![[BACK]](/cvsweb/icons/back.gif){kind=icon}
Return to bootencryption.cpp CVS log ![[TXT]](/cvsweb/icons/text.gif){kind=icon}
![[DIR]](/cvsweb/icons/dir.gif){kind=icon}
Up to [truecrypt] / truecrypt / common|
Return to bootencryption.cpp CVS log | Up to [truecrypt] / truecrypt / common |
1.1 root 1: /*
1.1.1.8 root 2: Copyright (c) 2008-2009 TrueCrypt Foundation. All rights reserved.
1.1 root 3:
1.1.1.9 ! root 4: Governed by the TrueCrypt License 2.7 the full text of which is contained
1.1 root 5: in the file License.txt included in TrueCrypt binary and source code
6: distribution packages.
7: */
8:
9: #include "Tcdefs.h"
10: #include "Platform/Finally.h"
11: #include "Platform/ForEach.h"
12: #include <Setupapi.h>
13: #include <devguid.h>
14: #include <io.h>
15: #include <shlobj.h>
16: #include <atlbase.h>
17: #include "BootEncryption.h"
18: #include "Boot/Windows/BootCommon.h"
19: #include "Common/Resource.h"
20: #include "Crc.h"
21: #include "Crypto.h"
22: #include "Dlgcode.h"
23: #include "Endian.h"
1.1.1.5 root 24: #include "Language.h"
1.1 root 25: #include "Random.h"
26: #include "Registry.h"
27: #include "Volumes.h"
28:
29: #ifdef VOLFORMAT
30: #include "Format/FormatCom.h"
31: #elif defined (TCMOUNT)
32: #include "Mount/MainCom.h"
33: #endif
34:
35: namespace TrueCrypt
36: {
37: #if !defined (SETUP)
38:
39: class Elevator
40: {
41: public:
1.1.1.6 root 42:
43: static void AddReference ()
44: {
45: ++ReferenceCount;
46: }
47:
48:
1.1 root 49: static void CallDriver (DWORD ioctl, void *input, DWORD inputSize, void *output, DWORD outputSize)
50: {
51: Elevate();
52:
53: CComBSTR inputBstr;
54: if (input && inputBstr.AppendBytes ((const char *) input, inputSize) != S_OK)
55: throw ParameterIncorrect (SRC_POS);
56:
57: CComBSTR outputBstr;
58: if (output && outputBstr.AppendBytes ((const char *) output, outputSize) != S_OK)
59: throw ParameterIncorrect (SRC_POS);
60:
61: DWORD result = ElevatedComInstance->CallDriver (ioctl, inputBstr, &outputBstr);
1.1.1.5 root 62:
63: if (output)
64: memcpy (output, *(void **) &outputBstr, outputSize);
65:
1.1 root 66: if (result != ERROR_SUCCESS)
67: {
68: SetLastError (result);
69: throw SystemException();
70: }
71: }
72:
73: static void ReadWriteFile (BOOL write, BOOL device, const string &filePath, byte *buffer, uint64 offset, uint32 size, DWORD *sizeDone)
74: {
75: Elevate();
76:
77: CComBSTR bufferBstr;
78: if (bufferBstr.AppendBytes ((const char *) buffer, size) != S_OK)
79: throw ParameterIncorrect (SRC_POS);
80: DWORD result = ElevatedComInstance->ReadWriteFile (write, device, CComBSTR (filePath.c_str()), &bufferBstr, offset, size, sizeDone);
81:
82: if (result != ERROR_SUCCESS)
83: {
84: SetLastError (result);
85: throw SystemException();
86: }
87:
88: if (!write)
89: memcpy (buffer, (BYTE *) bufferBstr.m_str, size);
90: }
91:
1.1.1.6 root 92: static BOOL IsPagingFileActive (BOOL checkNonWindowsPartitionsOnly)
1.1.1.5 root 93: {
94: Elevate();
95:
1.1.1.6 root 96: return ElevatedComInstance->IsPagingFileActive (checkNonWindowsPartitionsOnly);
1.1.1.5 root 97: }
98:
99: static void WriteLocalMachineRegistryDwordValue (char *keyPath, char *valueName, DWORD value)
1.1 root 100: {
101: Elevate();
102:
1.1.1.5 root 103: DWORD result = ElevatedComInstance->WriteLocalMachineRegistryDwordValue (CComBSTR (keyPath), CComBSTR (valueName), value);
104:
105: if (result != ERROR_SUCCESS)
106: {
107: SetLastError (result);
108: throw SystemException();
109: }
110: }
111:
112: static void RegisterFilterDriver (bool registerDriver, bool volumeClass)
113: {
114: Elevate();
115:
116: DWORD result = ElevatedComInstance->RegisterFilterDriver (registerDriver ? TRUE : FALSE, volumeClass ? TRUE : FALSE);
1.1 root 117: if (result != ERROR_SUCCESS)
118: {
119: SetLastError (result);
120: throw SystemException();
121: }
122: }
123:
1.1.1.6 root 124:
1.1 root 125: static void Release ()
126: {
1.1.1.6 root 127: if (--ReferenceCount == 0 && ElevatedComInstance)
1.1 root 128: {
129: ElevatedComInstance->Release();
130: ElevatedComInstance = nullptr;
131: CoUninitialize ();
132: }
133: }
134:
135: static void SetDriverServiceStartType (DWORD startType)
136: {
137: Elevate();
138:
139: DWORD result = ElevatedComInstance->SetDriverServiceStartType (startType);
140: if (result != ERROR_SUCCESS)
141: {
142: SetLastError (result);
143: throw SystemException();
144: }
145: }
146:
147: protected:
148: static void Elevate ()
149: {
150: if (IsAdmin())
151: {
152: SetLastError (ERROR_ACCESS_DENIED);
153: throw SystemException();
154: }
155:
1.1.1.5 root 156: if (!ElevatedComInstance || ElevatedComInstanceThreadId != GetCurrentThreadId())
1.1 root 157: {
158: CoInitialize (NULL);
159: ElevatedComInstance = GetElevatedInstance (GetActiveWindow() ? GetActiveWindow() : MainDlg);
1.1.1.5 root 160: ElevatedComInstanceThreadId = GetCurrentThreadId();
1.1 root 161: }
162: }
163:
164: #if defined (TCMOUNT)
165: static ITrueCryptMainCom *ElevatedComInstance;
166: #elif defined (VOLFORMAT)
167: static ITrueCryptFormatCom *ElevatedComInstance;
168: #endif
1.1.1.5 root 169: static DWORD ElevatedComInstanceThreadId;
1.1.1.6 root 170: static int ReferenceCount;
1.1 root 171: };
172:
173: #if defined (TCMOUNT)
174: ITrueCryptMainCom *Elevator::ElevatedComInstance;
175: #elif defined (VOLFORMAT)
176: ITrueCryptFormatCom *Elevator::ElevatedComInstance;
177: #endif
1.1.1.5 root 178: DWORD Elevator::ElevatedComInstanceThreadId;
1.1.1.6 root 179: int Elevator::ReferenceCount = 0;
1.1 root 180:
181: #else // SETUP
182:
183: class Elevator
184: {
185: public:
1.1.1.6 root 186: static void AddReference () { }
1.1 root 187: static void CallDriver (DWORD ioctl, void *input, DWORD inputSize, void *output, DWORD outputSize) { throw ParameterIncorrect (SRC_POS); }
188: static void ReadWriteFile (BOOL write, BOOL device, const string &filePath, byte *buffer, uint64 offset, uint32 size, DWORD *sizeDone) { throw ParameterIncorrect (SRC_POS); }
1.1.1.5 root 189: static void RegisterFilterDriver (bool registerDriver, bool volumeClass) { throw ParameterIncorrect (SRC_POS); }
1.1 root 190: static void Release () { }
191: static void SetDriverServiceStartType (DWORD startType) { throw ParameterIncorrect (SRC_POS); }
192: };
193:
194: #endif // SETUP
195:
196:
197: File::File (string path, bool readOnly, bool create) : Elevated (false), FileOpen (false)
198: {
199: Handle = CreateFile (path.c_str(),
1.1.1.6 root 200: readOnly ? GENERIC_READ : GENERIC_READ | GENERIC_WRITE,
1.1 root 201: FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, create ? CREATE_ALWAYS : OPEN_EXISTING,
202: FILE_FLAG_RANDOM_ACCESS | FILE_FLAG_WRITE_THROUGH, NULL);
203:
204: try
205: {
206: throw_sys_if (Handle == INVALID_HANDLE_VALUE);
207: }
208: catch (SystemException &)
209: {
210: if (GetLastError() == ERROR_ACCESS_DENIED && IsUacSupported())
211: Elevated = true;
212: else
213: throw;
214: }
215:
216: FileOpen = true;
217: FilePointerPosition = 0;
218: IsDevice = false;
219: Path = path;
220: }
221:
222: void File::Close ()
223: {
224: if (FileOpen)
225: {
226: if (!Elevated)
227: CloseHandle (Handle);
228:
229: FileOpen = false;
230: }
231: }
232:
233: DWORD File::Read (byte *buffer, DWORD size)
234: {
235: DWORD bytesRead;
236:
237: if (Elevated)
238: {
239: DWORD bytesRead;
240:
241: Elevator::ReadWriteFile (false, IsDevice, Path, buffer, FilePointerPosition, size, &bytesRead);
242: FilePointerPosition += bytesRead;
243: return bytesRead;
244: }
245:
246: throw_sys_if (!ReadFile (Handle, buffer, size, &bytesRead, NULL));
247: return bytesRead;
248: }
249:
250: void File::SeekAt (int64 position)
251: {
1.1.1.6 root 252: FilePointerPosition = position;
253:
254: if (!Elevated)
1.1 root 255: {
256: LARGE_INTEGER pos;
257: pos.QuadPart = position;
258: throw_sys_if (!SetFilePointerEx (Handle, pos, NULL, FILE_BEGIN));
259: }
260: }
261:
262: void File::Write (byte *buffer, DWORD size)
263: {
264: DWORD bytesWritten;
1.1.1.6 root 265:
266: try
1.1 root 267: {
1.1.1.6 root 268: if (Elevated)
269: {
270: Elevator::ReadWriteFile (true, IsDevice, Path, buffer, FilePointerPosition, size, &bytesWritten);
271: FilePointerPosition += bytesWritten;
272: throw_sys_if (bytesWritten != size);
273: }
274: else
275: {
276: throw_sys_if (!WriteFile (Handle, buffer, size, &bytesWritten, NULL) || bytesWritten != size);
277: }
1.1 root 278: }
1.1.1.6 root 279: catch (SystemException &e)
1.1 root 280: {
1.1.1.6 root 281: if (!IsDevice || e.ErrorCode != ERROR_WRITE_PROTECT || !IsHiddenOSRunning())
282: throw;
283:
284: BootEncryption bootEnc (NULL);
285:
286: while (size >= SECTOR_SIZE)
287: {
288: bootEnc.WriteBootDriveSector (FilePointerPosition, buffer);
289:
290: FilePointerPosition += SECTOR_SIZE;
291: buffer += SECTOR_SIZE;
292: size -= SECTOR_SIZE;
293: }
1.1 root 294: }
295: }
296:
297: void Show (HWND parent, const string &str)
298: {
299: MessageBox (parent, str.c_str(), NULL, 0);
300: }
301:
302:
303: Device::Device (string path, bool readOnly)
304: {
305: FileOpen = false;
306: Elevated = false;
307:
308: Handle = CreateFile ((string ("\\\\.\\") + path).c_str(),
1.1.1.6 root 309: readOnly ? GENERIC_READ : GENERIC_READ | GENERIC_WRITE,
1.1 root 310: FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
311: FILE_FLAG_RANDOM_ACCESS | FILE_FLAG_WRITE_THROUGH, NULL);
312:
313: try
314: {
315: throw_sys_if (Handle == INVALID_HANDLE_VALUE);
316: }
317: catch (SystemException &)
318: {
319: if (GetLastError() == ERROR_ACCESS_DENIED && IsUacSupported())
320: Elevated = true;
321: else
322: throw;
323: }
324:
325: FileOpen = true;
326: FilePointerPosition = 0;
327: IsDevice = true;
328: Path = path;
329: }
330:
331:
1.1.1.6 root 332: BootEncryption::BootEncryption (HWND parent)
333: : DriveConfigValid (false),
334: ParentWindow (parent),
335: RealSystemDriveSizeValid (false),
336: RescueIsoImage (nullptr),
337: RescueVolumeHeaderValid (false),
338: SelectedEncryptionAlgorithmId (0),
339: VolumeHeaderValid (false)
340: {
341: Elevator::AddReference();
342: }
343:
344:
1.1 root 345: BootEncryption::~BootEncryption ()
346: {
347: if (RescueIsoImage)
348: delete RescueIsoImage;
349:
350: Elevator::Release();
351: }
352:
353:
354: void BootEncryption::CallDriver (DWORD ioctl, void *input, DWORD inputSize, void *output, DWORD outputSize)
355: {
356: try
357: {
358: DWORD bytesReturned;
359: throw_sys_if (!DeviceIoControl (hDriver, ioctl, input, inputSize, output, outputSize, &bytesReturned, NULL));
360: }
361: catch (SystemException &)
362: {
363: if (GetLastError() == ERROR_ACCESS_DENIED && IsUacSupported())
364: Elevator::CallDriver (ioctl, input, inputSize, output, outputSize);
365: else
366: throw;
367: }
368: }
369:
370:
1.1.1.5 root 371: // Finds the first partition physically located behind the active one and returns its properties
372: Partition BootEncryption::GetPartitionForHiddenOS ()
373: {
374: Partition candidatePartition;
375:
376: memset (&candidatePartition, 0, sizeof(candidatePartition));
377:
378: // The user may have modified/added/deleted partitions since the time the partition table was last scanned
379: InvalidateCachedSysDriveProperties();
380:
381: SystemDriveConfiguration config = GetSystemDriveConfiguration ();
382: bool activePartitionFound = false;
383: bool candidateForHiddenOSFound = false;
384:
385: if (config.SystemPartition.IsGPT)
386: throw ParameterIncorrect (SRC_POS); // It is assumed that CheckRequirements() had been called
387:
388: // Find the first active partition on the system drive
389: foreach (const Partition &partition, config.Partitions)
390: {
391: if (partition.Info.BootIndicator)
392: {
393: if (partition.Info.PartitionNumber != config.SystemPartition.Number)
394: {
395: throw ErrorException (wstring (GetString ("SYSTEM_PARTITION_NOT_ACTIVE"))
396: + GetRemarksOnHiddenOS());
397: }
398:
399: activePartitionFound = true;
400: break;
401: }
402: }
403:
404: /* WARNING: Note that the partition number at the end of a device path (\Device\HarddiskY\PartitionX) must
405: NOT be used to find the first partition physically located behind the active one. The reason is that the
406: user may have deleted and created partitions during this session and e.g. the second partition could have
407: a higer number than the third one. */
408:
409:
410: // Find the first partition physically located behind the active partition
411: if (activePartitionFound)
412: {
413: int64 minOffsetFound = config.DrivePartition.Info.PartitionLength.QuadPart;
414:
415: foreach (const Partition &partition, config.Partitions)
416: {
417: if (partition.Info.StartingOffset.QuadPart > config.SystemPartition.Info.StartingOffset.QuadPart
418: && partition.Info.StartingOffset.QuadPart < minOffsetFound)
419: {
420: minOffsetFound = partition.Info.StartingOffset.QuadPart;
421:
422: candidatePartition = partition;
423:
424: candidateForHiddenOSFound = true;
425: }
426: }
427:
428: if (!candidateForHiddenOSFound)
429: {
430: throw ErrorException (wstring (GetString ("NO_PARTITION_FOLLOWS_BOOT_PARTITION"))
431: + GetRemarksOnHiddenOS());
432: }
433:
434: if (config.SystemPartition.Info.PartitionLength.QuadPart > TC_MAX_FAT_FS_SIZE)
435: {
436: if ((double) candidatePartition.Info.PartitionLength.QuadPart / config.SystemPartition.Info.PartitionLength.QuadPart < MIN_HIDDENOS_DECOY_PARTITION_SIZE_RATIO_NTFS)
437: {
438: throw ErrorException (wstring (GetString ("PARTITION_TOO_SMALL_FOR_HIDDEN_OS_NTFS"))
439: + GetRemarksOnHiddenOS());
440: }
441: }
442: else if ((double) candidatePartition.Info.PartitionLength.QuadPart / config.SystemPartition.Info.PartitionLength.QuadPart < MIN_HIDDENOS_DECOY_PARTITION_SIZE_RATIO_FAT)
443: {
444: throw ErrorException (wstring (GetString ("PARTITION_TOO_SMALL_FOR_HIDDEN_OS"))
445: + GetRemarksOnHiddenOS());
446: }
447: }
448: else
449: {
450: // No active partition on the system drive
451: throw ErrorException ("WINDOWS_NOT_ON_BOOT_DRIVE_ERROR");
452: }
453:
1.1.1.6 root 454: HiddenOSCandidatePartition = candidatePartition;
1.1.1.5 root 455: return candidatePartition;
456: }
457:
458:
1.1 root 459: DWORD BootEncryption::GetDriverServiceStartType ()
460: {
461: DWORD startType;
462: throw_sys_if (!ReadLocalMachineRegistryDword ("SYSTEM\\CurrentControlSet\\Services\\truecrypt", "Start", &startType));
463: return startType;
464: }
465:
466:
1.1.1.5 root 467: wstring BootEncryption::GetRemarksOnHiddenOS ()
468: {
469: return (wstring (L"\n\n")
470: + GetString ("TWO_SYSTEMS_IN_ONE_PARTITION_REMARK")
471: + L"\n\n"
472: + GetString ("FOR_MORE_INFO_ON_PARTITIONS"));
473: }
474:
475:
1.1 root 476: void BootEncryption::SetDriverServiceStartType (DWORD startType)
477: {
478: if (!IsAdmin() && IsUacSupported())
479: {
480: Elevator::SetDriverServiceStartType (startType);
481: return;
482: }
483:
484: BOOL startOnBoot = (startType == SERVICE_BOOT_START);
485:
486: SC_HANDLE serviceManager = OpenSCManager (NULL, NULL, SC_MANAGER_ALL_ACCESS);
487: throw_sys_if (!serviceManager);
488:
489: finally_do_arg (SC_HANDLE, serviceManager, { CloseServiceHandle (finally_arg); });
490:
491: SC_HANDLE service = OpenService (serviceManager, "truecrypt", SERVICE_CHANGE_CONFIG);
492: throw_sys_if (!service);
493:
494: finally_do_arg (SC_HANDLE, service, { CloseServiceHandle (finally_arg); });
495:
1.1.1.5 root 496: // Windows versions preceding Vista can be installed on FAT filesystem which does not
497: // support long filenames during boot. Convert the driver path to short form if required.
498: string driverPath;
1.1.1.8 root 499: if (startOnBoot && !IsOSAtLeast (WIN_VISTA))
1.1.1.5 root 500: {
501: char pathBuf[MAX_PATH];
502: char filesystem[128];
503:
504: string path (GetWindowsDirectory());
505: path += "\\drivers\\truecrypt.sys";
506:
507: if (GetVolumePathName (path.c_str(), pathBuf, sizeof (pathBuf))
508: && GetVolumeInformation (pathBuf, NULL, 0, NULL, NULL, NULL, filesystem, sizeof(filesystem))
509: && memcmp (filesystem, "FAT", 3) == 0)
510: {
511: throw_sys_if (GetShortPathName (path.c_str(), pathBuf, sizeof (pathBuf)) == 0);
512:
513: // Convert absolute path to relative to the Windows directory
514: driverPath = pathBuf;
515: driverPath = driverPath.substr (driverPath.rfind ("\\", driverPath.rfind ("\\", driverPath.rfind ("\\") - 1) - 1) + 1);
516:
517: if (Is64BitOs())
518: driverPath = "SysWOW64" + driverPath.substr (driverPath.find ("\\"));
519: }
520: }
521:
1.1 root 522: throw_sys_if (!ChangeServiceConfig (service, SERVICE_NO_CHANGE, SERVICE_NO_CHANGE,
1.1.1.5 root 523: startOnBoot ? SERVICE_ERROR_SEVERE : SERVICE_ERROR_NORMAL,
524: driverPath.empty() ? NULL : driverPath.c_str(),
1.1 root 525: startOnBoot ? "Filter" : NULL,
526: NULL, NULL, NULL, NULL, NULL));
527:
528: // ChangeServiceConfig() rejects SERVICE_BOOT_START with ERROR_INVALID_PARAMETER
529: throw_sys_if (!WriteLocalMachineRegistryDword ("SYSTEM\\CurrentControlSet\\Services\\truecrypt", "Start", startType));
530: }
531:
532:
533: void BootEncryption::ProbeRealSystemDriveSize ()
534: {
535: if (RealSystemDriveSizeValid)
536: return;
537:
538: GetSystemDriveConfiguration();
539:
540: ProbeRealDriveSizeRequest request;
541: _snwprintf (request.DeviceName, array_capacity (request.DeviceName), L"%hs", DriveConfig.DrivePartition.DevicePath.c_str());
542:
543: CallDriver (TC_IOCTL_PROBE_REAL_DRIVE_SIZE, &request, sizeof (request), &request, sizeof (request));
544: DriveConfig.DrivePartition.Info.PartitionLength = request.RealDriveSize;
545:
1.1.1.5 root 546: RealSystemDriveSizeValid = true;
1.1.1.3 root 547:
548: if (request.TimeOut)
549: throw TimeOut (SRC_POS);
1.1 root 550: }
551:
552:
1.1.1.5 root 553: void BootEncryption::InvalidateCachedSysDriveProperties ()
554: {
555: DriveConfigValid = false;
556: RealSystemDriveSizeValid = false;
557: }
558:
559:
1.1 root 560: PartitionList BootEncryption::GetDrivePartitions (int driveNumber)
561: {
562: PartitionList partList;
563:
564: for (int partNumber = 0; partNumber < 64; ++partNumber)
565: {
566: stringstream partPath;
567: partPath << "\\Device\\Harddisk" << driveNumber << "\\Partition" << partNumber;
568:
569: DISK_PARTITION_INFO_STRUCT diskPartInfo;
570: _snwprintf (diskPartInfo.deviceName, array_capacity (diskPartInfo.deviceName), L"%hs", partPath.str().c_str());
571:
572: try
573: {
574: CallDriver (TC_IOCTL_GET_DRIVE_PARTITION_INFO, &diskPartInfo, sizeof (diskPartInfo), &diskPartInfo, sizeof (diskPartInfo));
575: }
576: catch (...)
577: {
578: continue;
579: }
580:
581: Partition part;
582: part.DevicePath = partPath.str();
583: part.Number = partNumber;
584: part.Info = diskPartInfo.partInfo;
585: part.IsGPT = diskPartInfo.IsGPT;
586:
587: // Mount point
588: wstringstream ws;
589: ws << partPath.str().c_str();
590: int driveNumber = GetDiskDeviceDriveLetter ((wchar_t *) ws.str().c_str());
591:
592: if (driveNumber >= 0)
593: {
594: part.MountPoint += (char) (driveNumber + 'A');
595: part.MountPoint += ":";
596: }
1.1.1.8 root 597:
598: // Volume ID
599: wchar_t volumePath[TC_MAX_PATH];
600: if (ResolveSymbolicLink ((wchar_t *) ws.str().c_str(), volumePath))
601: {
602: wchar_t volumeName[TC_MAX_PATH];
603: HANDLE fh = FindFirstVolumeW (volumeName, array_capacity (volumeName));
604: if (fh != INVALID_HANDLE_VALUE)
605: {
606: do
607: {
608: wstring volumeNameStr = volumeName;
609: wchar_t devicePath[TC_MAX_PATH];
610:
611: if (QueryDosDeviceW (volumeNameStr.substr (4, volumeNameStr.size() - 1 - 4).c_str(), devicePath, array_capacity (devicePath)) != 0
612: && wcscmp (volumePath, devicePath) == 0)
613: {
614: part.VolumeNameId = volumeName;
615: break;
616: }
617:
618: } while (FindNextVolumeW (fh, volumeName, array_capacity (volumeName)));
619:
620: FindVolumeClose (fh);
621: }
622: }
623:
1.1 root 624: partList.push_back (part);
625: }
626:
627: return partList;
628: }
629:
630:
631: DISK_GEOMETRY BootEncryption::GetDriveGeometry (int driveNumber)
632: {
633: stringstream devName;
634: devName << "\\Device\\Harddisk" << driveNumber << "\\Partition0";
635:
636: DISK_GEOMETRY geometry;
637: throw_sys_if (!::GetDriveGeometry ((char *) devName.str().c_str(), &geometry));
638: return geometry;
639: }
640:
641:
642: string BootEncryption::GetWindowsDirectory ()
643: {
644: char buf[MAX_PATH];
1.1.1.5 root 645: throw_sys_if (GetSystemDirectory (buf, sizeof (buf)) == 0);
646:
647: return string (buf);
1.1 root 648: }
1.1.1.6 root 649:
650:
651: string BootEncryption::GetTempPath ()
652: {
653: char tempPath[MAX_PATH];
654: DWORD tempLen = ::GetTempPath (sizeof (tempPath), tempPath);
655: if (tempLen == 0 || tempLen > sizeof (tempPath))
656: throw ParameterIncorrect (SRC_POS);
657:
658: return string (tempPath);
659: }
660:
1.1 root 661:
662: uint16 BootEncryption::GetInstalledBootLoaderVersion ()
663: {
664: uint16 version;
665: CallDriver (TC_IOCTL_GET_BOOT_LOADER_VERSION, NULL, 0, &version, sizeof (version));
666: return version;
667: }
668:
669:
1.1.1.3 root 670: // Note that this does not require admin rights (it just requires the driver to be running)
671: bool BootEncryption::IsBootLoaderOnDrive (char *devicePath)
672: {
673: try
674: {
675: OPEN_TEST_STRUCT openTestStruct;
1.1.1.8 root 676: memset (&openTestStruct, 0, sizeof (openTestStruct));
1.1.1.3 root 677: DWORD dwResult;
678:
679: strcpy ((char *) &openTestStruct.wszFileName[0], devicePath);
680: ToUNICODE ((char *) &openTestStruct.wszFileName[0]);
681:
682: openTestStruct.bDetectTCBootLoader = TRUE;
683:
684: return (DeviceIoControl (hDriver, TC_IOCTL_OPEN_TEST,
685: &openTestStruct, sizeof (OPEN_TEST_STRUCT),
1.1.1.8 root 686: &openTestStruct, sizeof (OPEN_TEST_STRUCT),
687: &dwResult, NULL) && openTestStruct.TCBootLoaderDetected);
1.1.1.3 root 688: }
689: catch (...)
690: {
691: return false;
692: }
693: }
694:
695:
1.1 root 696: BootEncryptionStatus BootEncryption::GetStatus ()
697: {
698: /* IMPORTANT: Do NOT add any potentially time-consuming operations to this function. */
699:
700: BootEncryptionStatus status;
701: CallDriver (TC_IOCTL_GET_BOOT_ENCRYPTION_STATUS, NULL, 0, &status, sizeof (status));
702: return status;
703: }
704:
705:
706: void BootEncryption::GetVolumeProperties (VOLUME_PROPERTIES_STRUCT *properties)
707: {
708: if (properties == NULL)
709: throw ParameterIncorrect (SRC_POS);
710:
711: CallDriver (TC_IOCTL_GET_BOOT_DRIVE_VOLUME_PROPERTIES, NULL, 0, properties, sizeof (*properties));
712: }
713:
714:
1.1.1.5 root 715: bool BootEncryption::IsHiddenSystemRunning ()
716: {
717: int hiddenSystemStatus;
718:
719: CallDriver (TC_IOCTL_IS_HIDDEN_SYSTEM_RUNNING, nullptr, 0, &hiddenSystemStatus, sizeof (hiddenSystemStatus));
720: return hiddenSystemStatus != 0;
721: }
722:
723:
1.1.1.2 root 724: bool BootEncryption::SystemDriveContainsPartitionType (byte type)
725: {
726: Device device (GetSystemDriveConfiguration().DevicePath, true);
727:
728: byte mbrBuf[SECTOR_SIZE];
729: device.SeekAt (0);
730: device.Read (mbrBuf, sizeof (mbrBuf));
731:
732: MBR *mbr = reinterpret_cast <MBR *> (mbrBuf);
733: if (mbr->Signature != 0xaa55)
734: throw ParameterIncorrect (SRC_POS);
735:
736: for (size_t i = 0; i < array_capacity (mbr->Partitions); ++i)
737: {
738: if (mbr->Partitions[i].Type == type)
739: return true;
740: }
741:
742: return false;
743: }
744:
745:
746: bool BootEncryption::SystemDriveContainsExtendedPartition ()
747: {
748: return SystemDriveContainsPartitionType (PARTITION_EXTENDED) || SystemDriveContainsPartitionType (PARTITION_XINT13_EXTENDED);
749: }
750:
751:
752: bool BootEncryption::SystemDriveIsDynamic ()
753: {
1.1.1.5 root 754: GetSystemDriveConfigurationRequest request;
755: _snwprintf (request.DevicePath, array_capacity (request.DevicePath), L"%hs", GetSystemDriveConfiguration().DeviceKernelPath.c_str());
756:
757: CallDriver (TC_IOCTL_GET_SYSTEM_DRIVE_CONFIG, &request, sizeof (request), &request, sizeof (request));
758: return request.DriveIsDynamic ? true : false;
1.1.1.2 root 759: }
760:
761:
1.1 root 762: SystemDriveConfiguration BootEncryption::GetSystemDriveConfiguration ()
763: {
764: if (DriveConfigValid)
765: return DriveConfig;
766:
767: SystemDriveConfiguration config;
768:
769: string winDir = GetWindowsDirectory();
770:
771: // Scan all drives
772: for (int driveNumber = 0; driveNumber < 32; ++driveNumber)
773: {
774: bool windowsFound = false;
775: config.SystemLoaderPresent = false;
776:
777: PartitionList partitions = GetDrivePartitions (driveNumber);
778: foreach (const Partition &part, partitions)
779: {
1.1.1.5 root 780: if (!part.MountPoint.empty()
781: && (_access ((part.MountPoint + "\\bootmgr").c_str(), 0) == 0 || _access ((part.MountPoint + "\\ntldr").c_str(), 0) == 0))
782: {
1.1 root 783: config.SystemLoaderPresent = true;
1.1.1.5 root 784: }
1.1.1.8 root 785: else if (!part.VolumeNameId.empty()
786: && (_waccess ((part.VolumeNameId + L"\\bootmgr").c_str(), 0) == 0 || _waccess ((part.VolumeNameId + L"\\ntldr").c_str(), 0) == 0))
787: {
788: config.SystemLoaderPresent = true;
789: }
1.1 root 790:
1.1.1.6 root 791: if (!windowsFound && !part.MountPoint.empty() && ToUpperCase (winDir).find (ToUpperCase (part.MountPoint)) == 0)
1.1 root 792: {
793: config.SystemPartition = part;
794: windowsFound = true;
795: }
796: }
797:
798: if (windowsFound)
799: {
800: config.DriveNumber = driveNumber;
801:
802: stringstream ss;
803: ss << "PhysicalDrive" << driveNumber;
804: config.DevicePath = ss.str();
805:
1.1.1.5 root 806: stringstream kernelPath;
807: kernelPath << "\\Device\\Harddisk" << driveNumber << "\\Partition0";
808: config.DeviceKernelPath = kernelPath.str();
809:
1.1 root 810: config.DrivePartition = partitions.front();
811: partitions.pop_front();
812: config.Partitions = partitions;
813:
814: config.InitialUnallocatedSpace = 0x7fffFFFFffffFFFFull;
815: config.TotalUnallocatedSpace = config.DrivePartition.Info.PartitionLength.QuadPart;
816:
817: foreach (const Partition &part, config.Partitions)
818: {
819: if (part.Info.StartingOffset.QuadPart < config.InitialUnallocatedSpace)
820: config.InitialUnallocatedSpace = part.Info.StartingOffset.QuadPart;
821:
822: config.TotalUnallocatedSpace -= part.Info.PartitionLength.QuadPart;
823: }
824:
825: DriveConfig = config;
1.1.1.5 root 826: DriveConfigValid = true;
1.1 root 827: return DriveConfig;
828: }
829: }
830:
831: throw ParameterIncorrect (SRC_POS);
832: }
833:
834:
835: bool BootEncryption::SystemPartitionCoversWholeDrive ()
836: {
837: SystemDriveConfiguration config = GetSystemDriveConfiguration();
838:
839: return config.Partitions.size() == 1
1.1.1.3 root 840: && config.DrivePartition.Info.PartitionLength.QuadPart - config.SystemPartition.Info.PartitionLength.QuadPart < 64 * BYTES_PER_MB;
1.1 root 841: }
842:
843:
1.1.1.3 root 844: uint32 BootEncryption::GetChecksum (byte *data, size_t size)
1.1 root 845: {
1.1.1.3 root 846: uint32 sum = 0;
847:
848: while (size-- > 0)
849: {
850: sum += *data++;
851: sum = _rotl (sum, 1);
852: }
853:
854: return sum;
855: }
856:
857:
1.1.1.6 root 858: void BootEncryption::CreateBootLoaderInMemory (byte *buffer, size_t bufferSize, bool rescueDisk, bool hiddenOSCreation)
1.1.1.3 root 859: {
1.1.1.5 root 860: if (bufferSize < TC_BOOT_LOADER_AREA_SIZE - TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE)
1.1.1.3 root 861: throw ParameterIncorrect (SRC_POS);
862:
863: ZeroMemory (buffer, bufferSize);
864:
865: int ea = 0;
866: if (GetStatus().DriveMounted)
867: {
868: try
869: {
870: GetBootEncryptionAlgorithmNameRequest request;
871: CallDriver (TC_IOCTL_GET_BOOT_ENCRYPTION_ALGORITHM_NAME, NULL, 0, &request, sizeof (request));
872:
873: if (_stricmp (request.BootEncryptionAlgorithmName, "AES") == 0)
874: ea = AES;
875: else if (_stricmp (request.BootEncryptionAlgorithmName, "Serpent") == 0)
876: ea = SERPENT;
877: else if (_stricmp (request.BootEncryptionAlgorithmName, "Twofish") == 0)
878: ea = TWOFISH;
879: }
880: catch (...)
881: {
882: try
883: {
884: VOLUME_PROPERTIES_STRUCT properties;
885: GetVolumeProperties (&properties);
886: ea = properties.ea;
887: }
888: catch (...) { }
889: }
890: }
891: else
892: {
893: if (SelectedEncryptionAlgorithmId == 0)
894: throw ParameterIncorrect (SRC_POS);
895:
896: ea = SelectedEncryptionAlgorithmId;
897: }
898:
1.1.1.5 root 899: int bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR : IDR_BOOT_SECTOR;
900: int bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER : IDR_BOOT_LOADER;
1.1.1.3 root 901:
902: switch (ea)
903: {
904: case AES:
1.1.1.5 root 905: bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_AES : IDR_BOOT_SECTOR_AES;
906: bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_AES : IDR_BOOT_LOADER_AES;
1.1.1.3 root 907: break;
908:
909: case SERPENT:
1.1.1.5 root 910: bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_SERPENT : IDR_BOOT_SECTOR_SERPENT;
911: bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_SERPENT : IDR_BOOT_LOADER_SERPENT;
1.1.1.3 root 912: break;
913:
914: case TWOFISH:
1.1.1.5 root 915: bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_TWOFISH : IDR_BOOT_SECTOR_TWOFISH;
916: bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_TWOFISH : IDR_BOOT_LOADER_TWOFISH;
1.1.1.3 root 917: break;
918: }
919:
920: // Boot sector
1.1 root 921: DWORD size;
1.1.1.3 root 922: byte *bootSecResourceImg = MapResource ("BIN", bootSectorId, &size);
923: if (!bootSecResourceImg || size != SECTOR_SIZE)
924: throw ParameterIncorrect (SRC_POS);
925:
926: memcpy (buffer, bootSecResourceImg, size);
1.1 root 927:
1.1.1.6 root 928: *(uint16 *) (buffer + TC_BOOT_SECTOR_VERSION_OFFSET) = BE16 (VERSION_NUM);
929:
1.1.1.8 root 930: if (IsOSAtLeast (WIN_VISTA))
1.1.1.3 root 931: buffer[TC_BOOT_SECTOR_CONFIG_OFFSET] |= TC_BOOT_CFG_FLAG_WINDOWS_VISTA_OR_LATER;
932:
1.1.1.6 root 933: // Checksum of the backup header of the outer volume for the hidden system
934: if (hiddenOSCreation)
935: {
936: Device device (GetSystemDriveConfiguration().DevicePath);
937: byte headerSector[SECTOR_SIZE];
938:
939: device.SeekAt (HiddenOSCandidatePartition.Info.StartingOffset.QuadPart + HiddenOSCandidatePartition.Info.PartitionLength.QuadPart - TC_VOLUME_HEADER_GROUP_SIZE + TC_VOLUME_HEADER_EFFECTIVE_SIZE);
940: device.Read (headerSector, sizeof (headerSector));
941:
1.1.1.8 root 942: *(uint32 *) (buffer + TC_BOOT_SECTOR_OUTER_VOLUME_BAK_HEADER_CRC_OFFSET) = GetCrc32 (headerSector, sizeof (headerSector));
1.1.1.6 root 943: }
944:
1.1.1.3 root 945: // Decompressor
946: byte *decompressor = MapResource ("BIN", IDR_BOOT_LOADER_DECOMPRESSOR, &size);
947: if (!decompressor || size > TC_BOOT_LOADER_DECOMPRESSOR_SECTOR_COUNT * SECTOR_SIZE)
1.1 root 948: throw ParameterIncorrect (SRC_POS);
949:
1.1.1.3 root 950: memcpy (buffer + SECTOR_SIZE, decompressor, size);
1.1 root 951:
1.1.1.3 root 952: // Compressed boot loader
953: byte *bootLoader = MapResource ("BIN", bootLoaderId, &size);
954: if (!bootLoader || size > TC_MAX_BOOT_LOADER_SECTOR_COUNT * SECTOR_SIZE)
955: throw ParameterIncorrect (SRC_POS);
1.1 root 956:
1.1.1.3 root 957: memcpy (buffer + SECTOR_SIZE + TC_BOOT_LOADER_DECOMPRESSOR_SECTOR_COUNT * SECTOR_SIZE, bootLoader, size);
1.1 root 958:
1.1.1.3 root 959: // Boot loader and decompressor checksum
960: *(uint16 *) (buffer + TC_BOOT_SECTOR_LOADER_LENGTH_OFFSET) = static_cast <uint16> (size);
961: *(uint32 *) (buffer + TC_BOOT_SECTOR_LOADER_CHECKSUM_OFFSET) = GetChecksum (buffer + SECTOR_SIZE,
962: TC_BOOT_LOADER_DECOMPRESSOR_SECTOR_COUNT * SECTOR_SIZE + size);
963:
964: // Backup of decompressor and boot loader
965: if (size + TC_BOOT_LOADER_DECOMPRESSOR_SECTOR_COUNT * SECTOR_SIZE <= TC_BOOT_LOADER_BACKUP_SECTOR_COUNT * SECTOR_SIZE)
966: {
967: memcpy (buffer + SECTOR_SIZE + TC_BOOT_LOADER_BACKUP_SECTOR_COUNT * SECTOR_SIZE,
968: buffer + SECTOR_SIZE, TC_BOOT_LOADER_BACKUP_SECTOR_COUNT * SECTOR_SIZE);
969:
970: buffer[TC_BOOT_SECTOR_CONFIG_OFFSET] |= TC_BOOT_CFG_FLAG_BACKUP_LOADER_AVAILABLE;
971: }
1.1.1.5 root 972: else if (!rescueDisk && bootLoaderId != IDR_BOOT_LOADER)
1.1.1.3 root 973: {
974: throw ParameterIncorrect (SRC_POS);
975: }
976: }
977:
978:
1.1.1.8 root 979: void BootEncryption::ReadBootSectorConfig (byte *config, size_t bufLength, byte *userConfig, string *customUserMessage, uint16 *bootLoaderVersion)
1.1.1.5 root 980: {
1.1.1.6 root 981: if (config && bufLength < TC_BOOT_CFG_FLAG_AREA_SIZE)
1.1.1.5 root 982: throw ParameterIncorrect (SRC_POS);
983:
984: GetSystemDriveConfigurationRequest request;
985: _snwprintf (request.DevicePath, array_capacity (request.DevicePath), L"%hs", GetSystemDriveConfiguration().DeviceKernelPath.c_str());
986:
987: try
988: {
989: CallDriver (TC_IOCTL_GET_SYSTEM_DRIVE_CONFIG, &request, sizeof (request), &request, sizeof (request));
1.1.1.6 root 990: if (config)
991: *config = request.Configuration;
992:
993: if (userConfig)
994: *userConfig = request.UserConfiguration;
995:
996: if (customUserMessage)
997: {
998: request.CustomUserMessage[TC_BOOT_SECTOR_USER_MESSAGE_MAX_LENGTH] = 0;
999: *customUserMessage = request.CustomUserMessage;
1000: }
1.1.1.8 root 1001:
1002: if (bootLoaderVersion)
1003: *bootLoaderVersion = request.BootLoaderVersion;
1.1.1.5 root 1004: }
1005: catch (...)
1006: {
1.1.1.6 root 1007: if (config)
1008: *config = 0;
1009:
1010: if (userConfig)
1011: *userConfig = 0;
1012:
1013: if (customUserMessage)
1014: customUserMessage->clear();
1.1.1.8 root 1015:
1016: if (bootLoaderVersion)
1017: *bootLoaderVersion = 0;
1.1.1.5 root 1018: }
1019: }
1020:
1021:
1022: void BootEncryption::WriteBootSectorConfig (const byte newConfig[])
1023: {
1024: Device device (GetSystemDriveConfiguration().DevicePath);
1025: byte mbr[SECTOR_SIZE];
1026:
1027: device.SeekAt (0);
1028: device.Read (mbr, sizeof (mbr));
1029:
1030: memcpy (mbr + TC_BOOT_SECTOR_CONFIG_OFFSET, newConfig, TC_BOOT_CFG_FLAG_AREA_SIZE);
1031:
1032: device.SeekAt (0);
1033: device.Write (mbr, sizeof (mbr));
1034:
1035: byte mbrVerificationBuf[SECTOR_SIZE];
1036: device.SeekAt (0);
1037: device.Read (mbrVerificationBuf, sizeof (mbr));
1038:
1039: if (memcmp (mbr, mbrVerificationBuf, sizeof (mbr)) != 0)
1040: throw ErrorException ("ERROR_MBR_PROTECTED");
1041: }
1042:
1043:
1.1.1.6 root 1044: void BootEncryption::WriteBootSectorUserConfig (byte userConfig, const string &customUserMessage)
1045: {
1046: Device device (GetSystemDriveConfiguration().DevicePath);
1047: byte mbr[SECTOR_SIZE];
1048:
1049: device.SeekAt (0);
1050: device.Read (mbr, sizeof (mbr));
1051:
1.1.1.8 root 1052: if (!BufferContainsString (mbr, sizeof (mbr), TC_APP_NAME)
1053: || BE16 (*(uint16 *) (mbr + TC_BOOT_SECTOR_VERSION_OFFSET)) > VERSION_NUM)
1054: {
1055: return;
1056: }
1057:
1.1.1.6 root 1058: mbr[TC_BOOT_SECTOR_USER_CONFIG_OFFSET] = userConfig;
1059:
1060: memset (mbr + TC_BOOT_SECTOR_USER_MESSAGE_OFFSET, 0, TC_BOOT_SECTOR_USER_MESSAGE_MAX_LENGTH);
1061:
1062: if (!customUserMessage.empty())
1063: {
1064: if (customUserMessage.size() > TC_BOOT_SECTOR_USER_MESSAGE_MAX_LENGTH)
1065: throw ParameterIncorrect (SRC_POS);
1066:
1067: memcpy (mbr + TC_BOOT_SECTOR_USER_MESSAGE_OFFSET, customUserMessage.c_str(), customUserMessage.size());
1068: }
1069:
1070: device.SeekAt (0);
1071: device.Write (mbr, sizeof (mbr));
1072:
1073: byte mbrVerificationBuf[SECTOR_SIZE];
1074: device.SeekAt (0);
1075: device.Read (mbrVerificationBuf, sizeof (mbr));
1076:
1077: if (memcmp (mbr, mbrVerificationBuf, sizeof (mbr)) != 0)
1078: throw ErrorException ("ERROR_MBR_PROTECTED");
1079: }
1080:
1081:
1.1.1.5 root 1082: unsigned int BootEncryption::GetHiddenOSCreationPhase ()
1083: {
1084: byte configFlags [TC_BOOT_CFG_FLAG_AREA_SIZE];
1085:
1086: ReadBootSectorConfig (configFlags, sizeof(configFlags));
1087:
1088: return (configFlags[0] & TC_BOOT_CFG_MASK_HIDDEN_OS_CREATION_PHASE);
1089: }
1090:
1091:
1092: void BootEncryption::SetHiddenOSCreationPhase (unsigned int newPhase)
1093: {
1094: #if TC_BOOT_CFG_FLAG_AREA_SIZE != 1
1095: # error TC_BOOT_CFG_FLAG_AREA_SIZE != 1; revise GetHiddenOSCreationPhase() and SetHiddenOSCreationPhase()
1096: #endif
1097: byte configFlags [TC_BOOT_CFG_FLAG_AREA_SIZE];
1098:
1099: ReadBootSectorConfig (configFlags, sizeof(configFlags));
1100:
1101: configFlags[0] &= (byte) ~TC_BOOT_CFG_MASK_HIDDEN_OS_CREATION_PHASE;
1102:
1103: configFlags[0] |= newPhase;
1104:
1105: WriteBootSectorConfig (configFlags);
1106: }
1107:
1108:
1.1.1.6 root 1109: #ifndef SETUP
1110:
1111: void BootEncryption::StartDecoyOSWipe (WipeAlgorithmId wipeAlgorithm)
1112: {
1113: if (!IsHiddenOSRunning())
1114: throw ParameterIncorrect (SRC_POS);
1115:
1116: WipeDecoySystemRequest request;
1117: ZeroMemory (&request, sizeof (request));
1118:
1119: request.WipeAlgorithm = wipeAlgorithm;
1120:
1121: if (Randinit() != ERR_SUCCESS)
1122: throw ParameterIncorrect (SRC_POS);
1123:
1.1.1.8 root 1124: UserEnrichRandomPool (ParentWindow);
1125:
1.1.1.6 root 1126: if (!RandgetBytes (request.WipeKey, sizeof (request.WipeKey), TRUE))
1127: throw ParameterIncorrect (SRC_POS);
1128:
1129: CallDriver (TC_IOCTL_START_DECOY_SYSTEM_WIPE, &request, sizeof (request), NULL, 0);
1130:
1131: burn (&request, sizeof (request));
1132: }
1133:
1134:
1135: void BootEncryption::AbortDecoyOSWipe ()
1136: {
1137: CallDriver (TC_IOCTL_ABORT_DECOY_SYSTEM_WIPE);
1138: }
1139:
1140:
1141: DecoySystemWipeStatus BootEncryption::GetDecoyOSWipeStatus ()
1142: {
1143: DecoySystemWipeStatus status;
1144: CallDriver (TC_IOCTL_GET_DECOY_SYSTEM_WIPE_STATUS, NULL, 0, &status, sizeof (status));
1145: return status;
1146: }
1147:
1148:
1149: void BootEncryption::CheckDecoyOSWipeResult ()
1150: {
1151: CallDriver (TC_IOCTL_GET_DECOY_SYSTEM_WIPE_RESULT);
1152: }
1153:
1154:
1155: void BootEncryption::WipeHiddenOSCreationConfig ()
1156: {
1157: if (IsHiddenOSRunning() || Randinit() != ERR_SUCCESS)
1158: throw ParameterIncorrect (SRC_POS);
1159:
1160: Device device (GetSystemDriveConfiguration().DevicePath);
1161: byte mbr[SECTOR_SIZE];
1162:
1163: device.SeekAt (0);
1164: device.Read (mbr, sizeof (mbr));
1165:
1166: finally_do_arg (BootEncryption *, this,
1167: {
1168: try
1169: {
1170: finally_arg->SetHiddenOSCreationPhase (TC_HIDDEN_OS_CREATION_PHASE_NONE);
1171: } catch (...) { }
1172: });
1173:
1174: #if PRAND_DISK_WIPE_PASSES > RNG_POOL_SIZE
1175: # error PRAND_DISK_WIPE_PASSES > RNG_POOL_SIZE
1176: #endif
1177:
1178: byte randData[PRAND_DISK_WIPE_PASSES];
1179: if (!RandgetBytes (randData, sizeof (randData), FALSE))
1180: throw ParameterIncorrect (SRC_POS);
1181:
1182: for (int wipePass = 0; wipePass < PRAND_DISK_WIPE_PASSES; wipePass++)
1183: {
1184: for (int i = 0; i < TC_BOOT_SECTOR_OUTER_VOLUME_BAK_HEADER_CRC_SIZE; ++i)
1185: {
1186: mbr[TC_BOOT_SECTOR_OUTER_VOLUME_BAK_HEADER_CRC_OFFSET + i] = randData[wipePass];
1187: }
1188:
1189: mbr[TC_BOOT_SECTOR_CONFIG_OFFSET] &= (byte) ~TC_BOOT_CFG_MASK_HIDDEN_OS_CREATION_PHASE;
1190: mbr[TC_BOOT_SECTOR_CONFIG_OFFSET] |= randData[wipePass] & TC_BOOT_CFG_MASK_HIDDEN_OS_CREATION_PHASE;
1191:
1192: if (wipePass == PRAND_DISK_WIPE_PASSES - 1)
1193: memset (mbr + TC_BOOT_SECTOR_OUTER_VOLUME_BAK_HEADER_CRC_OFFSET, 0, TC_BOOT_SECTOR_OUTER_VOLUME_BAK_HEADER_CRC_SIZE);
1194:
1195: device.SeekAt (0);
1196: device.Write (mbr, sizeof (mbr));
1197: }
1198:
1199: for (int wipePass = 0; wipePass < PRAND_DISK_WIPE_PASSES/4 + 1; wipePass++)
1200: {
1201: SetHiddenOSCreationPhase (TC_HIDDEN_OS_CREATION_PHASE_NONE);
1202: SetHiddenOSCreationPhase (TC_HIDDEN_OS_CREATION_PHASE_CLONING);
1203: SetHiddenOSCreationPhase (TC_HIDDEN_OS_CREATION_PHASE_WIPING);
1204: SetHiddenOSCreationPhase (TC_HIDDEN_OS_CREATION_PHASE_WIPED);
1205: }
1206: SetHiddenOSCreationPhase (TC_HIDDEN_OS_CREATION_PHASE_NONE);
1207: }
1208:
1209: #endif // !SETUP
1210:
1211:
1212: void BootEncryption::InstallBootLoader (bool preserveUserConfig, bool hiddenOSCreation)
1.1.1.3 root 1213: {
1.1.1.5 root 1214: byte bootLoaderBuf[TC_BOOT_LOADER_AREA_SIZE - TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE];
1.1.1.6 root 1215: CreateBootLoaderInMemory (bootLoaderBuf, sizeof (bootLoaderBuf), false, hiddenOSCreation);
1.1.1.3 root 1216:
1217: // Write MBR
1218: Device device (GetSystemDriveConfiguration().DevicePath);
1219: byte mbr[SECTOR_SIZE];
1.1 root 1220:
1221: device.SeekAt (0);
1.1.1.3 root 1222: device.Read (mbr, sizeof (mbr));
1.1 root 1223:
1.1.1.8 root 1224: if (preserveUserConfig && BufferContainsString (mbr, sizeof (mbr), TC_APP_NAME))
1.1.1.6 root 1225: {
1226: uint16 version = BE16 (*(uint16 *) (mbr + TC_BOOT_SECTOR_VERSION_OFFSET));
1227: if (version != 0)
1228: {
1229: bootLoaderBuf[TC_BOOT_SECTOR_USER_CONFIG_OFFSET] = mbr[TC_BOOT_SECTOR_USER_CONFIG_OFFSET];
1230: memcpy (bootLoaderBuf + TC_BOOT_SECTOR_USER_MESSAGE_OFFSET, mbr + TC_BOOT_SECTOR_USER_MESSAGE_OFFSET, TC_BOOT_SECTOR_USER_MESSAGE_MAX_LENGTH);
1231: }
1232: }
1233:
1.1.1.3 root 1234: memcpy (mbr, bootLoaderBuf, TC_MAX_MBR_BOOT_CODE_SIZE);
1.1 root 1235:
1.1.1.3 root 1236: device.SeekAt (0);
1237: device.Write (mbr, sizeof (mbr));
1.1 root 1238:
1.1.1.3 root 1239: byte mbrVerificationBuf[SECTOR_SIZE];
1240: device.SeekAt (0);
1241: device.Read (mbrVerificationBuf, sizeof (mbr));
1.1 root 1242:
1.1.1.3 root 1243: if (memcmp (mbr, mbrVerificationBuf, sizeof (mbr)) != 0)
1244: throw ErrorException ("ERROR_MBR_PROTECTED");
1.1 root 1245:
1.1.1.3 root 1246: // Write boot loader
1.1 root 1247: device.SeekAt (SECTOR_SIZE);
1.1.1.3 root 1248: device.Write (bootLoaderBuf + SECTOR_SIZE, sizeof (bootLoaderBuf) - SECTOR_SIZE);
1.1 root 1249: }
1250:
1251:
1252: string BootEncryption::GetSystemLoaderBackupPath ()
1253: {
1254: char pathBuf[MAX_PATH];
1255:
1256: throw_sys_if (!SUCCEEDED (SHGetFolderPath (NULL, CSIDL_COMMON_APPDATA | CSIDL_FLAG_CREATE, NULL, 0, pathBuf)));
1257:
1258: string path = string (pathBuf) + "\\" TC_APP_NAME;
1259: CreateDirectory (path.c_str(), NULL);
1260:
1261: return path + '\\' + TC_SYS_BOOT_LOADER_BACKUP_NAME;
1262: }
1263:
1.1.1.3 root 1264:
1.1.1.5 root 1265: void BootEncryption::RenameDeprecatedSystemLoaderBackup ()
1266: {
1267: char pathBuf[MAX_PATH];
1268:
1269: if (SUCCEEDED (SHGetFolderPath (NULL, CSIDL_COMMON_APPDATA, NULL, 0, pathBuf)))
1270: {
1271: string path = string (pathBuf) + "\\" TC_APP_NAME + '\\' + TC_SYS_BOOT_LOADER_BACKUP_NAME_LEGACY;
1272:
1273: if (FileExists (path.c_str()) && !FileExists (GetSystemLoaderBackupPath().c_str()))
1274: throw_sys_if (rename (path.c_str(), GetSystemLoaderBackupPath().c_str()) != 0);
1275: }
1276: }
1277:
1278:
1.1.1.2 root 1279: #ifndef SETUP
1.1 root 1280: void BootEncryption::CreateRescueIsoImage (bool initialSetup, const string &isoImagePath)
1281: {
1282: BootEncryptionStatus encStatus = GetStatus();
1283: if (encStatus.SetupInProgress)
1284: throw ParameterIncorrect (SRC_POS);
1285:
1286: Buffer imageBuf (RescueIsoImageSize);
1287:
1288: byte *image = imageBuf.Ptr();
1289: memset (image, 0, RescueIsoImageSize);
1290:
1291: // Primary volume descriptor
1.1.1.2 root 1292: strcpy ((char *)image + 0x8000, "\001CD001\001");
1293: strcpy ((char *)image + 0x7fff + 41, "TrueCrypt Rescue Disk ");
1294: *(uint32 *) (image + 0x7fff + 81) = RescueIsoImageSize / 2048;
1295: *(uint32 *) (image + 0x7fff + 85) = BE32 (RescueIsoImageSize / 2048);
1296: image[0x7fff + 121] = 1;
1297: image[0x7fff + 124] = 1;
1298: image[0x7fff + 125] = 1;
1299: image[0x7fff + 128] = 1;
1300: image[0x7fff + 130] = 8;
1301: image[0x7fff + 131] = 8;
1302:
1303: image[0x7fff + 133] = 10;
1304: image[0x7fff + 140] = 10;
1305: image[0x7fff + 141] = 0x14;
1306: image[0x7fff + 157] = 0x22;
1307: image[0x7fff + 159] = 0x18;
1.1 root 1308:
1309: // Boot record volume descriptor
1310: strcpy ((char *)image + 0x8801, "CD001\001EL TORITO SPECIFICATION");
1311: image[0x8800 + 0x47] = 0x19;
1312:
1.1.1.2 root 1313: // Volume descriptor set terminator
1314: strcpy ((char *)image + 0x9000, "\377CD001\001");
1315:
1316: // Path table
1317: image[0xA000 + 0] = 1;
1318: image[0xA000 + 2] = 0x18;
1319: image[0xA000 + 6] = 1;
1320:
1321: // Root directory
1322: image[0xc000 + 0] = 0x22;
1323: image[0xc000 + 2] = 0x18;
1324: image[0xc000 + 9] = 0x18;
1325: image[0xc000 + 11] = 0x08;
1326: image[0xc000 + 16] = 0x08;
1327: image[0xc000 + 25] = 0x02;
1328: image[0xc000 + 28] = 0x01;
1329: image[0xc000 + 31] = 0x01;
1330: image[0xc000 + 32] = 0x01;
1331: image[0xc000 + 34] = 0x22;
1332: image[0xc000 + 36] = 0x18;
1333: image[0xc000 + 43] = 0x18;
1334: image[0xc000 + 45] = 0x08;
1335: image[0xc000 + 50] = 0x08;
1336: image[0xc000 + 59] = 0x02;
1337: image[0xc000 + 62] = 0x01;
1338: *(uint32 *) (image + 0xc000 + 65) = 0x010101;
1339:
1.1 root 1340: // Validation entry
1341: image[0xc800] = 1;
1.1.1.2 root 1342: int offset = 0xc800 + 0x1c;
1.1 root 1343: image[offset++] = 0xaa;
1344: image[offset++] = 0x55;
1345: image[offset++] = 0x55;
1346: image[offset] = 0xaa;
1347:
1348: // Initial entry
1349: offset = 0xc820;
1350: image[offset++] = 0x88;
1351: image[offset++] = 2;
1352: image[0xc820 + 6] = 1;
1353: image[0xc820 + 8] = TC_CD_BOOT_LOADER_SECTOR;
1354:
1355: // TrueCrypt Boot Loader
1.1.1.5 root 1356: CreateBootLoaderInMemory (image + TC_CD_BOOTSECTOR_OFFSET, TC_BOOT_LOADER_AREA_SIZE, true);
1.1 root 1357:
1358: // Volume header
1359: if (initialSetup)
1360: {
1361: if (!RescueVolumeHeaderValid)
1362: throw ParameterIncorrect (SRC_POS);
1363:
1.1.1.5 root 1364: memcpy (image + TC_CD_BOOTSECTOR_OFFSET + TC_BOOT_VOLUME_HEADER_SECTOR_OFFSET, RescueVolumeHeader, TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);
1.1 root 1365: }
1366: else
1367: {
1368: Device bootDevice (GetSystemDriveConfiguration().DevicePath, true);
1369: bootDevice.SeekAt (TC_BOOT_VOLUME_HEADER_SECTOR_OFFSET);
1.1.1.5 root 1370: bootDevice.Read (image + TC_CD_BOOTSECTOR_OFFSET + TC_BOOT_VOLUME_HEADER_SECTOR_OFFSET, TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);
1.1 root 1371: }
1372:
1373: // Original system loader
1374: try
1375: {
1376: File sysBakFile (GetSystemLoaderBackupPath(), true);
1377: sysBakFile.Read (image + TC_CD_BOOTSECTOR_OFFSET + TC_ORIG_BOOT_LOADER_BACKUP_SECTOR_OFFSET, TC_BOOT_LOADER_AREA_SIZE);
1378:
1379: image[TC_CD_BOOTSECTOR_OFFSET + TC_BOOT_SECTOR_CONFIG_OFFSET] |= TC_BOOT_CFG_FLAG_RESCUE_DISK_ORIG_SYS_LOADER;
1380: }
1381: catch (Exception &e)
1382: {
1383: e.Show (ParentWindow);
1384: Warning ("SYS_LOADER_UNAVAILABLE_FOR_RESCUE_DISK");
1385: }
1386:
1.1.1.5 root 1387: // Boot loader backup
1388: CreateBootLoaderInMemory (image + TC_CD_BOOTSECTOR_OFFSET + TC_BOOT_LOADER_BACKUP_RESCUE_DISK_SECTOR_OFFSET, TC_BOOT_LOADER_AREA_SIZE, false);
1389:
1.1 root 1390: RescueIsoImage = new byte[RescueIsoImageSize];
1391: if (!RescueIsoImage)
1392: throw bad_alloc();
1393: memcpy (RescueIsoImage, image, RescueIsoImageSize);
1394:
1395: if (!isoImagePath.empty())
1396: {
1397: File isoFile (isoImagePath, false, true);
1398: isoFile.Write (image, RescueIsoImageSize);
1399: }
1400: }
1.1.1.2 root 1401: #endif
1.1 root 1402:
1403: bool BootEncryption::VerifyRescueDisk ()
1404: {
1405: if (!RescueIsoImage)
1406: throw ParameterIncorrect (SRC_POS);
1407:
1408: for (char drive = 'Z'; drive >= 'D'; --drive)
1409: {
1410: try
1411: {
1412: string path = "X:";
1413: path[0] = drive;
1414:
1415: Device driveDevice (path, true);
1416: size_t verifiedSectorCount = (TC_CD_BOOTSECTOR_OFFSET + TC_ORIG_BOOT_LOADER_BACKUP_SECTOR_OFFSET + TC_BOOT_LOADER_AREA_SIZE) / 2048;
1417: Buffer buffer ((verifiedSectorCount + 1) * 2048);
1418:
1419: DWORD bytesRead = driveDevice.Read (buffer.Ptr(), buffer.Size());
1420: if (bytesRead != buffer.Size())
1421: continue;
1422:
1423: if (memcmp (buffer.Ptr(), RescueIsoImage, buffer.Size()) == 0)
1424: return true;
1425: }
1426: catch (...) { }
1427: }
1428:
1429: return false;
1430: }
1431:
1432:
1433: #ifndef SETUP
1434:
1435: void BootEncryption::CreateVolumeHeader (uint64 volumeSize, uint64 encryptedAreaStart, Password *password, int ea, int mode, int pkcs5)
1436: {
1437: PCRYPTO_INFO cryptoInfo = NULL;
1.1.1.5 root 1438:
1.1.1.8 root 1439: if (!IsRandomNumberGeneratorStarted())
1440: throw ParameterIncorrect (SRC_POS);
1441:
1.1.1.6 root 1442: throw_sys_if (CreateVolumeHeaderInMemory (TRUE, (char *) VolumeHeader, ea, mode, password, pkcs5, NULL, &cryptoInfo,
1.1.1.5 root 1443: volumeSize, 0, encryptedAreaStart, 0, TC_SYSENC_KEYSCOPE_MIN_REQ_PROG_VERSION, TC_HEADER_FLAG_ENCRYPTED_SYSTEM, FALSE) != 0);
1.1 root 1444:
1445: finally_do_arg (PCRYPTO_INFO*, &cryptoInfo, { crypto_close (*finally_arg); });
1446:
1447: // Initial rescue disk assumes encryption of the drive has been completed (EncryptedAreaLength == volumeSize)
1448: memcpy (RescueVolumeHeader, VolumeHeader, sizeof (RescueVolumeHeader));
1.1.1.6 root 1449: ReadVolumeHeader (TRUE, (char *) RescueVolumeHeader, password, NULL, cryptoInfo);
1.1 root 1450:
1451: DecryptBuffer (RescueVolumeHeader + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, cryptoInfo);
1452:
1453: if (GetHeaderField32 (RescueVolumeHeader, TC_HEADER_OFFSET_MAGIC) != 0x54525545)
1454: throw ParameterIncorrect (SRC_POS);
1455:
1456: byte *fieldPos = RescueVolumeHeader + TC_HEADER_OFFSET_ENCRYPTED_AREA_LENGTH;
1457: mputInt64 (fieldPos, volumeSize);
1.1.1.5 root 1458:
1459: // CRC of the header fields
1460: uint32 crc = GetCrc32 (RescueVolumeHeader + TC_HEADER_OFFSET_MAGIC, TC_HEADER_OFFSET_HEADER_CRC - TC_HEADER_OFFSET_MAGIC);
1461: fieldPos = RescueVolumeHeader + TC_HEADER_OFFSET_HEADER_CRC;
1462: mputLong (fieldPos, crc);
1463:
1.1 root 1464: EncryptBuffer (RescueVolumeHeader + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, cryptoInfo);
1465:
1466: VolumeHeaderValid = true;
1467: RescueVolumeHeaderValid = true;
1468: }
1469:
1470:
1471: void BootEncryption::InstallVolumeHeader ()
1472: {
1473: if (!VolumeHeaderValid)
1474: throw ParameterIncorrect (SRC_POS);
1475:
1476: Device device (GetSystemDriveConfiguration().DevicePath);
1477:
1478: device.SeekAt (TC_BOOT_VOLUME_HEADER_SECTOR_OFFSET);
1479: device.Write ((byte *) VolumeHeader, sizeof (VolumeHeader));
1480: }
1481:
1482:
1483: // For synchronous operations use AbortSetupWait()
1484: void BootEncryption::AbortSetup ()
1485: {
1486: CallDriver (TC_IOCTL_ABORT_BOOT_ENCRYPTION_SETUP);
1487: }
1488:
1489:
1490: // For asynchronous operations use AbortSetup()
1491: void BootEncryption::AbortSetupWait ()
1492: {
1493: CallDriver (TC_IOCTL_ABORT_BOOT_ENCRYPTION_SETUP);
1494:
1495: BootEncryptionStatus encStatus = GetStatus();
1496:
1497: while (encStatus.SetupInProgress)
1498: {
1499: Sleep (TC_ABORT_TRANSFORM_WAIT_INTERVAL);
1500: encStatus = GetStatus();
1501: }
1502: }
1503:
1504:
1505: void BootEncryption::BackupSystemLoader ()
1506: {
1507: Device device (GetSystemDriveConfiguration().DevicePath, true);
1508:
1509: byte bootLoaderBuf[TC_BOOT_LOADER_AREA_SECTOR_COUNT * SECTOR_SIZE];
1510:
1511: device.SeekAt (0);
1512: device.Read (bootLoaderBuf, sizeof (bootLoaderBuf));
1513:
1514: // Prevent TrueCrypt loader from being backed up
1515: for (size_t i = 0; i < sizeof (bootLoaderBuf) - strlen (TC_APP_NAME); ++i)
1516: {
1517: if (memcmp (bootLoaderBuf + i, TC_APP_NAME, strlen (TC_APP_NAME)) == 0)
1518: {
1519: if (AskWarnNoYes ("TC_BOOT_LOADER_ALREADY_INSTALLED") == IDNO)
1520: throw UserAbort (SRC_POS);
1521: return;
1522: }
1523: }
1524:
1525: File backupFile (GetSystemLoaderBackupPath(), false, true);
1526: backupFile.Write (bootLoaderBuf, sizeof (bootLoaderBuf));
1527: }
1528:
1529:
1530: void BootEncryption::RestoreSystemLoader ()
1531: {
1532: byte bootLoaderBuf[TC_BOOT_LOADER_AREA_SECTOR_COUNT * SECTOR_SIZE];
1533:
1534: File backupFile (GetSystemLoaderBackupPath(), true);
1535:
1536: if (backupFile.Read (bootLoaderBuf, sizeof (bootLoaderBuf)) != sizeof (bootLoaderBuf))
1537: throw ParameterIncorrect (SRC_POS);
1538:
1539: Device device (GetSystemDriveConfiguration().DevicePath);
1.1.1.4 root 1540:
1541: // Preserve current partition table
1542: byte mbr[SECTOR_SIZE];
1543: device.SeekAt (0);
1544: device.Read (mbr, sizeof (mbr));
1545: memcpy (bootLoaderBuf + TC_MAX_MBR_BOOT_CODE_SIZE, mbr + TC_MAX_MBR_BOOT_CODE_SIZE, sizeof (mbr) - TC_MAX_MBR_BOOT_CODE_SIZE);
1546:
1.1 root 1547: device.SeekAt (0);
1548: device.Write (bootLoaderBuf, sizeof (bootLoaderBuf));
1549: }
1550:
1.1.1.3 root 1551: #endif // SETUP
1.1 root 1552:
1.1.1.5 root 1553: void BootEncryption::RegisterDeviceClassFilter (bool registerFilter, const GUID *deviceClassGuid)
1.1 root 1554: {
1.1.1.5 root 1555: HKEY classRegKey = SetupDiOpenClassRegKey (deviceClassGuid, KEY_READ | KEY_WRITE);
1.1 root 1556: throw_sys_if (classRegKey == INVALID_HANDLE_VALUE);
1557: finally_do_arg (HKEY, classRegKey, { RegCloseKey (finally_arg); });
1558:
1.1.1.5 root 1559: if (registerFilter)
1.1 root 1560: {
1.1.1.5 root 1561: // Register class filter below all other filters in the stack
1562:
1.1 root 1563: size_t strSize = strlen ("truecrypt") + 1;
1564: byte regKeyBuf[65536];
1565: DWORD size = sizeof (regKeyBuf) - strSize;
1566:
1567: // SetupInstallFromInfSection() does not support prepending of values so we have to modify the registry directly
1568: strncpy ((char *) regKeyBuf, "truecrypt", sizeof (regKeyBuf));
1569:
1570: if (RegQueryValueEx (classRegKey, "UpperFilters", NULL, NULL, regKeyBuf + strSize, &size) != ERROR_SUCCESS)
1571: size = 1;
1572:
1573: throw_sys_if (RegSetValueEx (classRegKey, "UpperFilters", 0, REG_MULTI_SZ, regKeyBuf, strSize + size) != ERROR_SUCCESS);
1574: }
1575: else
1576: {
1.1.1.5 root 1577: // Unregister a class filter
1.1.1.6 root 1578: string infFileName = GetTempPath() + "\\truecrypt_device_filter.inf";
1.1 root 1579:
1580: File infFile (infFileName, false, true);
1.1.1.5 root 1581: finally_do_arg (string, infFileName, { DeleteFile (finally_arg.c_str()); });
1.1 root 1582:
1.1.1.5 root 1583: string infTxt = "[truecrypt]\r\n"
1584: "DelReg=truecrypt_reg\r\n\r\n"
1585: "[truecrypt_reg]\r\n"
1586: "HKR,,\"UpperFilters\",0x00018002,\"truecrypt\"\r\n";
1.1 root 1587:
1588: infFile.Write ((byte *) infTxt.c_str(), infTxt.size());
1589: infFile.Close();
1590:
1591: HINF hInf = SetupOpenInfFile (infFileName.c_str(), NULL, INF_STYLE_OLDNT | INF_STYLE_WIN4, NULL);
1592: throw_sys_if (hInf == INVALID_HANDLE_VALUE);
1593: finally_do_arg (HINF, hInf, { SetupCloseInfFile (finally_arg); });
1594:
1595: throw_sys_if (!SetupInstallFromInfSection (ParentWindow, hInf, "truecrypt", SPINST_REGISTRY, classRegKey, NULL, 0, NULL, NULL, NULL, NULL));
1596: }
1597: }
1.1.1.5 root 1598:
1599: void BootEncryption::RegisterFilterDriver (bool registerDriver, bool volumeClass)
1600: {
1601: if (!IsAdmin() && IsUacSupported())
1602: {
1603: Elevator::RegisterFilterDriver (registerDriver, volumeClass);
1604: return;
1605: }
1606:
1607: if (volumeClass)
1608: {
1609: RegisterDeviceClassFilter (registerDriver, &GUID_DEVCLASS_VOLUME);
1610: RegisterDeviceClassFilter (registerDriver, &GUID_DEVCLASS_FLOPPYDISK);
1611: }
1612: else
1613: {
1614: RegisterDeviceClassFilter (registerDriver, &GUID_DEVCLASS_DISKDRIVE);
1615: }
1616: }
1.1 root 1617:
1.1.1.3 root 1618: #ifndef SETUP
1.1 root 1619:
1620: void BootEncryption::CheckRequirements ()
1621: {
1622: if (nCurrentOS == WIN_2000)
1623: throw ErrorException ("SYS_ENCRYPTION_UNSUPPORTED_ON_CURRENT_OS");
1.1.1.8 root 1624:
1625: if (CurrentOSMajor == 6 && CurrentOSMinor == 0 && CurrentOSServicePack < 1)
1626: throw ErrorException ("SYS_ENCRYPTION_UNSUPPORTED_ON_VISTA_SP0");
1.1 root 1627:
1628: if (IsNonInstallMode())
1629: throw ErrorException ("FEATURE_REQUIRES_INSTALLATION");
1630:
1631: SystemDriveConfiguration config = GetSystemDriveConfiguration ();
1632:
1633: if (config.SystemPartition.IsGPT)
1634: throw ErrorException ("GPT_BOOT_DRIVE_UNSUPPORTED");
1635:
1.1.1.5 root 1636: if (SystemDriveIsDynamic())
1637: throw ErrorException ("SYSENC_UNSUPPORTED_FOR_DYNAMIC_DISK");
1638:
1.1 root 1639: if (config.InitialUnallocatedSpace < TC_BOOT_LOADER_AREA_SIZE)
1640: throw ErrorException ("NO_SPACE_FOR_BOOT_LOADER");
1641:
1642: DISK_GEOMETRY geometry = GetDriveGeometry (config.DriveNumber);
1643:
1644: if (geometry.BytesPerSector != SECTOR_SIZE)
1645: throw ErrorException ("LARGE_SECTOR_UNSUPPORTED");
1646:
1647: if (!config.SystemLoaderPresent)
1648: throw ErrorException ("WINDOWS_NOT_ON_BOOT_DRIVE_ERROR");
1.1.1.5 root 1649:
1650: if (!config.SystemPartition.IsGPT)
1651: {
1652: // Determine whether there is an Active partition on the system drive
1653: bool activePartitionFound = false;
1654: foreach (const Partition &partition, config.Partitions)
1655: {
1656: if (partition.Info.BootIndicator)
1657: {
1658: activePartitionFound = true;
1659: break;
1660: }
1661: }
1662:
1663: if (!activePartitionFound)
1664: throw ErrorException ("WINDOWS_NOT_ON_BOOT_DRIVE_ERROR");
1665: }
1666: }
1667:
1668:
1669: void BootEncryption::CheckRequirementsHiddenOS ()
1670: {
1671: // It is assumed that CheckRequirements() had been called (so we don't check e.g. whether it's GPT).
1672:
1673: // The user may have modified/added/deleted partitions since the partition table was last scanned.
1674: InvalidateCachedSysDriveProperties ();
1675:
1676: GetPartitionForHiddenOS ();
1.1 root 1677: }
1678:
1679:
1.1.1.6 root 1680: void BootEncryption::InitialSecurityChecksForHiddenOS ()
1681: {
1682: char windowsDrive = toupper (GetWindowsDirectory()[0]);
1683:
1684: // Paging files
1.1.1.8 root 1685: bool pagingFilesOk = !IsPagingFileActive (TRUE);
1.1.1.6 root 1686:
1687: char pagingFileRegData[65536];
1688: DWORD pagingFileRegDataSize = sizeof (pagingFileRegData);
1689:
1690: if (ReadLocalMachineRegistryMultiString ("System\\CurrentControlSet\\Control\\Session Manager\\Memory Management", "PagingFiles", pagingFileRegData, &pagingFileRegDataSize)
1691: && pagingFileRegDataSize > 4)
1692: {
1693: for (size_t i = 1; i < pagingFileRegDataSize - 2; ++i)
1694: {
1695: if (memcmp (pagingFileRegData + i, ":\\", 2) == 0 && toupper (pagingFileRegData[i - 1]) != windowsDrive)
1696: {
1.1.1.8 root 1697: pagingFilesOk = false;
1698: break;
1.1.1.6 root 1699: }
1700: }
1701: }
1702:
1.1.1.8 root 1703: if (!pagingFilesOk)
1704: {
1705: if (AskWarnYesNoString ((wchar_t *) (wstring (GetString ("PAGING_FILE_NOT_ON_SYS_PARTITION"))
1706: + GetString ("LEAKS_OUTSIDE_SYSPART_UNIVERSAL_EXPLANATION")
1707: + L"\n\n\n"
1708: + GetString ("RESTRICT_PAGING_FILES_TO_SYS_PARTITION")
1709: ).c_str()) == IDYES)
1710: {
1711: RestrictPagingFilesToSystemPartition();
1712: RestartComputer();
1713: AbortProcessSilent();
1714: }
1715:
1716: throw ErrorException (wstring (GetString ("PAGING_FILE_NOT_ON_SYS_PARTITION"))
1717: + GetString ("LEAKS_OUTSIDE_SYSPART_UNIVERSAL_EXPLANATION"));
1718: }
1719:
1.1.1.6 root 1720: // User profile
1721: char *configPath = GetConfigPath ("dummy");
1722: if (configPath && toupper (configPath[0]) != windowsDrive)
1723: {
1724: throw ErrorException (wstring (GetString ("USER_PROFILE_NOT_ON_SYS_PARTITION"))
1725: + GetString ("LEAKS_OUTSIDE_SYSPART_UNIVERSAL_EXPLANATION"));
1726: }
1727:
1728: // Temporary files
1729: if (toupper (GetTempPath()[0]) != windowsDrive)
1730: {
1731: throw ErrorException (wstring (GetString ("TEMP_NOT_ON_SYS_PARTITION"))
1732: + GetString ("LEAKS_OUTSIDE_SYSPART_UNIVERSAL_EXPLANATION"));
1733: }
1734: }
1735:
1736:
1.1 root 1737: void BootEncryption::Deinstall ()
1738: {
1739: BootEncryptionStatus encStatus = GetStatus();
1740:
1741: if (encStatus.DriveEncrypted || encStatus.DriveMounted)
1742: throw ParameterIncorrect (SRC_POS);
1743:
1744: SystemDriveConfiguration config = GetSystemDriveConfiguration ();
1745:
1746: if (encStatus.VolumeHeaderPresent)
1747: {
1748: // Verify CRC of header salt
1749: Device device (config.DevicePath, true);
1.1.1.5 root 1750: byte header[TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE];
1.1 root 1751:
1752: device.SeekAt (TC_BOOT_VOLUME_HEADER_SECTOR_OFFSET);
1753: device.Read (header, sizeof (header));
1754:
1755: if (encStatus.VolumeHeaderSaltCrc32 != GetCrc32 ((byte *) header, PKCS5_SALT_SIZE))
1756: throw ParameterIncorrect (SRC_POS);
1757: }
1758:
1.1.1.5 root 1759: RegisterFilterDriver (false, false);
1760: RegisterFilterDriver (false, true);
1.1 root 1761: SetDriverServiceStartType (SERVICE_SYSTEM_START);
1762:
1.1.1.5 root 1763: SetHiddenOSCreationPhase (TC_HIDDEN_OS_CREATION_PHASE_NONE); // In case RestoreSystemLoader() fails
1764:
1.1 root 1765: try
1766: {
1767: RestoreSystemLoader ();
1768: }
1769: catch (Exception &e)
1770: {
1771: e.Show (ParentWindow);
1772: throw ErrorException ("SYS_LOADER_RESTORE_FAILED");
1773: }
1774: }
1775:
1776:
1777: int BootEncryption::ChangePassword (Password *oldPassword, Password *newPassword, int pkcs5)
1778: {
1.1.1.5 root 1779: BootEncryptionStatus encStatus = GetStatus();
1780:
1781: if (encStatus.SetupInProgress)
1.1 root 1782: throw ParameterIncorrect (SRC_POS);
1783:
1784: SystemDriveConfiguration config = GetSystemDriveConfiguration ();
1785:
1.1.1.5 root 1786: char header[TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE];
1.1 root 1787: Device device (config.DevicePath);
1788:
1789: // Only one algorithm is currently supported
1790: if (pkcs5 != 0)
1791: throw ParameterIncorrect (SRC_POS);
1792:
1.1.1.5 root 1793: int64 headerOffset = TC_BOOT_VOLUME_HEADER_SECTOR_OFFSET;
1794: int64 backupHeaderOffset = -1;
1795:
1796: if (encStatus.HiddenSystem)
1797: {
1798: headerOffset = encStatus.HiddenSystemPartitionStart + TC_HIDDEN_VOLUME_HEADER_OFFSET;
1799:
1800: // Find hidden system partition
1801: foreach (const Partition &partition, config.Partitions)
1802: {
1803: if (partition.Info.StartingOffset.QuadPart == encStatus.HiddenSystemPartitionStart)
1804: {
1805: backupHeaderOffset = partition.Info.StartingOffset.QuadPart + partition.Info.PartitionLength.QuadPart - TC_VOLUME_HEADER_SIZE;
1806: break;
1807: }
1808: }
1809:
1810: if (backupHeaderOffset == -1)
1811: throw ParameterIncorrect (SRC_POS);
1812: }
1813:
1814: device.SeekAt (headerOffset);
1.1 root 1815: device.Read ((byte *) header, sizeof (header));
1816:
1817: PCRYPTO_INFO cryptoInfo = NULL;
1818:
1.1.1.6 root 1819: int status = ReadVolumeHeader (!encStatus.HiddenSystem, header, oldPassword, &cryptoInfo, NULL);
1.1 root 1820: finally_do_arg (PCRYPTO_INFO, cryptoInfo, { if (finally_arg) crypto_close (finally_arg); });
1821:
1822: if (status != 0)
1823: {
1824: handleError (ParentWindow, status);
1825: return status;
1826: }
1827:
1828: // Change the PKCS-5 PRF if requested by user
1829: if (pkcs5 != 0)
1.1.1.8 root 1830: {
1.1 root 1831: cryptoInfo->pkcs5 = pkcs5;
1.1.1.8 root 1832: RandSetHashFunction (pkcs5);
1833: }
1.1 root 1834:
1835: throw_sys_if (Randinit () != 0);
1.1.1.8 root 1836: finally_do ({ RandStop (FALSE); });
1837:
1838: NormalCursor();
1839: UserEnrichRandomPool (ParentWindow);
1840: WaitCursor();
1.1 root 1841:
1842: /* The header will be re-encrypted PRAND_DISK_WIPE_PASSES times to prevent adversaries from using
1843: techniques such as magnetic force microscopy or magnetic force scanning tunnelling microscopy
1844: to recover the overwritten header. According to Peter Gutmann, data should be overwritten 22
1845: times (ideally, 35 times) using non-random patterns and pseudorandom data. However, as users might
1846: impatiently interupt the process (etc.) we will not use the Gutmann's patterns but will write the
1847: valid re-encrypted header, i.e. pseudorandom data, and there will be many more passes than Guttman
1848: recommends. During each pass we will write a valid working header. Each pass will use the same master
1849: key, and also the same header key, secondary key (XTS), etc., derived from the new password. The only
1850: item that will be different for each pass will be the salt. This is sufficient to cause each "version"
1851: of the header to differ substantially and in a random manner from the versions written during the
1852: other passes. */
1853:
1854: bool headerUpdated = false;
1855: int result = ERR_SUCCESS;
1856:
1857: try
1858: {
1.1.1.5 root 1859: BOOL backupHeader = FALSE;
1860: while (TRUE)
1.1 root 1861: {
1.1.1.5 root 1862: for (int wipePass = 0; wipePass < PRAND_DISK_WIPE_PASSES; wipePass++)
1.1 root 1863: {
1.1.1.5 root 1864: PCRYPTO_INFO tmpCryptoInfo = NULL;
1865:
1.1.1.6 root 1866: status = CreateVolumeHeaderInMemory (!encStatus.HiddenSystem,
1.1.1.5 root 1867: header,
1868: cryptoInfo->ea,
1869: cryptoInfo->mode,
1870: newPassword,
1871: cryptoInfo->pkcs5,
1872: (char *) cryptoInfo->master_keydata,
1873: &tmpCryptoInfo,
1874: cryptoInfo->VolumeSize.Value,
1875: cryptoInfo->hiddenVolumeSize,
1876: cryptoInfo->EncryptedAreaStart.Value,
1877: cryptoInfo->EncryptedAreaLength.Value,
1878: cryptoInfo->RequiredProgramVersion,
1879: cryptoInfo->HeaderFlags | TC_HEADER_FLAG_ENCRYPTED_SYSTEM,
1880: wipePass < PRAND_DISK_WIPE_PASSES - 1);
1881:
1882: if (tmpCryptoInfo)
1883: crypto_close (tmpCryptoInfo);
1884:
1885: if (status != 0)
1886: {
1887: handleError (ParentWindow, status);
1888: return status;
1889: }
1890:
1891: device.SeekAt (headerOffset);
1892: device.Write ((byte *) header, sizeof (header));
1893: headerUpdated = true;
1.1 root 1894: }
1895:
1.1.1.5 root 1896: if (!encStatus.HiddenSystem || backupHeader)
1897: break;
1898:
1899: backupHeader = TRUE;
1900: headerOffset = backupHeaderOffset;
1.1 root 1901: }
1902: }
1903: catch (Exception &e)
1904: {
1905: e.Show (ParentWindow);
1906: result = ERR_OS_ERROR;
1907: }
1908:
1909: if (headerUpdated)
1910: {
1911: ReopenBootVolumeHeaderRequest reopenRequest;
1912: reopenRequest.VolumePassword = *newPassword;
1913: finally_do_arg (ReopenBootVolumeHeaderRequest*, &reopenRequest, { burn (finally_arg, sizeof (*finally_arg)); });
1914:
1915: CallDriver (TC_IOCTL_REOPEN_BOOT_VOLUME_HEADER, &reopenRequest, sizeof (reopenRequest));
1916: }
1917:
1918: return result;
1919: }
1920:
1921:
1922: void BootEncryption::CheckEncryptionSetupResult ()
1923: {
1.1.1.7 root 1924: CallDriver (TC_IOCTL_GET_BOOT_ENCRYPTION_SETUP_RESULT);
1.1 root 1925: }
1926:
1927:
1.1.1.6 root 1928: void BootEncryption::Install (bool hiddenSystem)
1.1 root 1929: {
1930: BootEncryptionStatus encStatus = GetStatus();
1931: if (encStatus.DriveMounted)
1932: throw ParameterIncorrect (SRC_POS);
1933:
1934: try
1935: {
1.1.1.6 root 1936: InstallBootLoader (false, hiddenSystem);
1937:
1938: if (!hiddenSystem)
1939: InstallVolumeHeader ();
1940:
1941: RegisterBootDriver (hiddenSystem);
1.1 root 1942: }
1943: catch (Exception &)
1944: {
1945: try
1946: {
1947: RestoreSystemLoader ();
1948: }
1949: catch (Exception &e)
1950: {
1951: e.Show (ParentWindow);
1952: }
1953:
1954: throw;
1955: }
1956: }
1957:
1958:
1.1.1.6 root 1959: void BootEncryption::PrepareHiddenOSCreation (int ea, int mode, int pkcs5)
1960: {
1961: BootEncryptionStatus encStatus = GetStatus();
1962: if (encStatus.DriveMounted)
1963: throw ParameterIncorrect (SRC_POS);
1964:
1965: CheckRequirements();
1966: BackupSystemLoader();
1967:
1968: SelectedEncryptionAlgorithmId = ea;
1969: }
1970:
1971:
1.1 root 1972: void BootEncryption::PrepareInstallation (bool systemPartitionOnly, Password &password, int ea, int mode, int pkcs5, const string &rescueIsoImagePath)
1973: {
1974: BootEncryptionStatus encStatus = GetStatus();
1975: if (encStatus.DriveMounted)
1976: throw ParameterIncorrect (SRC_POS);
1977:
1978: CheckRequirements ();
1979:
1980: SystemDriveConfiguration config = GetSystemDriveConfiguration();
1.1.1.7 root 1981:
1982: // Some chipset drivers may prevent access to the last sector of the drive
1983: if (!systemPartitionOnly)
1984: {
1985: DISK_GEOMETRY geometry = GetDriveGeometry (config.DriveNumber);
1986: Buffer sector (geometry.BytesPerSector);
1987:
1988: Device device (config.DevicePath);
1989:
1990: try
1991: {
1992: device.SeekAt (config.DrivePartition.Info.PartitionLength.QuadPart - geometry.BytesPerSector);
1993: device.Read (sector.Ptr(), sector.Size());
1994: }
1995: catch (SystemException &e)
1996: {
1997: if (e.ErrorCode != ERROR_CRC)
1998: {
1999: e.Show (ParentWindow);
2000: Error ("WHOLE_DRIVE_ENCRYPTION_PREVENTED_BY_DRIVERS");
2001: throw UserAbort (SRC_POS);
2002: }
2003: }
2004: }
2005:
1.1 root 2006: BackupSystemLoader ();
2007:
2008: uint64 volumeSize;
2009: uint64 encryptedAreaStart;
2010:
2011: if (systemPartitionOnly)
2012: {
2013: volumeSize = config.SystemPartition.Info.PartitionLength.QuadPart;
2014: encryptedAreaStart = config.SystemPartition.Info.StartingOffset.QuadPart;
2015: }
2016: else
2017: {
2018: volumeSize = config.DrivePartition.Info.PartitionLength.QuadPart - TC_BOOT_LOADER_AREA_SIZE;
2019: encryptedAreaStart = config.DrivePartition.Info.StartingOffset.QuadPart + TC_BOOT_LOADER_AREA_SIZE;
2020: }
2021:
1.1.1.3 root 2022: SelectedEncryptionAlgorithmId = ea;
1.1 root 2023: CreateVolumeHeader (volumeSize, encryptedAreaStart, &password, ea, mode, pkcs5);
2024:
2025: if (!rescueIsoImagePath.empty())
2026: CreateRescueIsoImage (true, rescueIsoImagePath);
2027: }
2028:
1.1.1.6 root 2029: bool BootEncryption::IsPagingFileActive (BOOL checkNonWindowsPartitionsOnly)
1.1.1.5 root 2030: {
2031: if (!IsAdmin() && IsUacSupported())
1.1.1.6 root 2032: return Elevator::IsPagingFileActive (checkNonWindowsPartitionsOnly) ? true : false;
1.1.1.5 root 2033:
1.1.1.6 root 2034: return ::IsPagingFileActive (checkNonWindowsPartitionsOnly) ? true : false;
1.1.1.5 root 2035: }
2036:
1.1.1.8 root 2037: void BootEncryption::RestrictPagingFilesToSystemPartition ()
2038: {
2039: char pagingFiles[128];
2040: strncpy (pagingFiles, "X:\\pagefile.sys 0 0", sizeof (pagingFiles));
2041: pagingFiles[0] = GetWindowsDirectory()[0];
2042:
2043: throw_sys_if (!WriteLocalMachineRegistryMultiString ("System\\CurrentControlSet\\Control\\Session Manager\\Memory Management", "PagingFiles", pagingFiles, strlen (pagingFiles) + 2));
2044: }
1.1.1.5 root 2045:
2046: void BootEncryption::WriteLocalMachineRegistryDwordValue (char *keyPath, char *valueName, DWORD value)
2047: {
2048: if (!IsAdmin() && IsUacSupported())
2049: {
2050: Elevator::WriteLocalMachineRegistryDwordValue (keyPath, valueName, value);
2051: return;
2052: }
2053:
2054: throw_sys_if (!WriteLocalMachineRegistryDword (keyPath, valueName, value));
2055: }
2056:
2057:
1.1.1.8 root 2058: void BootEncryption::StartDecryption (BOOL discardUnreadableEncryptedSectors)
1.1 root 2059: {
2060: BootEncryptionStatus encStatus = GetStatus();
2061:
2062: if (!encStatus.DeviceFilterActive || !encStatus.DriveMounted || encStatus.SetupInProgress)
2063: throw ParameterIncorrect (SRC_POS);
2064:
2065: BootEncryptionSetupRequest request;
2066: ZeroMemory (&request, sizeof (request));
2067:
2068: request.SetupMode = SetupDecryption;
1.1.1.8 root 2069: request.DiscardUnreadableEncryptedSectors = discardUnreadableEncryptedSectors;
1.1 root 2070:
2071: CallDriver (TC_IOCTL_BOOT_ENCRYPTION_SETUP, &request, sizeof (request), NULL, 0);
2072: }
2073:
2074:
1.1.1.6 root 2075: void BootEncryption::StartEncryption (WipeAlgorithmId wipeAlgorithm, bool zeroUnreadableSectors)
1.1 root 2076: {
2077: BootEncryptionStatus encStatus = GetStatus();
2078:
2079: if (!encStatus.DeviceFilterActive || !encStatus.DriveMounted || encStatus.SetupInProgress)
2080: throw ParameterIncorrect (SRC_POS);
2081:
2082: BootEncryptionSetupRequest request;
2083: ZeroMemory (&request, sizeof (request));
2084:
2085: request.SetupMode = SetupEncryption;
2086: request.WipeAlgorithm = wipeAlgorithm;
1.1.1.6 root 2087: request.ZeroUnreadableSectors = zeroUnreadableSectors;
1.1 root 2088:
2089: CallDriver (TC_IOCTL_BOOT_ENCRYPTION_SETUP, &request, sizeof (request), NULL, 0);
2090: }
2091:
1.1.1.2 root 2092: #endif // !SETUP
1.1 root 2093:
1.1.1.6 root 2094:
2095: void BootEncryption::WriteBootDriveSector (uint64 offset, byte *data)
2096: {
2097: WriteBootDriveSectorRequest request;
2098: request.Offset.QuadPart = offset;
2099: memcpy (request.Data, data, sizeof (request.Data));
2100:
2101: CallDriver (TC_IOCTL_WRITE_BOOT_DRIVE_SECTOR, &request, sizeof (request), NULL, 0);
2102: }
2103:
2104:
2105: void BootEncryption::RegisterBootDriver (bool hiddenSystem)
1.1.1.3 root 2106: {
2107: SetDriverServiceStartType (SERVICE_BOOT_START);
2108:
2109: try
2110: {
1.1.1.5 root 2111: RegisterFilterDriver (false, false);
2112: RegisterFilterDriver (false, true);
1.1.1.3 root 2113: }
2114: catch (...) { }
2115:
1.1.1.5 root 2116: RegisterFilterDriver (true, false);
1.1.1.6 root 2117:
2118: if (hiddenSystem)
2119: RegisterFilterDriver (true, true);
1.1.1.3 root 2120: }
2121:
2122:
1.1 root 2123: bool BootEncryption::RestartComputer (void)
2124: {
1.1.1.5 root 2125: return (::RestartComputer() != FALSE);
1.1 root 2126: }
2127: }
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.