![[BACK]](/cvsweb/icons/back.gif){kind=icon}
Return to inplace.c CVS log ![[TXT]](/cvsweb/icons/text.gif){kind=icon}
![[DIR]](/cvsweb/icons/dir.gif){kind=icon}
Up to [truecrypt] / truecrypt / format|
Return to inplace.c CVS log | Up to [truecrypt] / truecrypt / format |
1.1 root 1: /*
1.1.1.2 root 2: Copyright (c) 2008-2009 TrueCrypt Foundation. All rights reserved.
1.1 root 3:
1.1.1.3 ! root 4: Governed by the TrueCrypt License 2.7 the full text of which is contained
1.1 root 5: in the file License.txt included in TrueCrypt binary and source code
6: distribution packages.
7: */
8:
9:
1.1.1.2 root 10: /* In this file, _WIN32_WINNT is defined as 0x0600 to make filesystem shrink available (Vista
1.1 root 11: or later). _WIN32_WINNT cannot be defined as 0x0600 for the entire user-space projects
12: because it breaks the main font app when the app is running on XP (likely an MS bug).
13: IMPORTANT: Due to this issue, functions in this file must not directly interact with GUI. */
14: #define TC_LOCAL_WIN32_WINNT_OVERRIDE 1
15: #if (_WIN32_WINNT < 0x0600)
16: # undef _WIN32_WINNT
17: # define _WIN32_WINNT 0x0600
18: #endif
19:
20:
21: #include <stdlib.h>
22: #include <string.h>
23: #include <string>
24:
25: #include "Tcdefs.h"
26: #include "Platform/Finally.h"
27:
28: #include "Common.h"
29: #include "Crc.h"
30: #include "Dlgcode.h"
31: #include "Language.h"
32: #include "Tcformat.h"
33: #include "Volumes.h"
34:
35: #include "InPlace.h"
36:
37: using namespace std;
38: using namespace TrueCrypt;
39:
40: #define TC_MAX_NONSYS_INPLACE_ENC_WORK_CHUNK_SIZE (2048 * BYTES_PER_KB)
41: #define TC_INITIAL_NTFS_CONCEAL_PORTION_SIZE (2 * TC_MAX_VOLUME_SECTOR_SIZE)
42: #define TC_NTFS_CONCEAL_CONSTANT 0xFF
43: #define TC_NONSYS_INPLACE_ENC_HEADER_UPDATE_INTERVAL (64 * BYTES_PER_MB)
44: #define TC_NONSYS_INPLACE_ENC_MIN_VOL_SIZE (TC_TOTAL_VOLUME_HEADERS_SIZE + TC_MIN_NTFS_FS_SIZE * 2)
45:
46:
47: // If the returned value is greater than 0, it is the desired volume size in NTFS sectors (not in bytes)
48: // after shrinking has been performed. If there's any error, returns -1.
49: static __int64 NewFileSysSizeAfterShrink (HANDLE dev, const char *devicePath, int64 *totalClusterCount, DWORD *bytesPerCluster, BOOL silent)
50: {
51: NTFS_VOLUME_DATA_BUFFER ntfsVolData;
52: DWORD nBytesReturned;
53: __int64 fileSysSize, desiredNbrSectors;
54:
55: // Filesystem size and sector size
56:
57: if (!DeviceIoControl (dev,
58: FSCTL_GET_NTFS_VOLUME_DATA,
59: NULL,
60: 0,
61: (LPVOID) &ntfsVolData,
62: sizeof (ntfsVolData),
63: &nBytesReturned,
64: NULL))
65: {
66: if (!silent)
67: handleWin32Error (MainDlg);
68:
69: return -1;
70: }
71:
72: fileSysSize = ntfsVolData.NumberSectors.QuadPart * ntfsVolData.BytesPerSector;
73:
74: desiredNbrSectors = (fileSysSize - TC_TOTAL_VOLUME_HEADERS_SIZE) / ntfsVolData.BytesPerSector;
75:
76: if (desiredNbrSectors <= 0)
77: return -1;
78:
79: if (totalClusterCount)
80: *totalClusterCount = ntfsVolData.TotalClusters.QuadPart;
81: if (bytesPerCluster)
82: *bytesPerCluster = ntfsVolData.BytesPerCluster;
83:
84: return desiredNbrSectors;
85: }
86:
87:
88: BOOL CheckRequirementsForNonSysInPlaceEnc (const char *devicePath, BOOL silent)
89: {
90: NTFS_VOLUME_DATA_BUFFER ntfsVolData;
91: DWORD nBytesReturned;
92: HANDLE dev;
93: char szFileSysName [256];
94: WCHAR devPath [MAX_PATH];
95: char dosDev [TC_MAX_PATH] = {0};
96: char devName [MAX_PATH] = {0};
97: int driveLetterNo = -1;
98: char szRootPath[4] = {0, ':', '\\', 0};
99: __int64 deviceSize;
100: int partitionNumber = -1, driveNumber = -1;
101:
102:
103: /* ---------- Checks that do not require admin rights ----------- */
104:
105:
106: /* Operating system */
107:
108: if (CurrentOSMajor < 6)
109: {
110: if (!silent)
111: ShowInPlaceEncErrMsgWAltSteps ("OS_NOT_SUPPORTED_FOR_NONSYS_INPLACE_ENC", FALSE);
112:
113: return FALSE;
114: }
115:
116:
117: /* Volume type (must be a partition or a dynamic volume) */
118:
119: if (sscanf (devicePath, "\\Device\\HarddiskVolume%d", &partitionNumber) != 1
1.1.1.2 root 120: && sscanf (devicePath, "\\Device\\Harddisk%d\\Partition%d", &driveNumber, &partitionNumber) != 2)
1.1 root 121: {
122: if (!silent)
123: Error ("INPLACE_ENC_INVALID_PATH");
124:
125: return FALSE;
126: }
127:
1.1.1.2 root 128: if (partitionNumber == 0)
1.1 root 129: {
130: if (!silent)
131: Warning ("RAW_DEV_NOT_SUPPORTED_FOR_INPLACE_ENC");
132:
133: return FALSE;
134: }
135:
136:
137: /* Admin rights */
138:
139: if (!IsAdmin())
140: {
141: // We rely on the wizard process to call us only when the whole wizard process has been elevated (so UAC
142: // status can be ignored). In case the IsAdmin() detection somehow fails, we allow the user to continue.
143:
144: if (!silent)
145: Warning ("ADMIN_PRIVILEGES_WARN_DEVICES");
146: }
147:
148:
149: /* ---------- Checks that may require admin rights ----------- */
150:
151:
152: /* Access to the partition */
153:
154: strcpy ((char *) devPath, devicePath);
155: ToUNICODE ((char *) devPath);
156:
157: driveLetterNo = GetDiskDeviceDriveLetter (devPath);
158:
159: if (driveLetterNo >= 0)
160: szRootPath[0] = driveLetterNo + 'A';
161:
162: if (FakeDosNameForDevice (devicePath, dosDev, devName, FALSE) != 0)
163: {
164: if (!silent)
165: {
166: handleWin32Error (MainDlg);
167: Error ("INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL");
168: }
169: return FALSE;
170: }
171:
172: dev = OpenPartitionVolume (devName,
173: FALSE, // Do not require exclusive access
174: TRUE, // Require shared access (must be TRUE; otherwise, volume properties will not be possible to obtain)
175: FALSE, // Do not ask the user to confirm shared access (if exclusive fails)
176: FALSE, // Do not append alternative instructions how to encrypt the data (to applicable error messages)
177: silent); // Silent mode
178:
179: if (dev == INVALID_HANDLE_VALUE)
180: return FALSE;
181:
182:
183: /* File system type */
184:
185: GetVolumeInformation (szRootPath, NULL, 0, NULL, NULL, NULL, szFileSysName, sizeof(szFileSysName));
186:
187: if (strncmp (szFileSysName, "NTFS", 4))
188: {
189: // The previous filesystem type detection method failed (or it's not NTFS) -- try an alternative method
190:
191: if (!DeviceIoControl (dev,
192: FSCTL_GET_NTFS_VOLUME_DATA,
193: NULL,
194: 0,
195: (LPVOID) &ntfsVolData,
196: sizeof (ntfsVolData),
197: &nBytesReturned,
198: NULL))
199: {
200: if (!silent)
201: {
202: // The filesystem is not NTFS or the filesystem type could not be determined (or the NTFS filesystem
203: // is dismounted).
204:
205: if (IsDeviceMounted (devName))
206: ShowInPlaceEncErrMsgWAltSteps ("ONLY_NTFS_SUPPORTED_FOR_NONSYS_INPLACE_ENC", FALSE);
207: else
208: Warning ("ONLY_MOUNTED_VOL_SUPPORTED_FOR_NONSYS_INPLACE_ENC");
209: }
210:
211: CloseHandle (dev);
212: return FALSE;
213: }
214: }
215:
216:
217: /* Attempt to determine whether the filesystem can be safely shrunk */
218:
219: if (NewFileSysSizeAfterShrink (dev, devicePath, NULL, NULL, silent) == -1)
220: {
221: // Cannot determine whether shrinking is required
222: if (!silent)
223: ShowInPlaceEncErrMsgWAltSteps ("INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL_ALT", TRUE);
224:
225: CloseHandle (dev);
226: return FALSE;
227: }
228:
229:
230: /* Partition size */
231:
232: deviceSize = GetDeviceSize (devicePath);
233: if (deviceSize < 0)
234: {
235: // Cannot determine the size of the partition
236: if (!silent)
237: Error ("INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL");
238:
239: CloseHandle (dev);
240: return FALSE;
241: }
242:
243: if (deviceSize < TC_NONSYS_INPLACE_ENC_MIN_VOL_SIZE)
244: {
245: // The partition is too small
246: if (!silent)
247: {
248: ShowInPlaceEncErrMsgWAltSteps ("PARTITION_TOO_SMALL_FOR_NONSYS_INPLACE_ENC", FALSE);
249: }
250:
251: CloseHandle (dev);
252: return FALSE;
253: }
254:
255:
256: /* Free space on the filesystem */
257:
258: if (!DeviceIoControl (dev,
259: FSCTL_GET_NTFS_VOLUME_DATA,
260: NULL,
261: 0,
262: (LPVOID) &ntfsVolData,
263: sizeof (ntfsVolData),
264: &nBytesReturned,
265: NULL))
266: {
267: if (!silent)
268: ShowInPlaceEncErrMsgWAltSteps ("INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL", TRUE);
269:
270: CloseHandle (dev);
271: return FALSE;
272: }
273:
274: if (ntfsVolData.FreeClusters.QuadPart * ntfsVolData.BytesPerCluster < TC_TOTAL_VOLUME_HEADERS_SIZE)
275: {
276: if (!silent)
277: ShowInPlaceEncErrMsgWAltSteps ("NOT_ENOUGH_FREE_FILESYS_SPACE_FOR_SHRINK", TRUE);
278:
279: CloseHandle (dev);
280: return FALSE;
281: }
282:
283:
284: /* Filesystem sector size */
285:
286: if (ntfsVolData.BytesPerSector > TC_MAX_VOLUME_SECTOR_SIZE
287: || ntfsVolData.BytesPerSector % ENCRYPTION_DATA_UNIT_SIZE != 0)
288: {
289: if (!silent)
290: ShowInPlaceEncErrMsgWAltSteps ("ERR_UNSUPPORTED_SECTOR_SIZE_GENERIC", TRUE);
291:
292: CloseHandle (dev);
293: return FALSE;
294: }
295:
296:
297: CloseHandle (dev);
298: return TRUE;
299: }
300:
301:
302: int EncryptPartitionInPlaceBegin (volatile FORMAT_VOL_PARAMETERS *volParams, volatile HANDLE *outHandle, WipeAlgorithmId wipeAlgorithm)
303: {
304: SHRINK_VOLUME_INFORMATION shrinkVolInfo;
305: signed __int64 sizeToShrinkTo;
306: int nStatus = ERR_SUCCESS;
307: PCRYPTO_INFO cryptoInfo = NULL;
308: PCRYPTO_INFO cryptoInfo2 = NULL;
309: HANDLE dev = INVALID_HANDLE_VALUE;
310: DWORD dwError;
311: char *header;
312: char dosDev[TC_MAX_PATH] = {0};
313: char devName[MAX_PATH] = {0};
314: int driveLetter = -1;
315: WCHAR deviceName[MAX_PATH];
316: uint64 dataAreaSize;
317: __int64 deviceSize;
318: LARGE_INTEGER offset;
319: DWORD dwResult;
320:
321: SetNonSysInplaceEncUIStatus (NONSYS_INPLACE_ENC_STATUS_PREPARING);
322:
323:
324: if (!CheckRequirementsForNonSysInPlaceEnc (volParams->volumePath, FALSE))
325: return ERR_DONT_REPORT;
326:
327:
328: header = (char *) TCalloc (TC_VOLUME_HEADER_EFFECTIVE_SIZE);
329: if (!header)
330: return ERR_OUTOFMEMORY;
331:
332: VirtualLock (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);
333:
334: deviceSize = GetDeviceSize (volParams->volumePath);
335: if (deviceSize < 0)
336: {
337: // Cannot determine the size of the partition
338: nStatus = ERR_PARAMETER_INCORRECT;
339: goto closing_seq;
340: }
341:
342: if (deviceSize < TC_NONSYS_INPLACE_ENC_MIN_VOL_SIZE)
343: {
344: ShowInPlaceEncErrMsgWAltSteps ("PARTITION_TOO_SMALL_FOR_NONSYS_INPLACE_ENC", TRUE);
345: nStatus = ERR_DONT_REPORT;
346: goto closing_seq;
347: }
348:
349: dataAreaSize = GetVolumeDataAreaSize (volParams->hiddenVol, deviceSize);
350:
351: strcpy ((char *)deviceName, volParams->volumePath);
352: ToUNICODE ((char *)deviceName);
353:
354: driveLetter = GetDiskDeviceDriveLetter (deviceName);
355:
356:
357: if (FakeDosNameForDevice (volParams->volumePath, dosDev, devName, FALSE) != 0)
358: {
359: nStatus = ERR_OS_ERROR;
360: goto closing_seq;
361: }
362:
363: if (IsDeviceMounted (devName))
364: {
365: dev = OpenPartitionVolume (devName,
366: FALSE, // Do not require exclusive access (must be FALSE; otherwise, it will not be possible to dismount the volume or obtain its properties and FSCTL_ALLOW_EXTENDED_DASD_IO will fail too)
367: TRUE, // Require shared access (must be TRUE; otherwise, it will not be possible to dismount the volume or obtain its properties and FSCTL_ALLOW_EXTENDED_DASD_IO will fail too)
368: FALSE, // Do not ask the user to confirm shared access (if exclusive fails)
369: FALSE, // Do not append alternative instructions how to encrypt the data (to applicable error messages)
370: FALSE); // Non-silent mode
371:
372: if (dev == INVALID_HANDLE_VALUE)
373: {
374: nStatus = ERR_DONT_REPORT;
375: goto closing_seq;
376: }
377: }
378: else
379: {
380: // The volume is not mounted so we can't work with the filesystem.
381: Error ("ONLY_MOUNTED_VOL_SUPPORTED_FOR_NONSYS_INPLACE_ENC");
382: nStatus = ERR_DONT_REPORT;
383: goto closing_seq;
384: }
385:
386:
387: /* Gain "raw" access to the partition (the NTFS driver guards hidden sectors). */
388:
389: if (!DeviceIoControl (dev,
390: FSCTL_ALLOW_EXTENDED_DASD_IO,
391: NULL,
392: 0,
393: NULL,
394: 0,
395: &dwResult,
396: NULL))
397: {
398: handleWin32Error (MainDlg);
399: ShowInPlaceEncErrMsgWAltSteps ("INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL_ALT", TRUE);
400: nStatus = ERR_DONT_REPORT;
401: goto closing_seq;
402: }
403:
404:
405:
406: /* Shrink the filesystem */
407:
408: int64 totalClusterCount;
409: DWORD bytesPerCluster;
410:
411: sizeToShrinkTo = NewFileSysSizeAfterShrink (dev, volParams->volumePath, &totalClusterCount, &bytesPerCluster, FALSE);
412:
413: if (sizeToShrinkTo == -1)
414: {
415: ShowInPlaceEncErrMsgWAltSteps ("INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL_ALT", TRUE);
416: nStatus = ERR_DONT_REPORT;
417: goto closing_seq;
418: }
419:
420: SetNonSysInplaceEncUIStatus (NONSYS_INPLACE_ENC_STATUS_RESIZING);
421:
422: memset (&shrinkVolInfo, 0, sizeof (shrinkVolInfo));
423:
424: shrinkVolInfo.ShrinkRequestType = ShrinkPrepare;
425: shrinkVolInfo.NewNumberOfSectors = sizeToShrinkTo;
426:
427: if (!DeviceIoControl (dev,
428: FSCTL_SHRINK_VOLUME,
429: (LPVOID) &shrinkVolInfo,
430: sizeof (shrinkVolInfo),
431: NULL,
432: 0,
433: &dwResult,
434: NULL))
435: {
436: handleWin32Error (MainDlg);
437: ShowInPlaceEncErrMsgWAltSteps ("CANNOT_RESIZE_FILESYS", TRUE);
438: nStatus = ERR_DONT_REPORT;
439: goto closing_seq;
440: }
441:
442: BOOL clustersMovedBeforeVolumeEnd = FALSE;
443:
444: while (true)
445: {
446: shrinkVolInfo.ShrinkRequestType = ShrinkCommit;
447: shrinkVolInfo.NewNumberOfSectors = 0;
448:
449: if (!DeviceIoControl (dev, FSCTL_SHRINK_VOLUME, &shrinkVolInfo, sizeof (shrinkVolInfo), NULL, 0, &dwResult, NULL))
450: {
451: // If there are any occupied clusters beyond the new desired end of the volume, the call fails with
452: // ERROR_ACCESS_DENIED (STATUS_ALREADY_COMMITTED).
453: if (GetLastError () == ERROR_ACCESS_DENIED)
454: {
455: if (!clustersMovedBeforeVolumeEnd)
456: {
457: if (MoveClustersBeforeThreshold (dev, deviceName, totalClusterCount - (bytesPerCluster > TC_TOTAL_VOLUME_HEADERS_SIZE ? 1 : TC_TOTAL_VOLUME_HEADERS_SIZE / bytesPerCluster)))
458: {
459: clustersMovedBeforeVolumeEnd = TRUE;
460: continue;
461: }
462:
463: handleWin32Error (MainDlg);
464: }
465: }
466: else
467: handleWin32Error (MainDlg);
468:
469: ShowInPlaceEncErrMsgWAltSteps ("CANNOT_RESIZE_FILESYS", TRUE);
470: nStatus = ERR_DONT_REPORT;
471: goto closing_seq;
472: }
473:
474: break;
475: }
476:
477: SetNonSysInplaceEncUIStatus (NONSYS_INPLACE_ENC_STATUS_PREPARING);
478:
479:
480: /* Gain exclusive access to the volume */
481:
482: nStatus = DismountFileSystem (dev,
483: driveLetter,
484: TRUE,
485: TRUE,
486: FALSE);
487:
488: if (nStatus != ERR_SUCCESS)
489: {
490: nStatus = ERR_DONT_REPORT;
491: goto closing_seq;
492: }
493:
494:
495:
496: /* Create header backup on the partition. Until the volume is fully encrypted, the backup header will provide
497: us with the master key, encrypted range, and other data for pause/resume operations. We cannot create the
498: primary header until the entire partition is encrypted (because we encrypt backwards and the primary header
499: area is occuppied by data until the very end of the process). */
500:
501: // Prepare the backup header
1.1.1.2 root 502: for (int wipePass = 0; wipePass < (wipeAlgorithm == TC_WIPE_NONE ? 1 : PRAND_DISK_WIPE_PASSES); wipePass++)
503: {
504: nStatus = CreateVolumeHeaderInMemory (FALSE,
505: header,
506: volParams->ea,
507: FIRST_MODE_OF_OPERATION_ID,
508: volParams->password,
509: volParams->pkcs5,
510: wipePass == 0 ? NULL : (char *) cryptoInfo->master_keydata,
511: &cryptoInfo,
512: dataAreaSize,
513: 0,
514: TC_VOLUME_DATA_OFFSET + dataAreaSize, // Start of the encrypted area = the first byte of the backup heeader (encrypting from the end)
515: 0, // No data is encrypted yet
516: 0,
517: volParams->headerFlags | TC_HEADER_FLAG_NONSYS_INPLACE_ENC,
518: wipeAlgorithm == TC_WIPE_NONE ? FALSE : (wipePass < PRAND_DISK_WIPE_PASSES - 1));
1.1 root 519:
1.1.1.2 root 520: if (nStatus != 0)
521: goto closing_seq;
1.1 root 522:
1.1.1.2 root 523: offset.QuadPart = TC_VOLUME_DATA_OFFSET + dataAreaSize;
1.1 root 524:
1.1.1.2 root 525: if (!SetFilePointerEx (dev, offset, NULL, FILE_BEGIN))
526: {
527: nStatus = ERR_OS_ERROR;
528: goto closing_seq;
529: }
1.1 root 530:
1.1.1.2 root 531: // Write the backup header to the partition
532: if (_lwrite ((HFILE) dev, header, TC_VOLUME_HEADER_EFFECTIVE_SIZE) == HFILE_ERROR)
533: {
534: nStatus = ERR_OS_ERROR;
535: goto closing_seq;
536: }
1.1 root 537:
1.1.1.2 root 538: // Fill the reserved sectors of the backup header area with random data
539: nStatus = WriteRandomDataToReservedHeaderAreas (dev, cryptoInfo, dataAreaSize, FALSE, TRUE);
1.1 root 540:
1.1.1.2 root 541: if (nStatus != ERR_SUCCESS)
542: goto closing_seq;
543: }
1.1 root 544:
545:
546: /* Now we will try to decrypt the backup header to verify it has been correctly written. */
547:
548: nStatus = OpenBackupHeader (dev, volParams->volumePath, volParams->password, &cryptoInfo2, NULL, deviceSize);
549:
550: if (nStatus != ERR_SUCCESS
551: || cryptoInfo->EncryptedAreaStart.Value != cryptoInfo2->EncryptedAreaStart.Value
552: || cryptoInfo2->EncryptedAreaStart.Value == 0)
553: {
554: if (nStatus == ERR_SUCCESS)
555: nStatus = ERR_PARAMETER_INCORRECT;
556:
557: goto closing_seq;
558: }
559:
560: // The backup header is valid so we know we should be able to safely resume in-place encryption
561: // of this partition even if the system/app crashes.
562:
563:
564:
565: /* Conceal the NTFS filesystem (by performing an easy-to-undo modification). This will prevent Windows
566: and apps from interfering with the volume until it has been fully encrypted. */
567:
568: nStatus = ConcealNTFS (dev);
569:
570: if (nStatus != ERR_SUCCESS)
571: goto closing_seq;
572:
573:
574:
575: // /* If a drive letter is assigned to the device, remove it (so that users do not try to open it, which
576: //would cause Windows to ask them if they want to format the volume and other dangerous things). */
577:
578: //if (driveLetter >= 0)
579: //{
580: // char rootPath[] = { driveLetter + 'A', ':', '\\', 0 };
581:
582: // // Try to remove the assigned drive letter
583: // if (DeleteVolumeMountPoint (rootPath))
584: // driveLetter = -1;
585: //}
586:
587:
588:
589: /* Update config files and app data */
590:
591: // In the config file, increase the number of partitions where in-place encryption is in progress
592:
593: SaveNonSysInPlaceEncSettings (1, wipeAlgorithm);
594:
595:
596: // Add the wizard to the system startup sequence if appropriate
597:
598: if (!IsNonInstallMode ())
599: ManageStartupSeqWiz (FALSE, "/prinplace");
600:
601:
602: nStatus = ERR_SUCCESS;
603:
604:
605: closing_seq:
606:
607: dwError = GetLastError();
608:
609: if (cryptoInfo != NULL)
610: {
611: crypto_close (cryptoInfo);
612: cryptoInfo = NULL;
613: }
614:
615: if (cryptoInfo2 != NULL)
616: {
617: crypto_close (cryptoInfo2);
618: cryptoInfo2 = NULL;
619: }
620:
621: burn (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);
622: VirtualUnlock (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);
623: TCfree (header);
624:
625: if (dosDev[0])
626: RemoveFakeDosName (volParams->volumePath, dosDev);
627:
628: *outHandle = dev;
629:
630: if (nStatus != ERR_SUCCESS)
631: SetLastError (dwError);
632:
633: return nStatus;
634: }
635:
636:
637: int EncryptPartitionInPlaceResume (HANDLE dev,
638: volatile FORMAT_VOL_PARAMETERS *volParams,
639: WipeAlgorithmId wipeAlgorithm,
640: volatile BOOL *bTryToCorrectReadErrors)
641: {
642: PCRYPTO_INFO masterCryptoInfo = NULL, headerCryptoInfo = NULL, tmpCryptoInfo = NULL;
643: UINT64_STRUCT unitNo;
644: char *buf = NULL, *header = NULL;
645: byte *wipeBuffer = NULL;
646: byte wipeRandChars [TC_WIPE_RAND_CHAR_COUNT];
647: byte wipeRandCharsUpdate [TC_WIPE_RAND_CHAR_COUNT];
648: char dosDev[TC_MAX_PATH] = {0};
649: char devName[MAX_PATH] = {0};
650: WCHAR deviceName[MAX_PATH];
651: int nStatus = ERR_SUCCESS;
652: __int64 deviceSize;
653: uint64 remainingBytes, lastHeaderUpdateDistance = 0, zeroedSectorCount = 0;
654: uint32 workChunkSize;
655: DWORD dwError, dwResult;
656: BOOL bPause = FALSE, bEncryptedAreaSizeChanged = FALSE;
657: LARGE_INTEGER offset;
658: int sectorSize;
659: int i;
660: DWORD n;
661: char *devicePath = volParams->volumePath;
662: Password *password = volParams->password;
663: DISK_GEOMETRY driveGeometry;
664:
665:
666: bInPlaceEncNonSysResumed = TRUE;
667:
668: buf = (char *) TCalloc (TC_MAX_NONSYS_INPLACE_ENC_WORK_CHUNK_SIZE);
669: if (!buf)
670: {
671: nStatus = ERR_OUTOFMEMORY;
672: goto closing_seq;
673: }
674:
675: header = (char *) TCalloc (TC_VOLUME_HEADER_EFFECTIVE_SIZE);
676: if (!header)
677: {
678: nStatus = ERR_OUTOFMEMORY;
679: goto closing_seq;
680: }
681:
682: VirtualLock (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);
683:
684: if (wipeAlgorithm != TC_WIPE_NONE)
685: {
686: wipeBuffer = (byte *) TCalloc (TC_MAX_NONSYS_INPLACE_ENC_WORK_CHUNK_SIZE);
687: if (!wipeBuffer)
688: {
689: nStatus = ERR_OUTOFMEMORY;
690: goto closing_seq;
691: }
692: }
693:
694: headerCryptoInfo = crypto_open();
695:
696: if (headerCryptoInfo == NULL)
697: {
698: nStatus = ERR_OUTOFMEMORY;
699: goto closing_seq;
700: }
701:
702: deviceSize = GetDeviceSize (devicePath);
703: if (deviceSize < 0)
704: {
705: // Cannot determine the size of the partition
706: nStatus = ERR_OS_ERROR;
707: goto closing_seq;
708: }
709:
710: if (dev == INVALID_HANDLE_VALUE)
711: {
712: strcpy ((char *)deviceName, devicePath);
713: ToUNICODE ((char *)deviceName);
714:
715: if (FakeDosNameForDevice (devicePath, dosDev, devName, FALSE) != 0)
716: {
717: nStatus = ERR_OS_ERROR;
718: goto closing_seq;
719: }
720:
721: dev = OpenPartitionVolume (devName,
722: FALSE, // Do not require exclusive access
723: FALSE, // Do not require shared access
724: TRUE, // Ask the user to confirm shared access (if exclusive fails)
725: FALSE, // Do not append alternative instructions how to encrypt the data (to applicable error messages)
726: FALSE); // Non-silent mode
727:
728: if (dev == INVALID_HANDLE_VALUE)
729: {
730: nStatus = ERR_DONT_REPORT;
731: goto closing_seq;
732: }
733: }
734:
735: // This should never be needed, but is still performed for extra safety (without checking the result)
736: DeviceIoControl (dev,
737: FSCTL_ALLOW_EXTENDED_DASD_IO,
738: NULL,
739: 0,
740: NULL,
741: 0,
742: &dwResult,
743: NULL);
744:
745:
746: if (!DeviceIoControl (dev, IOCTL_DISK_GET_DRIVE_GEOMETRY, NULL, 0, &driveGeometry, sizeof (driveGeometry), &dwResult, NULL))
747: {
748: nStatus = ERR_OS_ERROR;
749: goto closing_seq;
750: }
751:
752: sectorSize = driveGeometry.BytesPerSector;
753:
754:
755: nStatus = OpenBackupHeader (dev, devicePath, password, &masterCryptoInfo, headerCryptoInfo, deviceSize);
756:
757: if (nStatus != ERR_SUCCESS)
758: goto closing_seq;
759:
760:
761:
762: remainingBytes = masterCryptoInfo->VolumeSize.Value - masterCryptoInfo->EncryptedAreaLength.Value;
763:
764: lastHeaderUpdateDistance = 0;
765:
766:
767: ExportProgressStats (masterCryptoInfo->EncryptedAreaLength.Value, masterCryptoInfo->VolumeSize.Value / SECTOR_SIZE);
768:
769: SetNonSysInplaceEncUIStatus (NONSYS_INPLACE_ENC_STATUS_ENCRYPTING);
770:
771: bFirstNonSysInPlaceEncResumeDone = TRUE;
772:
773:
774: /* The in-place encryption core */
775:
776: while (remainingBytes > 0)
777: {
778: workChunkSize = (uint32) min (remainingBytes, TC_MAX_NONSYS_INPLACE_ENC_WORK_CHUNK_SIZE);
779:
780: if (workChunkSize % ENCRYPTION_DATA_UNIT_SIZE != 0)
781: {
782: nStatus = ERR_PARAMETER_INCORRECT;
783: goto closing_seq;
784: }
785:
786: unitNo.Value = (remainingBytes - workChunkSize + TC_VOLUME_DATA_OFFSET) / ENCRYPTION_DATA_UNIT_SIZE;
787:
788:
789: // Read the plaintext into RAM
790:
791: inplace_enc_read:
792:
793: offset.QuadPart = masterCryptoInfo->EncryptedAreaStart.Value - workChunkSize - TC_VOLUME_DATA_OFFSET;
794:
795: if (SetFilePointerEx (dev, offset, NULL, FILE_BEGIN) == 0)
796: {
797: nStatus = ERR_OS_ERROR;
798: goto closing_seq;
799: }
800:
801: if (ReadFile (dev, buf, workChunkSize, &n, NULL) == 0)
802: {
803: // Read error
804:
805: DWORD dwTmpErr = GetLastError ();
806:
1.1.1.2 root 807: if (IsDiskReadError (dwTmpErr) && !bVolTransformThreadCancel)
1.1 root 808: {
809: // Physical defect or data corruption
810:
811: if (!*bTryToCorrectReadErrors)
812: {
813: *bTryToCorrectReadErrors = (AskWarnYesNo ("ENABLE_BAD_SECTOR_ZEROING") == IDYES);
814: }
815:
816: if (*bTryToCorrectReadErrors)
817: {
818: // Try to correct the read errors physically
819:
820: offset.QuadPart = masterCryptoInfo->EncryptedAreaStart.Value - workChunkSize - TC_VOLUME_DATA_OFFSET;
821:
822: nStatus = ZeroUnreadableSectors (dev, offset, workChunkSize, sectorSize, &zeroedSectorCount);
823:
824: if (nStatus != ERR_SUCCESS)
825: {
826: // Due to write errors, we can't correct the read errors
827: nStatus = ERR_OS_ERROR;
828: goto closing_seq;
829: }
830:
831: goto inplace_enc_read;
832: }
833: }
834:
835: SetLastError (dwTmpErr); // Preserve the original error code
836:
837: nStatus = ERR_OS_ERROR;
838: goto closing_seq;
839: }
840:
841: if (remainingBytes - workChunkSize < TC_INITIAL_NTFS_CONCEAL_PORTION_SIZE)
842: {
843: // We reached the inital portion of the filesystem, which we had concealed (in order to prevent
844: // Windows from interfering with the volume). Now we need to undo that modification.
845:
846: for (i = 0; i < TC_INITIAL_NTFS_CONCEAL_PORTION_SIZE - (remainingBytes - workChunkSize); i++)
847: buf[i] ^= TC_NTFS_CONCEAL_CONSTANT;
848: }
849:
850:
851: // Encrypt the plaintext in RAM
852:
853: EncryptDataUnits ((byte *) buf, &unitNo, workChunkSize / ENCRYPTION_DATA_UNIT_SIZE, masterCryptoInfo);
854:
855:
856: // If enabled, wipe the area to which we will write the ciphertext
857:
858: if (wipeAlgorithm != TC_WIPE_NONE)
859: {
860: byte wipePass;
861:
862: offset.QuadPart = masterCryptoInfo->EncryptedAreaStart.Value - workChunkSize;
863:
864: for (wipePass = 1; wipePass <= GetWipePassCount (wipeAlgorithm); ++wipePass)
865: {
866: if (!WipeBuffer (wipeAlgorithm, wipeRandChars, wipePass, wipeBuffer, workChunkSize))
867: {
868: ULONG i;
869: for (i = 0; i < workChunkSize; ++i)
870: {
871: wipeBuffer[i] = buf[i] + wipePass;
872: }
873:
874: EncryptDataUnits (wipeBuffer, &unitNo, workChunkSize / ENCRYPTION_DATA_UNIT_SIZE, masterCryptoInfo);
875: memcpy (wipeRandCharsUpdate, wipeBuffer, sizeof (wipeRandCharsUpdate));
876: }
877:
878: if (SetFilePointerEx (dev, offset, NULL, FILE_BEGIN) == 0
879: || WriteFile (dev, wipeBuffer, workChunkSize, &n, NULL) == 0)
880: {
881: // Write error
882: dwError = GetLastError();
883:
884: // Undo failed write operation
885: if (workChunkSize > TC_VOLUME_DATA_OFFSET && SetFilePointerEx (dev, offset, NULL, FILE_BEGIN))
886: {
887: DecryptDataUnits ((byte *) buf, &unitNo, workChunkSize / ENCRYPTION_DATA_UNIT_SIZE, masterCryptoInfo);
888: WriteFile (dev, buf + TC_VOLUME_DATA_OFFSET, workChunkSize - TC_VOLUME_DATA_OFFSET, &n, NULL);
889: }
890:
891: SetLastError (dwError);
892: nStatus = ERR_OS_ERROR;
893: goto closing_seq;
894: }
895: }
896:
897: memcpy (wipeRandChars, wipeRandCharsUpdate, sizeof (wipeRandCharsUpdate));
898: }
899:
900:
901: // Write the ciphertext
902:
903: offset.QuadPart = masterCryptoInfo->EncryptedAreaStart.Value - workChunkSize;
904:
905: if (SetFilePointerEx (dev, offset, NULL, FILE_BEGIN) == 0)
906: {
907: nStatus = ERR_OS_ERROR;
908: goto closing_seq;
909: }
910:
911: if (WriteFile (dev, buf, workChunkSize, &n, NULL) == 0)
912: {
913: // Write error
914: dwError = GetLastError();
915:
916: // Undo failed write operation
917: if (workChunkSize > TC_VOLUME_DATA_OFFSET && SetFilePointerEx (dev, offset, NULL, FILE_BEGIN))
918: {
919: DecryptDataUnits ((byte *) buf, &unitNo, workChunkSize / ENCRYPTION_DATA_UNIT_SIZE, masterCryptoInfo);
920: WriteFile (dev, buf + TC_VOLUME_DATA_OFFSET, workChunkSize - TC_VOLUME_DATA_OFFSET, &n, NULL);
921: }
922:
923: SetLastError (dwError);
924: nStatus = ERR_OS_ERROR;
925: goto closing_seq;
926: }
927:
928:
929: masterCryptoInfo->EncryptedAreaStart.Value -= workChunkSize;
930: masterCryptoInfo->EncryptedAreaLength.Value += workChunkSize;
931:
932: remainingBytes -= workChunkSize;
933: lastHeaderUpdateDistance += workChunkSize;
934:
935: bEncryptedAreaSizeChanged = TRUE;
936:
937: if (lastHeaderUpdateDistance >= TC_NONSYS_INPLACE_ENC_HEADER_UPDATE_INTERVAL)
938: {
939: nStatus = FastVolumeHeaderUpdate (dev, headerCryptoInfo, masterCryptoInfo, deviceSize);
940:
941: if (nStatus != ERR_SUCCESS)
942: goto closing_seq;
943:
944: lastHeaderUpdateDistance = 0;
945: }
946:
947: ExportProgressStats (masterCryptoInfo->EncryptedAreaLength.Value, masterCryptoInfo->VolumeSize.Value / SECTOR_SIZE);
948:
949: if (bVolTransformThreadCancel)
950: {
951: bPause = TRUE;
952: break;
953: }
954: }
955:
956: nStatus = FastVolumeHeaderUpdate (dev, headerCryptoInfo, masterCryptoInfo, deviceSize);
957:
958:
959: if (nStatus != ERR_SUCCESS)
960: goto closing_seq;
961:
962:
963: if (!bPause)
964: {
965: /* The data area has been fully encrypted; create and write the primary volume header */
966:
967: SetNonSysInplaceEncUIStatus (NONSYS_INPLACE_ENC_STATUS_FINALIZING);
968:
1.1.1.2 root 969: for (int wipePass = 0; wipePass < (wipeAlgorithm == TC_WIPE_NONE ? 1 : PRAND_DISK_WIPE_PASSES); wipePass++)
970: {
971: nStatus = CreateVolumeHeaderInMemory (FALSE,
972: header,
973: headerCryptoInfo->ea,
974: headerCryptoInfo->mode,
975: password,
976: masterCryptoInfo->pkcs5,
977: (char *) masterCryptoInfo->master_keydata,
978: &tmpCryptoInfo,
979: masterCryptoInfo->VolumeSize.Value,
980: 0,
981: masterCryptoInfo->EncryptedAreaStart.Value,
982: masterCryptoInfo->EncryptedAreaLength.Value,
983: masterCryptoInfo->RequiredProgramVersion,
984: masterCryptoInfo->HeaderFlags | TC_HEADER_FLAG_NONSYS_INPLACE_ENC,
985: wipeAlgorithm == TC_WIPE_NONE ? FALSE : (wipePass < PRAND_DISK_WIPE_PASSES - 1));
1.1 root 986:
1.1.1.2 root 987: if (nStatus != ERR_SUCCESS)
988: goto closing_seq;
1.1 root 989:
990:
1.1.1.2 root 991: offset.QuadPart = TC_VOLUME_HEADER_OFFSET;
1.1 root 992:
1.1.1.2 root 993: if (SetFilePointerEx (dev, offset, NULL, FILE_BEGIN) == 0
994: || WriteFile (dev, header, TC_VOLUME_HEADER_EFFECTIVE_SIZE, &n, NULL) == 0)
995: {
996: nStatus = ERR_OS_ERROR;
997: goto closing_seq;
998: }
1.1 root 999:
1.1.1.2 root 1000: // Fill the reserved sectors of the header area with random data
1001: nStatus = WriteRandomDataToReservedHeaderAreas (dev, headerCryptoInfo, masterCryptoInfo->VolumeSize.Value, TRUE, FALSE);
1.1 root 1002:
1.1.1.2 root 1003: if (nStatus != ERR_SUCCESS)
1004: goto closing_seq;
1005: }
1.1 root 1006:
1007: // Update the configuration files
1008:
1009: SaveNonSysInPlaceEncSettings (-1, wipeAlgorithm);
1010:
1011:
1012:
1013: SetNonSysInplaceEncUIStatus (NONSYS_INPLACE_ENC_STATUS_FINISHED);
1014:
1015: nStatus = ERR_SUCCESS;
1016: }
1017: else
1018: {
1019: // The process has been paused by the user or aborted by the wizard (e.g. on app exit)
1020:
1021: nStatus = ERR_USER_ABORT;
1022:
1023: SetNonSysInplaceEncUIStatus (NONSYS_INPLACE_ENC_STATUS_PAUSED);
1024: }
1025:
1026:
1027: closing_seq:
1028:
1029: dwError = GetLastError();
1030:
1031: if (bEncryptedAreaSizeChanged
1032: && dev != INVALID_HANDLE_VALUE
1033: && masterCryptoInfo != NULL
1034: && headerCryptoInfo != NULL
1035: && deviceSize > 0)
1036: {
1037: // Execution of the core loop may have been interrupted due to an error or user action without updating the header
1038: FastVolumeHeaderUpdate (dev, headerCryptoInfo, masterCryptoInfo, deviceSize);
1039: }
1040:
1041: if (masterCryptoInfo != NULL)
1042: {
1043: crypto_close (masterCryptoInfo);
1044: masterCryptoInfo = NULL;
1045: }
1046:
1047: if (headerCryptoInfo != NULL)
1048: {
1049: crypto_close (headerCryptoInfo);
1050: headerCryptoInfo = NULL;
1051: }
1052:
1053: if (tmpCryptoInfo != NULL)
1054: {
1055: crypto_close (tmpCryptoInfo);
1056: tmpCryptoInfo = NULL;
1057: }
1058:
1059: if (dosDev[0])
1060: RemoveFakeDosName (devicePath, dosDev);
1061:
1062: if (dev != INVALID_HANDLE_VALUE)
1063: {
1064: CloseHandle (dev);
1065: dev = INVALID_HANDLE_VALUE;
1066: }
1067:
1068: if (buf != NULL)
1069: TCfree (buf);
1070:
1071: if (header != NULL)
1072: {
1073: burn (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);
1074: VirtualUnlock (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);
1075: TCfree (header);
1076: }
1077:
1078: if (wipeBuffer != NULL)
1079: TCfree (wipeBuffer);
1080:
1081: if (zeroedSectorCount > 0)
1082: {
1083: wchar_t msg[30000] = {0};
1084: wchar_t sizeStr[500] = {0};
1085:
1086: GetSizeString (zeroedSectorCount * sectorSize, sizeStr);
1087:
1088: wsprintfW (msg,
1089: GetString ("ZEROED_BAD_SECTOR_COUNT"),
1090: zeroedSectorCount,
1091: sizeStr);
1092:
1093: WarningDirect (msg);
1094: }
1095:
1096: if (nStatus != ERR_SUCCESS && nStatus != ERR_USER_ABORT)
1097: SetLastError (dwError);
1098:
1099: return nStatus;
1100: }
1101:
1102:
1103: int FastVolumeHeaderUpdate (HANDLE dev, CRYPTO_INFO *headerCryptoInfo, CRYPTO_INFO *masterCryptoInfo, __int64 deviceSize)
1104: {
1105: LARGE_INTEGER offset;
1106: DWORD n;
1107: int nStatus = ERR_SUCCESS;
1108: byte *header;
1109: DWORD dwError;
1110: uint32 headerCrc32;
1111: byte *fieldPos;
1112:
1113: header = (byte *) TCalloc (TC_VOLUME_HEADER_EFFECTIVE_SIZE);
1114:
1115: if (!header)
1116: return ERR_OUTOFMEMORY;
1117:
1118: VirtualLock (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);
1119:
1120:
1121: fieldPos = (byte *) header + TC_HEADER_OFFSET_ENCRYPTED_AREA_START;
1122:
1123: offset.QuadPart = deviceSize - TC_VOLUME_HEADER_GROUP_SIZE;
1124:
1125: if (SetFilePointerEx (dev, offset, NULL, FILE_BEGIN) == 0
1126: || ReadFile (dev, header, TC_VOLUME_HEADER_EFFECTIVE_SIZE, &n, NULL) == 0)
1127: {
1128: nStatus = ERR_OS_ERROR;
1129: goto closing_seq;
1130: }
1131:
1132:
1133: DecryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, headerCryptoInfo);
1134:
1135: if (GetHeaderField32 (header, TC_HEADER_OFFSET_MAGIC) != 0x54525545)
1136: {
1137: nStatus = ERR_PARAMETER_INCORRECT;
1138: goto closing_seq;
1139: }
1140:
1141: mputInt64 (fieldPos, (masterCryptoInfo->EncryptedAreaStart.Value));
1142: mputInt64 (fieldPos, (masterCryptoInfo->EncryptedAreaLength.Value));
1143:
1144:
1145: headerCrc32 = GetCrc32 (header + TC_HEADER_OFFSET_MAGIC, TC_HEADER_OFFSET_HEADER_CRC - TC_HEADER_OFFSET_MAGIC);
1146: fieldPos = (byte *) header + TC_HEADER_OFFSET_HEADER_CRC;
1147: mputLong (fieldPos, headerCrc32);
1148:
1149: EncryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, headerCryptoInfo);
1150:
1151:
1152: if (SetFilePointerEx (dev, offset, NULL, FILE_BEGIN) == 0
1153: || WriteFile (dev, header, TC_VOLUME_HEADER_EFFECTIVE_SIZE, &n, NULL) == 0)
1154: {
1155: nStatus = ERR_OS_ERROR;
1156: goto closing_seq;
1157: }
1158:
1159:
1160: closing_seq:
1161:
1162: dwError = GetLastError();
1163:
1164: burn (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);
1165: VirtualUnlock (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);
1166: TCfree (header);
1167:
1168: if (nStatus != ERR_SUCCESS)
1169: SetLastError (dwError);
1170:
1171: return nStatus;
1172: }
1173:
1174:
1175: static HANDLE OpenPartitionVolume (const char *devName,
1176: BOOL bExclusiveRequired,
1177: BOOL bSharedRequired,
1178: BOOL bSharedRequiresConfirmation,
1179: BOOL bShowAlternativeSteps,
1180: BOOL bSilent)
1181: {
1182: HANDLE dev = INVALID_HANDLE_VALUE;
1183: int retryCount = 0;
1184:
1185: if (bExclusiveRequired)
1186: bSharedRequired = FALSE;
1187:
1188: if (bExclusiveRequired || !bSharedRequired)
1189: {
1190: // Exclusive access
1191: // Note that when exclusive access is denied, it is worth retrying (usually succeeds after a few tries).
1192: while (dev == INVALID_HANDLE_VALUE && retryCount++ < EXCL_ACCESS_MAX_AUTO_RETRIES)
1193: {
1194: dev = CreateFile (devName, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_FLAG_WRITE_THROUGH, NULL);
1195:
1196: if (retryCount > 1)
1197: Sleep (EXCL_ACCESS_AUTO_RETRY_DELAY);
1198: }
1199: }
1200:
1201: if (dev == INVALID_HANDLE_VALUE)
1202: {
1203: if (bExclusiveRequired)
1204: {
1205: if (!bSilent)
1206: {
1207: handleWin32Error (MainDlg);
1208:
1209: if (bShowAlternativeSteps)
1210: ShowInPlaceEncErrMsgWAltSteps ("INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL_ALT", TRUE);
1211: else
1212: Error ("INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL");
1213: }
1214: return INVALID_HANDLE_VALUE;
1215: }
1216:
1217: // Shared mode
1218: dev = CreateFile (devName, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_FLAG_WRITE_THROUGH, NULL);
1219: if (dev != INVALID_HANDLE_VALUE)
1220: {
1221: if (bSharedRequiresConfirmation
1222: && !bSilent
1223: && AskWarnNoYes ("DEVICE_IN_USE_INPLACE_ENC") == IDNO)
1224: {
1225: CloseHandle (dev);
1226: return INVALID_HANDLE_VALUE;
1227: }
1228: }
1229: else
1230: {
1231: if (!bSilent)
1232: {
1233: handleWin32Error (MainDlg);
1234:
1235: if (bShowAlternativeSteps)
1236: ShowInPlaceEncErrMsgWAltSteps ("INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL_ALT", TRUE);
1237: else
1238: Error ("INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL");
1239: }
1240: return INVALID_HANDLE_VALUE;
1241: }
1242: }
1243:
1244: return dev;
1245: }
1246:
1247:
1248: static int DismountFileSystem (HANDLE dev,
1249: int driveLetter,
1250: BOOL bForcedAllowed,
1251: BOOL bForcedRequiresConfirmation,
1252: BOOL bSilent)
1253: {
1254: int attempt;
1255: BOOL bResult;
1256: DWORD dwResult;
1257:
1258: CloseVolumeExplorerWindows (MainDlg, driveLetter);
1259:
1260: attempt = UNMOUNT_MAX_AUTO_RETRIES * 10;
1261:
1262: while (!(bResult = DeviceIoControl (dev, FSCTL_LOCK_VOLUME, NULL, 0, NULL, 0, &dwResult, NULL))
1263: && attempt > 0)
1264: {
1265: Sleep (UNMOUNT_AUTO_RETRY_DELAY);
1266: attempt--;
1267: }
1268:
1269: if (!bResult)
1270: {
1271: if (!bForcedAllowed)
1272: {
1273: if (!bSilent)
1274: ShowInPlaceEncErrMsgWAltSteps ("INPLACE_ENC_CANT_LOCK_OR_DISMOUNT_FILESYS", TRUE);
1275:
1276: return ERR_DONT_REPORT;
1277: }
1278:
1279: if (bForcedRequiresConfirmation
1280: && !bSilent
1281: && AskWarnYesNo ("VOL_LOCK_FAILED_OFFER_FORCED_DISMOUNT") == IDNO)
1282: {
1283: return ERR_DONT_REPORT;
1284: }
1285: }
1286:
1287: // Dismount the volume
1288:
1289: attempt = UNMOUNT_MAX_AUTO_RETRIES * 10;
1290:
1291: while (!(bResult = DeviceIoControl (dev, FSCTL_DISMOUNT_VOLUME, NULL, 0, NULL, 0, &dwResult, NULL))
1292: && attempt > 0)
1293: {
1294: Sleep (UNMOUNT_AUTO_RETRY_DELAY);
1295: attempt--;
1296: }
1297:
1298: if (!bResult)
1299: {
1300: if (!bSilent)
1301: ShowInPlaceEncErrMsgWAltSteps ("INPLACE_ENC_CANT_LOCK_OR_DISMOUNT_FILESYS", TRUE);
1302:
1303: return ERR_DONT_REPORT;
1304: }
1305:
1306: return ERR_SUCCESS;
1307: }
1308:
1309:
1310: // Easy-to-undo modification applied to conceal the NTFS filesystem (to prevent Windows and apps from
1311: // interfering with it until the volume has been fully encrypted). Note that this function will precisely
1312: // undo any modifications it made to the filesystem automatically if an error occurs when writing (including
1313: // physical drive defects).
1314: static int ConcealNTFS (HANDLE dev)
1315: {
1316: char buf [TC_INITIAL_NTFS_CONCEAL_PORTION_SIZE];
1317: DWORD nbrBytesProcessed, nbrBytesProcessed2;
1318: int i;
1319: LARGE_INTEGER offset;
1320: DWORD dwError;
1321:
1322: offset.QuadPart = 0;
1323:
1324: if (SetFilePointerEx (dev, offset, NULL, FILE_BEGIN) == 0)
1325: return ERR_OS_ERROR;
1326:
1327: if (ReadFile (dev, buf, TC_INITIAL_NTFS_CONCEAL_PORTION_SIZE, &nbrBytesProcessed, NULL) == 0)
1328: return ERR_OS_ERROR;
1329:
1330: for (i = 0; i < TC_INITIAL_NTFS_CONCEAL_PORTION_SIZE; i++)
1331: buf[i] ^= TC_NTFS_CONCEAL_CONSTANT;
1332:
1333: offset.QuadPart = 0;
1334:
1335: if (SetFilePointerEx (dev, offset, NULL, FILE_BEGIN) == 0)
1336: return ERR_OS_ERROR;
1337:
1338: if (WriteFile (dev, buf, TC_INITIAL_NTFS_CONCEAL_PORTION_SIZE, &nbrBytesProcessed, NULL) == 0)
1339: {
1340: // One or more of the sectors is/are probably damaged and cause write errors.
1341: // We must undo the modifications we made.
1342:
1343: dwError = GetLastError();
1344:
1345: for (i = 0; i < TC_INITIAL_NTFS_CONCEAL_PORTION_SIZE; i++)
1346: buf[i] ^= TC_NTFS_CONCEAL_CONSTANT;
1347:
1348: offset.QuadPart = 0;
1349:
1350: do
1351: {
1352: Sleep (1);
1353: }
1354: while (SetFilePointerEx (dev, offset, NULL, FILE_BEGIN) == 0
1355: || WriteFile (dev, buf, TC_INITIAL_NTFS_CONCEAL_PORTION_SIZE, &nbrBytesProcessed2, NULL) == 0);
1356:
1357: SetLastError (dwError);
1358:
1359: return ERR_OS_ERROR;
1360: }
1361:
1362: return ERR_SUCCESS;
1363: }
1364:
1365:
1366: void ShowInPlaceEncErrMsgWAltSteps (char *iniStrId, BOOL bErr)
1367: {
1368: wchar_t msg[30000];
1369:
1370: wcscpy (msg, GetString (iniStrId));
1371:
1372: wcscat (msg, L"\n\n\n");
1373: wcscat (msg, GetString ("INPLACE_ENC_ALTERNATIVE_STEPS"));
1374:
1375: if (bErr)
1376: ErrorDirect (msg);
1377: else
1378: WarningDirect (msg);
1379: }
1380:
1381:
1382: static void ExportProgressStats (__int64 bytesDone, __int64 totalSectors)
1383: {
1384: NonSysInplaceEncBytesDone = bytesDone;
1385: NonSysInplaceEncTotalSectors = totalSectors;
1386: }
1387:
1388:
1389: void SetNonSysInplaceEncUIStatus (int nonSysInplaceEncStatus)
1390: {
1391: NonSysInplaceEncStatus = nonSysInplaceEncStatus;
1392: }
1393:
1394:
1395: BOOL SaveNonSysInPlaceEncSettings (int delta, WipeAlgorithmId newWipeAlgorithm)
1396: {
1397: int count;
1398: char str[32];
1399: WipeAlgorithmId savedWipeAlgorithm = TC_WIPE_NONE;
1400:
1401: if (delta == 0)
1402: return TRUE;
1403:
1404: count = LoadNonSysInPlaceEncSettings (&savedWipeAlgorithm) + delta;
1405:
1406: if (count < 1)
1407: {
1.1.1.2 root 1408: RemoveNonSysInPlaceEncNotifications();
1.1 root 1409: return TRUE;
1410: }
1411: else
1412: {
1413: if (newWipeAlgorithm != TC_WIPE_NONE)
1414: {
1415: sprintf (str, "%d", (int) newWipeAlgorithm);
1416:
1417: SaveBufferToFile (str, GetConfigPath (TC_APPD_FILENAME_NONSYS_INPLACE_ENC_WIPE), strlen(str), FALSE);
1418: }
1419: else if (FileExists (GetConfigPath (TC_APPD_FILENAME_NONSYS_INPLACE_ENC_WIPE)))
1420: {
1421: remove (GetConfigPath (TC_APPD_FILENAME_NONSYS_INPLACE_ENC_WIPE));
1422: }
1423:
1424: sprintf (str, "%d", count);
1425:
1426: return SaveBufferToFile (str, GetConfigPath (TC_APPD_FILENAME_NONSYS_INPLACE_ENC), strlen(str), FALSE);
1427: }
1428: }
1429:
1430:
1431: // Repairs damaged sectors (i.e. those with read errors) by zeroing them.
1432: // Note that this operating fails if there are any write errors.
1433: int ZeroUnreadableSectors (HANDLE dev, LARGE_INTEGER startOffset, int64 size, int sectorSize, uint64 *zeroedSectorCount)
1434: {
1435: int nStatus;
1436: DWORD n;
1437: int64 sectorCount;
1438: LARGE_INTEGER workOffset;
1439: byte *sectorBuffer = NULL;
1440: DWORD dwError;
1441:
1442: workOffset.QuadPart = startOffset.QuadPart;
1443:
1444: sectorBuffer = (byte *) TCalloc (sectorSize);
1445:
1446: if (!sectorBuffer)
1447: return ERR_OUTOFMEMORY;
1448:
1449: if (SetFilePointerEx (dev, startOffset, NULL, FILE_BEGIN) == 0)
1450: {
1451: nStatus = ERR_OS_ERROR;
1452: goto closing_seq;
1453: }
1454:
1455:
1456: for (sectorCount = size / sectorSize; sectorCount > 0; --sectorCount)
1457: {
1458: if (ReadFile (dev, sectorBuffer, sectorSize, &n, NULL) == 0)
1459: {
1460: memset (sectorBuffer, 0, sectorSize);
1461:
1462: if (SetFilePointerEx (dev, workOffset, NULL, FILE_BEGIN) == 0)
1463: {
1464: nStatus = ERR_OS_ERROR;
1465: goto closing_seq;
1466: }
1467:
1468: if (WriteFile (dev, sectorBuffer, sectorSize, &n, NULL) == 0)
1469: {
1470: nStatus = ERR_OS_ERROR;
1471: goto closing_seq;
1472: }
1473: ++(*zeroedSectorCount);
1474: }
1475:
1476: workOffset.QuadPart += n;
1477: }
1478:
1479: nStatus = ERR_SUCCESS;
1480:
1481: closing_seq:
1482:
1483: dwError = GetLastError();
1484:
1485: if (sectorBuffer != NULL)
1486: TCfree (sectorBuffer);
1487:
1488: if (nStatus != ERR_SUCCESS)
1489: SetLastError (dwError);
1490:
1491: return nStatus;
1492: }
1493:
1494:
1495: static int OpenBackupHeader (HANDLE dev, const char *devicePath, Password *password, PCRYPTO_INFO *retMasterCryptoInfo, CRYPTO_INFO *headerCryptoInfo, __int64 deviceSize)
1496: {
1497: LARGE_INTEGER offset;
1498: DWORD n;
1499: int nStatus = ERR_SUCCESS;
1500: char *header;
1501: DWORD dwError;
1502:
1503: header = (char *) TCalloc (TC_VOLUME_HEADER_EFFECTIVE_SIZE);
1504: if (!header)
1505: return ERR_OUTOFMEMORY;
1506:
1507: VirtualLock (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);
1508:
1509:
1510:
1511: offset.QuadPart = deviceSize - TC_VOLUME_HEADER_GROUP_SIZE;
1512:
1513: if (SetFilePointerEx (dev, offset, NULL, FILE_BEGIN) == 0
1514: || ReadFile (dev, header, TC_VOLUME_HEADER_EFFECTIVE_SIZE, &n, NULL) == 0)
1515: {
1516: nStatus = ERR_OS_ERROR;
1517: goto closing_seq;
1518: }
1519:
1520:
1521: nStatus = ReadVolumeHeader (FALSE, header, password, retMasterCryptoInfo, headerCryptoInfo);
1522: if (nStatus != ERR_SUCCESS)
1523: goto closing_seq;
1524:
1525:
1526: closing_seq:
1527:
1528: dwError = GetLastError();
1529:
1530: burn (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);
1531: VirtualUnlock (header, TC_VOLUME_HEADER_EFFECTIVE_SIZE);
1532: TCfree (header);
1533:
1534: dwError = GetLastError();
1535:
1536: if (nStatus != ERR_SUCCESS)
1537: SetLastError (dwError);
1538:
1539: return nStatus;
1540: }
1541:
1542:
1543: static BOOL GetFreeClusterBeforeThreshold (HANDLE volumeHandle, int64 *freeCluster, int64 clusterThreshold)
1544: {
1545: const int bitmapSize = 65536;
1546: byte bitmapBuffer[bitmapSize + sizeof (VOLUME_BITMAP_BUFFER)];
1547: VOLUME_BITMAP_BUFFER *bitmap = (VOLUME_BITMAP_BUFFER *) bitmapBuffer;
1548: STARTING_LCN_INPUT_BUFFER startLcn;
1549: startLcn.StartingLcn.QuadPart = 0;
1550:
1551: DWORD bytesReturned;
1552: while (DeviceIoControl (volumeHandle, FSCTL_GET_VOLUME_BITMAP, &startLcn, sizeof (startLcn), &bitmapBuffer, sizeof (bitmapBuffer), &bytesReturned, NULL)
1553: || GetLastError() == ERROR_MORE_DATA)
1554: {
1555: for (int64 bitmapIndex = 0; bitmapIndex < min (bitmapSize, (bitmap->BitmapSize.QuadPart / 8)); ++bitmapIndex)
1556: {
1557: if (bitmap->StartingLcn.QuadPart + bitmapIndex * 8 >= clusterThreshold)
1558: goto err;
1559:
1560: if (bitmap->Buffer[bitmapIndex] != 0xff)
1561: {
1562: for (int bit = 0; bit < 8; ++bit)
1563: {
1564: if ((bitmap->Buffer[bitmapIndex] & (1 << bit)) == 0)
1565: {
1566: *freeCluster = bitmap->StartingLcn.QuadPart + bitmapIndex * 8 + bit;
1567:
1568: if (*freeCluster >= clusterThreshold)
1569: goto err;
1570:
1571: return TRUE;
1572: }
1573: }
1574: }
1575: }
1576:
1577: startLcn.StartingLcn.QuadPart += min (bitmapSize * 8, bitmap->BitmapSize.QuadPart);
1578: }
1579:
1580: err:
1581: SetLastError (ERROR_DISK_FULL);
1582: return FALSE;
1583: }
1584:
1585:
1586: static BOOL MoveClustersBeforeThresholdInDir (HANDLE volumeHandle, const wstring &directory, int64 clusterThreshold)
1587: {
1588: WIN32_FIND_DATAW findData;
1589:
1590: HANDLE findHandle = FindFirstFileW (((directory.size() <= 3 ? L"" : L"\\\\?\\") + directory + L"\\*").c_str(), &findData);
1591: if (findHandle == INVALID_HANDLE_VALUE)
1592: return TRUE; // Error ignored
1593:
1594: finally_do_arg (HANDLE, findHandle, { FindClose (finally_arg); });
1595:
1596: // Find all files and directories
1597: do
1598: {
1599: if (findData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)
1600: {
1601: wstring subDir = findData.cFileName;
1602:
1603: if (subDir == L"." || subDir == L"..")
1604: continue;
1605:
1606: if (!MoveClustersBeforeThresholdInDir (volumeHandle, directory + L"\\" + subDir, clusterThreshold))
1607: return FALSE;
1608: }
1609:
1610: DWORD access = FILE_READ_ATTRIBUTES;
1611:
1612: if (findData.dwFileAttributes & FILE_ATTRIBUTE_ENCRYPTED)
1613: access = FILE_READ_DATA;
1614:
1615: HANDLE fsObject = CreateFileW ((directory + L"\\" + findData.cFileName).c_str(), access, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);
1616: if (fsObject == INVALID_HANDLE_VALUE)
1617: continue;
1618:
1619: finally_do_arg (HANDLE, fsObject, { CloseHandle (finally_arg); });
1620:
1621: STARTING_VCN_INPUT_BUFFER startVcn;
1622: startVcn.StartingVcn.QuadPart = 0;
1623: RETRIEVAL_POINTERS_BUFFER retPointers;
1624: DWORD bytesReturned;
1625:
1626: // Find clusters allocated beyond the threshold
1627: while (DeviceIoControl (fsObject, FSCTL_GET_RETRIEVAL_POINTERS, &startVcn, sizeof (startVcn), &retPointers, sizeof (retPointers), &bytesReturned, NULL)
1628: || GetLastError() == ERROR_MORE_DATA)
1629: {
1630: if (retPointers.ExtentCount == 0)
1631: break;
1632:
1633: if (retPointers.Extents[0].Lcn.QuadPart != -1)
1634: {
1635: int64 extentStartCluster = retPointers.Extents[0].Lcn.QuadPart;
1636: int64 extentLen = retPointers.Extents[0].NextVcn.QuadPart - retPointers.StartingVcn.QuadPart;
1637: int64 extentEndCluster = extentStartCluster + extentLen - 1;
1638:
1639: if (extentEndCluster >= clusterThreshold)
1640: {
1641: // Move clusters before the threshold
1642: for (int64 movedCluster = max (extentStartCluster, clusterThreshold); movedCluster <= extentEndCluster; ++movedCluster)
1643: {
1644: for (int retry = 0; ; ++retry)
1645: {
1646: MOVE_FILE_DATA moveData;
1647:
1648: if (GetFreeClusterBeforeThreshold (volumeHandle, &moveData.StartingLcn.QuadPart, clusterThreshold))
1649: {
1650: moveData.FileHandle = fsObject;
1651: moveData.StartingVcn.QuadPart = movedCluster - extentStartCluster + retPointers.StartingVcn.QuadPart;
1652: moveData.ClusterCount = 1;
1653:
1654: if (DeviceIoControl (volumeHandle, FSCTL_MOVE_FILE, &moveData, sizeof (moveData), NULL, 0, &bytesReturned, NULL))
1655: break;
1656: }
1657:
1.1.1.2 root 1658: if (retry > 600)
1.1 root 1659: return FALSE;
1660:
1661: // There are possible race conditions as we work on a live filesystem
1662: Sleep (100);
1663: }
1664: }
1665: }
1666: }
1667:
1668: startVcn.StartingVcn = retPointers.Extents[0].NextVcn;
1669: }
1670:
1671: } while (FindNextFileW (findHandle, &findData));
1672:
1673: return TRUE;
1674: }
1675:
1676:
1677: BOOL MoveClustersBeforeThreshold (HANDLE volumeHandle, PWSTR volumeDevicePath, int64 clusterThreshold)
1678: {
1679: int drive = GetDiskDeviceDriveLetter (volumeDevicePath);
1680: if (drive == -1)
1681: {
1682: SetLastError (ERROR_INVALID_PARAMETER);
1683: return FALSE;
1684: }
1685:
1686: wstring volumeRoot = L"X:";
1687: volumeRoot[0] = L'A' + drive;
1688:
1689: return MoveClustersBeforeThresholdInDir (volumeHandle, volumeRoot, clusterThreshold);
1690: }
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.