CRC_SIZE

WHIRLPOOL_init (&whirlpool);

sha512_begin (&sha2);

// read the first 512 bytes

char *header;

int pkcs5_prf = 0, pim = 0;

byte *mappedCryptoInfo = NULL;

Dump ("MountDrive pdo=%p\n", Extension->Pdo);

ASSERT (KeGetCurrentIrql() == PASSIVE_LEVEL);

goto ret;

}

{

#ifdef DEBUG

Dump ("Wiping memory %x %d\n", cryptoInfoAddress.LowPart, BootArgs.CryptoInfoLength);

#endif

/* Get the parameters used for booting to speed up driver startup and avoid testing irrelevant PRFs */

BOOT_CRYPTO_HEADER* pBootCryptoInfo = (BOOT_CRYPTO_HEADER*) mappedCryptoInfo;

Hash* pHash = HashGet(pBootCryptoInfo->pkcs5);

pkcs5_prf = pBootCryptoInfo->pkcs5;

}

}

// calculate Fingerprint

ComputeBootLoaderFingerprint (Extension->LowerDeviceObject, header);

if (Extension->Queue.CryptoInfo->hiddenVolume)

{

int64 hiddenPartitionOffset = BootArgs.HiddenSystemPartitionStart;

Dump ("Hidden volume start offset = %I64d\n", Extension->Queue.CryptoInfo->EncryptedAreaStart.Value + hiddenPartitionOffset);

Extension->HiddenSystem = TRUE;

Extension->Queue.RemapEncryptedArea = TRUE;

Extension->Queue.RemappedAreaOffset = hiddenPartitionOffset + Extension->Queue.CryptoInfo->EncryptedAreaStart.Value - BootArgs.DecoySystemPartitionStart;

Extension->Queue.RemappedAreaDataUnitOffset = Extension->Queue.CryptoInfo->EncryptedAreaStart.Value / ENCRYPTION_DATA_UNIT_SIZE - BootArgs.DecoySystemPartitionStart / ENCRYPTION_DATA_UNIT_SIZE;

Extension->Queue.CryptoInfo->EncryptedAreaStart.Value = BootArgs.DecoySystemPartitionStart;

if (Extension->Queue.CryptoInfo->VolumeSize.Value > hiddenPartitionOffset - BootArgs.DecoySystemPartitionStart)

TC_THROW_FATAL_EXCEPTION;

}

status = SendDeviceIoControlRequest (Extension->LowerDeviceObject, IOCTL_DISK_GET_LENGTH_INFO, NULL, 0, &BootDriveLength, sizeof (BootDriveLength));

if (!NT_SUCCESS (status))

{

Dump ("Failed to get drive length - error %x\n", status);

}

else

Extension->Queue.MaxReadAheadOffset = BootDriveLength;

status = EncryptedIoQueueStart (&Extension->Queue);

if (!NT_SUCCESS (status))

TC_BUG_CHECK (status);

Dump ("Saving: ConfiguredEncryptedAreaStart=%I64d (%I64d) ConfiguredEncryptedAreaEnd=%I64d (%I64d)\n", Extension->ConfiguredEncryptedAreaStart / 1024 / 1024, Extension->ConfiguredEncryptedAreaStart, Extension->ConfiguredEncryptedAreaEnd / 1024 / 1024, Extension->ConfiguredEncryptedAreaEnd);

Dump ("Saving: EncryptedAreaStart=%I64d (%I64d) EncryptedAreaEnd=%I64d (%I64d)\n", Extension->Queue.EncryptedAreaStart / 1024 / 1024, Extension->Queue.EncryptedAreaStart, Extension->Queue.EncryptedAreaEnd / 1024 / 1024, Extension->Queue.EncryptedAreaEnd);

if (Extension->Queue.EncryptedAreaStart == -1 || Extension->Queue.EncryptedAreaEnd == -1

|| Extension->Queue.EncryptedAreaEnd <= Extension->Queue.EncryptedAreaStart)

{

}

KeInitializeEvent (&Extension->MountWorkItemCompletedEvent, SynchronizationEvent, FALSE);

KeWaitForSingleObject (&Extension->MountWorkItemCompletedEvent, Executive, KernelMode, FALSE, NULL);

IoFreeWorkItem (workItem);

if (Extension->BootDrive)

{

status = EncryptedIoQueueAddIrp (&Extension->Queue, Irp);

if (status != STATUS_PENDING)

TCCompleteDiskIrp (Irp, status, 0);

{

Dump ("Header reopened\n");

ComputeBootLoaderFingerprint (BootDriveFilterExtension->LowerDeviceObject, header);

BootDriveFilterExtension->Queue.CryptoInfo->header_creation_time = BootDriveFilterExtension->HeaderCryptoInfo->header_creation_time;

BootDriveFilterExtension->Queue.CryptoInfo->pkcs5 = BootDriveFilterExtension->HeaderCryptoInfo->pkcs5;

BootDriveFilterExtension->Queue.CryptoInfo->noIterations = BootDriveFilterExtension->HeaderCryptoInfo->noIterations;

if (writeB)

return (*OriginalHiberDriverWriteFunctionsB[filterNumber]) (writeOffset, encryptedDataMdl);

return (*OriginalHiberDriverWriteFunctionsA[filterNumber]) (arg0WriteA, writeOffset, encryptedDataMdl, arg3WriteA);

}

byte *wipeBuffer = NULL;

byte wipeRandChars[TC_WIPE_RAND_CHAR_COUNT];

byte wipeRandCharsUpdate[TC_WIPE_RAND_CHAR_COUNT];

KIRQL irql;

NTSTATUS status;

// wipeRandCharsUpdate instead of relying on uninitialized stack memory

LARGE_INTEGER iSeed;

KeQuerySystemTime( &iSeed );

burn (digest, SHA512_DIGESTSIZE);

burn (&tctx, sizeof (tctx));

}

burn (&iSeed, sizeof(iSeed));

SetupResult = STATUS_UNSUCCESSFUL;

}

EncryptedIoQueueResumeFromHold (&Extension->Queue);

Dump ("EncryptedAreaStart=%I64d\n", Extension->Queue.EncryptedAreaStart);

Dump ("EncryptedAreaEnd=%I64d\n", Extension->Queue.EncryptedAreaEnd);

Dump ("ConfiguredEncryptedAreaStart=%I64d\n", Extension->ConfiguredEncryptedAreaStart);

}

EncryptDataUnits (wipeBuffer, &dataUnit, setupBlockSize / ENCRYPTION_DATA_UNIT_SIZE, Extension->Queue.CryptoInfo);

}

status = TCWriteDevice (BootDriveFilterExtension->LowerDeviceObject, wipeBuffer, offset, setupBlockSize);

}

}

}

}

else

SetupInProgress = TRUE;

status = TCStartThread (SetupThreadProc, DeviceObject, &EncryptionSetupThread);

if (!NT_SUCCESS (status))

SetupInProgress = FALSE;

bootEncStatus->HiddenSysLeakProtectionCount = HiddenSysLeakProtectionCount;

bootEncStatus->HiddenSystem = Extension->HiddenSystem;

if (Extension->HiddenSystem)

bootEncStatus->HiddenSystemPartitionStart = BootArgs.HiddenSystemPartitionStart;

}

irp->IoStatus.Information = 0;

if (BootArgsValid && BootDriveFound && BootDriveFilterExtension && BootDriveFilterExtension->DriveMounted && BootDriveFilterExtension->HeaderCryptoInfo)

{

/* compute the fingerprint again and check if it is the same as the one retrieved during boot */

char *header = TCalloc (TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);

}

else

{

}

}

}

DecoySystemWipeResult = STATUS_INSUFFICIENT_RESOURCES;

goto ret;

}

wipeRandBuffer = TCalloc (TC_ENCRYPTION_SETUP_IO_BLOCK_SIZE);

if (!wipeRandBuffer)

{

}

memcpy (wipeCryptoInfo->k2, WipeDecoyRequest.WipeKey + EAGetKeySize (ea), EAGetKeySize (ea));

if (!EAInitMode (wipeCryptoInfo))

{

DecoySystemWipeResult = STATUS_INVALID_PARAMETER;

burn (WipeDecoyRequest.WipeKey, sizeof (WipeDecoyRequest.WipeKey));

offset.QuadPart = Extension->ConfiguredEncryptedAreaStart;

Dump ("Wiping decoy system: start offset = %I64d\n", offset.QuadPart);

while (!DecoySystemWipeThreadAbortRequested)

DecoySystemWipeInProgress = TRUE;

status = TCStartThread (DecoySystemWipeThreadProc, DeviceObject, &DecoySystemWipeThread);

if (!NT_SUCCESS (status))

DecoySystemWipeInProgress = FALSE;

}

else

wipeStatus->WipedAreaEnd = DecoySystemWipedAreaEnd;

irp->IoStatus.Information = sizeof (DecoySystemWipeStatus);

irp->IoStatus.Status = STATUS_SUCCESS;

}