VeraCrypt
aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorMounir IDRASSI <mounir.idrassi@idrix.fr>2016-10-08 19:00:02 +0200
committerMounir IDRASSI <mounir.idrassi@idrix.fr>2016-10-17 18:40:25 +0200
commit0ac40097200985a64665ac8f7c0dd66ce5157988 (patch)
treec2f528c93409b9706179ed7424b32da59d0adaf6 /src
parent2a10640f42420683ca59feaca2ec43dc6977f1ae (diff)
downloadVeraCrypt-0ac40097200985a64665ac8f7c0dd66ce5157988.tar.gz
VeraCrypt-0ac40097200985a64665ac8f7c0dd66ce5157988.zip
Windows: Fix failure to access EFS data on VeraCrypt volumes under Windows 10 but supporting undocumented IOCTL.
Diffstat (limited to 'src')
-rw-r--r--src/Common/Apidrvr.h2
-rw-r--r--src/Driver/Ntdriver.c13
2 files changed, 13 insertions, 2 deletions
diff --git a/src/Common/Apidrvr.h b/src/Common/Apidrvr.h
index 36233d76..07a8448c 100644
--- a/src/Common/Apidrvr.h
+++ b/src/Common/Apidrvr.h
@@ -124,6 +124,8 @@
#define TC_IOCTL_LEGACY_GET_DRIVER_VERSION 466968
#define TC_IOCTL_LEGACY_GET_MOUNTED_VOLUMES 466948
+// Undocumented IOCTL sent by Windows 10 when handling EFS data on volumes
+#define IOCTL_UNKNOWN_WINDOWS10_EFS_ACCESS 0x455610D8
/* Start of driver interface structures, the size of these structures may
change between versions; so make sure you first send DRIVER_VERSION to
diff --git a/src/Driver/Ntdriver.c b/src/Driver/Ntdriver.c
index 384fca99..eaa8fa8c 100644
--- a/src/Driver/Ntdriver.c
+++ b/src/Driver/Ntdriver.c
@@ -214,7 +214,7 @@ NTSTATUS TCDispatchQueueIRP (PDEVICE_OBJECT DeviceObject, PIRP Irp)
PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (Irp);
NTSTATUS ntStatus;
-#ifdef _DEBUG
+#if defined(_DEBUG) || defined (_DEBUG_TRACE)
if (irpSp->MajorFunction == IRP_MJ_DEVICE_CONTROL && (Extension->bRootDevice || Extension->IsVolumeDevice))
{
switch (irpSp->Parameters.DeviceIoControl.IoControlCode)
@@ -896,6 +896,15 @@ NTSTATUS ProcessVolumeDeviceControlIrp (PDEVICE_OBJECT DeviceObject, PEXTENSION
}
break;
+
+ case IOCTL_UNKNOWN_WINDOWS10_EFS_ACCESS:
+ // This undocumented IOCTL is sent when handling EFS data
+ // We must return success otherwise EFS operations fail
+ Dump ("ProcessVolumeDeviceControlIrp (unknown IOCTL 0x%.8X, OutputBufferLength = %d). Returning fake success\n", irpSp->Parameters.DeviceIoControl.IoControlCode, (int) irpSp->Parameters.DeviceIoControl.OutputBufferLength);
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = 0;
+
+ break;
default:
Dump ("ProcessVolumeDeviceControlIrp (unknown code 0x%.8X)\n", irpSp->Parameters.DeviceIoControl.IoControlCode);
return TCCompleteIrp (Irp, STATUS_INVALID_DEVICE_REQUEST, 0);
@@ -2071,7 +2080,7 @@ void TCGetDosNameFromNumber (LPWSTR dosname,int cbDosName, int nDriveNo, DeviceN
RtlStringCbCatW (dosname, cbDosName, tmp);
}
-#ifdef _DEBUG
+#if defined(_DEBUG) || defined (_DEBUG_TRACE)
LPWSTR TCTranslateCode (ULONG ulCode)
{
switch (ulCode)