VeraCrypt
aboutsummaryrefslogtreecommitdiff
path: root/src/Driver
diff options
context:
space:
mode:
Diffstat (limited to 'src/Driver')
-rw-r--r--src/Driver/BuildDriver.cmd162
-rw-r--r--src/Driver/DriveFilter.c1942
-rw-r--r--src/Driver/DriveFilter.h85
-rw-r--r--src/Driver/Driver.rc101
-rw-r--r--src/Driver/Driver.vcproj414
-rw-r--r--src/Driver/DumpFilter.c244
-rw-r--r--src/Driver/DumpFilter.h21
-rw-r--r--src/Driver/EncryptedIoQueue.c1008
-rw-r--r--src/Driver/EncryptedIoQueue.h161
-rw-r--r--src/Driver/Makefile1
-rw-r--r--src/Driver/Ntdriver.c3293
-rw-r--r--src/Driver/Ntdriver.h174
-rw-r--r--src/Driver/Ntvol.c862
-rw-r--r--src/Driver/Ntvol.h19
-rw-r--r--src/Driver/Resource.h16
-rw-r--r--src/Driver/Sources21
-rw-r--r--src/Driver/VolumeFilter.c290
-rw-r--r--src/Driver/VolumeFilter.h19
18 files changed, 8833 insertions, 0 deletions
diff --git a/src/Driver/BuildDriver.cmd b/src/Driver/BuildDriver.cmd
new file mode 100644
index 00000000..c9d78943
--- /dev/null
+++ b/src/Driver/BuildDriver.cmd
@@ -0,0 +1,162 @@
+::
+:: Copyright (c) 2008-2009 TrueCrypt Developers Association. All rights reserved.
+::
+:: Governed by the TrueCrypt License 3.0 the full text of which is contained in
+:: the file License.txt included in TrueCrypt binary and source code distribution
+:: packages.
+::
+
+:: Usage: BuildDriver <-build|-rebuild|-clean> <-release|-debug> <-x86|-x64> <dir1> [dir2] ...
+
+@echo off
+set TC_ARG_CMD=%~1
+shift
+set TC_ARG_TYPE=%~1
+shift
+set TC_ARG_ARCH=%~1
+shift
+
+
+:: Windows Driver Kit build number
+
+set TC_WINDDK_BUILD=7600.16385.1
+
+
+:: Check for spaces in the current directory path
+
+cd | find " " >NUL:
+
+if %ERRORLEVEL% == 0 (
+ echo BuildDriver.cmd: error: MS Build does not support building of projects stored in a path containing spaces. >&2
+ exit /B 1
+)
+
+
+:: Build options
+
+set TC_C_DEFINES=-D_WIN32 -DTC_WINDOWS_DRIVER
+set TC_C_FLAGS=-nologo -I..
+set TC_C_WARNING_LEVEL=-W4
+set TC_C_DISABLED_WARNINGS=-wd4057 -wd4100 -wd4127 -wd4152 -wd4201 -wd4701 -wd4702 -wd4706
+set TC_LIBRARIAN_FLAGS=-nologo
+set TC_LINKER_FLAGS=-nologo
+set TC_TEST_SIGN=0
+
+
+:: Windows Driver Kit root
+
+set TC_WINDDK_ROOT=%SYSTEMDRIVE%\WinDDK\%TC_WINDDK_BUILD%
+if exist "%TC_WINDDK_ROOT%\bin\setenv.bat" goto ddk_found
+
+set TC_WINDDK_ROOT=%WINDDK_ROOT%\%TC_WINDDK_BUILD%
+if exist "%TC_WINDDK_ROOT%\bin\setenv.bat" goto ddk_found
+
+set TC_WINDDK_ROOT=%WINDDK_ROOT%
+if exist "%TC_WINDDK_ROOT%\bin\setenv.bat" goto ddk_found
+
+echo BuildDriver.cmd: error: Windows Driver Development Kit not found in the default directory. Set WINDDK_ROOT environment variable to point to your Windows DDK installation directory. >&2
+exit /B 1
+
+:ddk_found
+
+
+:: CPU architecture
+
+if "%TC_ARG_ARCH%"=="-x64" (
+ set TC_BUILD_ARCH=x64 WNET
+ set TC_BUILD_ARCH_DIR=amd64
+ set TC_ARCH=x64
+ set TC_ARCH_SUFFIX=-x64
+ set TC_C_DISABLED_WARNINGS=%TC_C_DISABLED_WARNINGS% -wd4328 -wd4366
+ set TC_LINKER_FLAGS=%TC_LINKER_FLAGS% -LTCG
+ if defined TC_KERNEL_TEST_CERTIFICATE_NAME set TC_TEST_SIGN=1
+) else (
+ set TC_BUILD_ARCH=WXP
+ set TC_BUILD_ARCH_DIR=i386
+ set TC_ARCH=x86
+ set TC_ARCH_SUFFIX=
+)
+
+
+:: Build type
+
+if "%TC_ARG_TYPE%"=="-debug" (
+ set TC_BUILD_TYPE=chk
+ set TC_C_DEFINES=%TC_C_DEFINES% -DDEBUG -D_DEBUG
+ set TC_BUILD_ALT_DIR=_driver_debug
+ set TC_COPY_DIR="..\Debug"
+) else (
+ set TC_BUILD_TYPE=fre
+ set TC_BUILD_ALT_DIR=_driver_release
+ set TC_COPY_DIR="..\Release"
+ set TC_TEST_SIGN=0
+)
+
+
+:: WDK environment
+
+pushd .
+call %TC_WINDDK_ROOT%\bin\setenv %TC_WINDDK_ROOT% %TC_BUILD_TYPE% %TC_BUILD_ARCH% no_oacr || exit /B %errorlevel%
+popd
+
+
+:: Build
+
+if "%TC_ARG_CMD%"=="-rebuild" (set TC_BUILD_OPTS=-c -Z)
+
+pushd .
+:build_dirs
+
+ if "%~1"=="" goto done
+ cd /D "%~1" || exit /B %errorlevel%
+
+ if "%TC_ARG_CMD%"=="-clean" (
+ rd /s /q obj%TC_BUILD_ALT_DIR%\%TC_BUILD_ARCH_DIR% 2>NUL:
+ rd /q obj%TC_BUILD_ALT_DIR% 2>NUL:
+ ) else (
+
+ set USER_C_FLAGS=%TC_C_FLAGS% %TC_C_DISABLED_WARNINGS% -FAcs -Fa%~1\obj%TC_BUILD_ALT_DIR%\%TC_BUILD_ARCH_DIR%\
+ set MSC_WARNING_LEVEL=%TC_C_WARNING_LEVEL%
+ set C_DEFINES=%TC_C_DEFINES%
+ set RCOPTIONS=/I %MFC_INC_PATH%
+ set LIBRARIAN_FLAGS=%TC_LIBRARIAN_FLAGS%
+ set LINKER_FLAGS=%TC_LINKER_FLAGS%
+ set BUILD_ALT_DIR=%TC_BUILD_ALT_DIR%
+
+ build %TC_BUILD_OPTS% -w -nmake /S -nmake /C 2>build_errors.log 1>&2
+
+ if errorlevel 1 (
+ type build_errors.log
+ type build_errors_asm.log 2>NUL:
+ exit /B 1
+ )
+ del /q build_errors.log build_errors_asm.log build%BUILD_ALT_DIR%.* 2>NUL:
+ )
+
+ shift
+
+goto build_dirs
+:done
+popd
+
+
+if "%TC_ARG_CMD%"=="-clean" exit /B 0
+
+md "%TC_COPY_DIR%\Setup Files" >NUL: 2>NUL:
+copy /B /Y obj%TC_BUILD_ALT_DIR%\%TC_BUILD_ARCH_DIR%\truecrypt.sys "%TC_COPY_DIR%\Setup Files\truecrypt%TC_ARCH_SUFFIX%.sys" >NUL:
+
+if errorlevel 1 (
+ echo BuildDriver.cmd: error: Cannot copy target. >&2
+ exit /B 1
+)
+
+if %TC_TEST_SIGN% equ 1 (
+ signtool sign /s "%TC_KERNEL_TEST_CERTIFICATE_STORE%" /n "%TC_KERNEL_TEST_CERTIFICATE_NAME%" "%TC_COPY_DIR%\Setup Files\truecrypt%TC_ARCH_SUFFIX%.sys" >NUL:
+
+ if errorlevel 1 (
+ echo BuildDriver.cmd: error: Cannot test-sign target. >&2
+ exit /B 1
+ )
+)
+
+exit /B 0
diff --git a/src/Driver/DriveFilter.c b/src/Driver/DriveFilter.c
new file mode 100644
index 00000000..72adb86f
--- /dev/null
+++ b/src/Driver/DriveFilter.c
@@ -0,0 +1,1942 @@
+/*
+ Copyright (c) 2008-2012 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#include "TCdefs.h"
+#include <ntddk.h>
+#include <ntddvol.h>
+#include "Cache.h"
+#include "Crc.h"
+#include "Crypto.h"
+#include "Apidrvr.h"
+#include "EncryptedIoQueue.h"
+#include "Common/Endian.h"
+#include "Ntdriver.h"
+#include "Ntvol.h"
+#include "Volumes.h"
+#include "VolumeFilter.h"
+#include "Wipe.h"
+#include "DriveFilter.h"
+#include "Boot/Windows/BootCommon.h"
+
+static BOOL DeviceFilterActive = FALSE;
+
+BOOL BootArgsValid = FALSE;
+BootArguments BootArgs;
+static uint16 BootLoaderSegment;
+static BOOL BootDriveSignatureValid = FALSE;
+
+static KMUTEX MountMutex;
+
+static volatile BOOL BootDriveFound = FALSE;
+static DriveFilterExtension *BootDriveFilterExtension = NULL;
+static LARGE_INTEGER BootDriveLength;
+
+static BOOL CrashDumpEnabled = FALSE;
+static BOOL HibernationEnabled = FALSE;
+
+static BOOL LegacyHibernationDriverFilterActive = FALSE;
+static byte *HibernationWriteBuffer = NULL;
+static MDL *HibernationWriteBufferMdl = NULL;
+
+static uint32 HibernationPreventionCount = 0;
+
+static BootEncryptionSetupRequest SetupRequest;
+static volatile BOOL SetupInProgress = FALSE;
+PKTHREAD EncryptionSetupThread = NULL;
+static volatile BOOL EncryptionSetupThreadAbortRequested;
+static KSPIN_LOCK SetupStatusSpinLock;
+static int64 SetupStatusEncryptedAreaEnd;
+static BOOL TransformWaitingForIdle;
+static NTSTATUS SetupResult;
+
+static WipeDecoySystemRequest WipeDecoyRequest;
+static volatile BOOL DecoySystemWipeInProgress = FALSE;
+static volatile BOOL DecoySystemWipeThreadAbortRequested;
+static KSPIN_LOCK DecoySystemWipeStatusSpinLock;
+static int64 DecoySystemWipedAreaEnd;
+PKTHREAD DecoySystemWipeThread = NULL;
+static NTSTATUS DecoySystemWipeResult;
+
+
+NTSTATUS LoadBootArguments ()
+{
+ NTSTATUS status = STATUS_UNSUCCESSFUL;
+ PHYSICAL_ADDRESS bootArgsAddr;
+ byte *mappedBootArgs;
+ uint16 bootLoaderSegment;
+
+ KeInitializeMutex (&MountMutex, 0);
+
+ for (bootLoaderSegment = TC_BOOT_LOADER_SEGMENT;
+ bootLoaderSegment >= TC_BOOT_LOADER_SEGMENT - 64 * 1024 / 16 && status != STATUS_SUCCESS;
+ bootLoaderSegment -= 32 * 1024 / 16)
+ {
+ bootArgsAddr.QuadPart = (bootLoaderSegment << 4) + TC_BOOT_LOADER_ARGS_OFFSET;
+ Dump ("Checking BootArguments at 0x%x\n", bootArgsAddr.LowPart);
+
+ mappedBootArgs = MmMapIoSpace (bootArgsAddr, sizeof (BootArguments), MmCached);
+ if (!mappedBootArgs)
+ return STATUS_INSUFFICIENT_RESOURCES;
+
+ if (TC_IS_BOOT_ARGUMENTS_SIGNATURE (mappedBootArgs))
+ {
+ BootArguments *bootArguments = (BootArguments *) mappedBootArgs;
+ Dump ("BootArguments found at 0x%x\n", bootArgsAddr.LowPart);
+
+ DumpMem (mappedBootArgs, sizeof (BootArguments));
+
+ if (bootArguments->BootLoaderVersion == VERSION_NUM
+ && bootArguments->BootArgumentsCrc32 != GetCrc32 ((byte *) bootArguments, (int) ((byte *) &bootArguments->BootArgumentsCrc32 - (byte *) bootArguments)))
+ {
+ Dump ("BootArguments CRC incorrect\n");
+ TC_BUG_CHECK (STATUS_CRC_ERROR);
+ }
+
+ BootLoaderSegment = bootLoaderSegment;
+
+ BootArgs = *bootArguments;
+ BootArgsValid = TRUE;
+ memset (bootArguments, 0, sizeof (*bootArguments));
+
+ if (BootArgs.BootLoaderVersion < 0x600)
+ {
+ BootArgs.HiddenSystemPartitionStart = 0;
+ BootArgs.DecoySystemPartitionStart = 0;
+ }
+
+ if (BootArgs.BootLoaderVersion < 0x630)
+ BootArgs.Flags = 0;
+
+ BootDriveSignatureValid = (BootArgs.BootLoaderVersion >= 0x710);
+
+ Dump ("BootLoaderVersion = %x\n", (int) BootArgs.BootLoaderVersion);
+ Dump ("HeaderSaltCrc32 = %x\n", (int) BootArgs.HeaderSaltCrc32);
+ Dump ("CryptoInfoOffset = %x\n", (int) BootArgs.CryptoInfoOffset);
+ Dump ("CryptoInfoLength = %d\n", (int) BootArgs.CryptoInfoLength);
+ Dump ("HiddenSystemPartitionStart = %I64u\n", BootArgs.HiddenSystemPartitionStart);
+ Dump ("DecoySystemPartitionStart = %I64u\n", BootArgs.DecoySystemPartitionStart);
+ Dump ("Flags = %x\n", BootArgs.Flags);
+ Dump ("BootDriveSignature = %x\n", BootArgs.BootDriveSignature);
+ Dump ("BootArgumentsCrc32 = %x\n", BootArgs.BootArgumentsCrc32);
+
+ if (CacheBootPassword && BootArgs.BootPassword.Length > 0)
+ AddPasswordToCache (&BootArgs.BootPassword);
+
+ status = STATUS_SUCCESS;
+ }
+
+ MmUnmapIoSpace (mappedBootArgs, sizeof (BootArguments));
+ }
+
+ return status;
+}
+
+
+NTSTATUS DriveFilterAddDevice (PDRIVER_OBJECT driverObject, PDEVICE_OBJECT pdo)
+{
+ DriveFilterExtension *Extension;
+ NTSTATUS status;
+ PDEVICE_OBJECT filterDeviceObject = NULL;
+ PDEVICE_OBJECT attachedDeviceObject;
+
+ Dump ("DriveFilterAddDevice pdo=%p\n", pdo);
+
+ attachedDeviceObject = IoGetAttachedDeviceReference (pdo);
+ status = IoCreateDevice (driverObject, sizeof (DriveFilterExtension), NULL, attachedDeviceObject->DeviceType, 0, FALSE, &filterDeviceObject);
+
+ ObDereferenceObject (attachedDeviceObject);
+
+ if (!NT_SUCCESS (status))
+ {
+ filterDeviceObject = NULL;
+ goto err;
+ }
+
+ Extension = (DriveFilterExtension *) filterDeviceObject->DeviceExtension;
+ memset (Extension, 0, sizeof (DriveFilterExtension));
+
+ Extension->LowerDeviceObject = IoAttachDeviceToDeviceStack (filterDeviceObject, pdo); // IoAttachDeviceToDeviceStackSafe() is not required in AddDevice routine and is also unavailable on Windows 2000 SP4
+ if (!Extension->LowerDeviceObject)
+ {
+ status = STATUS_DEVICE_REMOVED;
+ goto err;
+ }
+
+ Extension->IsDriveFilterDevice = Extension->Queue.IsFilterDevice = TRUE;
+ Extension->DeviceObject = Extension->Queue.DeviceObject = filterDeviceObject;
+ Extension->Pdo = pdo;
+
+ Extension->Queue.LowerDeviceObject = Extension->LowerDeviceObject;
+ IoInitializeRemoveLock (&Extension->Queue.RemoveLock, 'LRCT', 0, 0);
+
+ Extension->ConfiguredEncryptedAreaStart = -1;
+ Extension->ConfiguredEncryptedAreaEnd = -1;
+ Extension->Queue.EncryptedAreaStart = -1;
+ Extension->Queue.EncryptedAreaEnd = -1;
+ Extension->Queue.EncryptedAreaEndUpdatePending = FALSE;
+
+ filterDeviceObject->Flags |= Extension->LowerDeviceObject->Flags & (DO_DIRECT_IO | DO_BUFFERED_IO | DO_POWER_PAGABLE);
+ filterDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
+
+ DeviceFilterActive = TRUE;
+ return status;
+
+err:
+ if (filterDeviceObject)
+ {
+ if (Extension->LowerDeviceObject)
+ IoDetachDevice (Extension->LowerDeviceObject);
+
+ IoDeleteDevice (filterDeviceObject);
+ }
+
+ return status;
+}
+
+
+static void DismountDrive (DriveFilterExtension *Extension, BOOL stopIoQueue)
+{
+ Dump ("Dismounting drive\n");
+ ASSERT (Extension->DriveMounted);
+
+ if (stopIoQueue && EncryptedIoQueueIsRunning (&Extension->Queue))
+ EncryptedIoQueueStop (&Extension->Queue);
+
+ crypto_close (Extension->Queue.CryptoInfo);
+ Extension->Queue.CryptoInfo = NULL;
+
+ crypto_close (Extension->HeaderCryptoInfo);
+ Extension->HeaderCryptoInfo = NULL;
+
+ Extension->DriveMounted = FALSE;
+}
+
+
+static NTSTATUS MountDrive (DriveFilterExtension *Extension, Password *password, uint32 *headerSaltCrc32)
+{
+ BOOL hiddenVolume = (BootArgs.HiddenSystemPartitionStart != 0);
+ int64 hiddenHeaderOffset = BootArgs.HiddenSystemPartitionStart + TC_HIDDEN_VOLUME_HEADER_OFFSET;
+ NTSTATUS status;
+ LARGE_INTEGER offset;
+ char *header;
+
+ Dump ("MountDrive pdo=%p\n", Extension->Pdo);
+ ASSERT (KeGetCurrentIrql() == PASSIVE_LEVEL);
+
+ // Check boot drive signature first (header CRC search could fail if a user restored the header to a non-boot drive)
+ if (BootDriveSignatureValid)
+ {
+ byte mbr[TC_SECTOR_SIZE_BIOS];
+
+ offset.QuadPart = 0;
+ status = TCReadDevice (Extension->LowerDeviceObject, mbr, offset, TC_SECTOR_SIZE_BIOS);
+
+ if (NT_SUCCESS (status) && BootArgs.BootDriveSignature != *(uint32 *) (mbr + 0x1b8))
+ return STATUS_UNSUCCESSFUL;
+ }
+
+ header = TCalloc (TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);
+ if (!header)
+ return STATUS_INSUFFICIENT_RESOURCES;
+
+ offset.QuadPart = hiddenVolume ? hiddenHeaderOffset : TC_BOOT_VOLUME_HEADER_SECTOR_OFFSET;
+ Dump ("Reading volume header at %I64u\n", offset.QuadPart);
+
+ status = TCReadDevice (Extension->LowerDeviceObject, header, offset, TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);
+ if (!NT_SUCCESS (status))
+ {
+ Dump ("TCReadDevice error %x\n", status);
+ goto ret;
+ }
+
+ if (headerSaltCrc32)
+ {
+ uint32 saltCrc = GetCrc32 (header, PKCS5_SALT_SIZE);
+
+ if (saltCrc != *headerSaltCrc32)
+ {
+ status = STATUS_UNSUCCESSFUL;
+ goto ret;
+ }
+
+ Extension->VolumeHeaderSaltCrc32 = saltCrc;
+ }
+
+ Extension->HeaderCryptoInfo = crypto_open();
+ if (!Extension->HeaderCryptoInfo)
+ {
+ status = STATUS_INSUFFICIENT_RESOURCES;
+ goto ret;
+ }
+
+ if (ReadVolumeHeader (!hiddenVolume, header, password, &Extension->Queue.CryptoInfo, Extension->HeaderCryptoInfo) == 0)
+ {
+ // Header decrypted
+ status = STATUS_SUCCESS;
+ Dump ("Header decrypted\n");
+
+ if (Extension->Queue.CryptoInfo->hiddenVolume)
+ {
+ int64 hiddenPartitionOffset = BootArgs.HiddenSystemPartitionStart;
+ Dump ("Hidden volume start offset = %I64d\n", Extension->Queue.CryptoInfo->EncryptedAreaStart.Value + hiddenPartitionOffset);
+
+ Extension->HiddenSystem = TRUE;
+
+ Extension->Queue.RemapEncryptedArea = TRUE;
+ Extension->Queue.RemappedAreaOffset = hiddenPartitionOffset + Extension->Queue.CryptoInfo->EncryptedAreaStart.Value - BootArgs.DecoySystemPartitionStart;
+ Extension->Queue.RemappedAreaDataUnitOffset = Extension->Queue.CryptoInfo->EncryptedAreaStart.Value / ENCRYPTION_DATA_UNIT_SIZE - BootArgs.DecoySystemPartitionStart / ENCRYPTION_DATA_UNIT_SIZE;
+
+ Extension->Queue.CryptoInfo->EncryptedAreaStart.Value = BootArgs.DecoySystemPartitionStart;
+
+ if (Extension->Queue.CryptoInfo->VolumeSize.Value > hiddenPartitionOffset - BootArgs.DecoySystemPartitionStart)
+ TC_THROW_FATAL_EXCEPTION;
+
+ Dump ("RemappedAreaOffset = %I64d\n", Extension->Queue.RemappedAreaOffset);
+ Dump ("RemappedAreaDataUnitOffset = %I64d\n", Extension->Queue.RemappedAreaDataUnitOffset);
+ }
+ else
+ {
+ Extension->HiddenSystem = FALSE;
+ Extension->Queue.RemapEncryptedArea = FALSE;
+ }
+
+ Extension->ConfiguredEncryptedAreaStart = Extension->Queue.CryptoInfo->EncryptedAreaStart.Value;
+ Extension->ConfiguredEncryptedAreaEnd = Extension->Queue.CryptoInfo->EncryptedAreaStart.Value + Extension->Queue.CryptoInfo->VolumeSize.Value - 1;
+
+ Extension->Queue.EncryptedAreaStart = Extension->Queue.CryptoInfo->EncryptedAreaStart.Value;
+ Extension->Queue.EncryptedAreaEnd = Extension->Queue.CryptoInfo->EncryptedAreaStart.Value + Extension->Queue.CryptoInfo->EncryptedAreaLength.Value - 1;
+
+ if (Extension->Queue.CryptoInfo->EncryptedAreaLength.Value == 0)
+ {
+ Extension->Queue.EncryptedAreaStart = -1;
+ Extension->Queue.EncryptedAreaEnd = -1;
+ }
+
+ Dump ("Loaded: ConfiguredEncryptedAreaStart=%I64d (%I64d) ConfiguredEncryptedAreaEnd=%I64d (%I64d)\n", Extension->ConfiguredEncryptedAreaStart / 1024 / 1024, Extension->ConfiguredEncryptedAreaStart, Extension->ConfiguredEncryptedAreaEnd / 1024 / 1024, Extension->ConfiguredEncryptedAreaEnd);
+ Dump ("Loaded: EncryptedAreaStart=%I64d (%I64d) EncryptedAreaEnd=%I64d (%I64d)\n", Extension->Queue.EncryptedAreaStart / 1024 / 1024, Extension->Queue.EncryptedAreaStart, Extension->Queue.EncryptedAreaEnd / 1024 / 1024, Extension->Queue.EncryptedAreaEnd);
+
+ // Erase boot loader scheduled keys
+ if (BootArgs.CryptoInfoLength > 0)
+ {
+ PHYSICAL_ADDRESS cryptoInfoAddress;
+ byte *mappedCryptoInfo;
+
+ cryptoInfoAddress.QuadPart = (BootLoaderSegment << 4) + BootArgs.CryptoInfoOffset;
+ mappedCryptoInfo = MmMapIoSpace (cryptoInfoAddress, BootArgs.CryptoInfoLength, MmCached);
+
+ if (mappedCryptoInfo)
+ {
+ Dump ("Wiping memory %x %d\n", cryptoInfoAddress.LowPart, BootArgs.CryptoInfoLength);
+ memset (mappedCryptoInfo, 0, BootArgs.CryptoInfoLength);
+ MmUnmapIoSpace (mappedCryptoInfo, BootArgs.CryptoInfoLength);
+ }
+ }
+
+ BootDriveFilterExtension = Extension;
+ BootDriveFound = Extension->BootDrive = Extension->DriveMounted = Extension->VolumeHeaderPresent = TRUE;
+ BootDriveFilterExtension->MagicNumber = TC_BOOT_DRIVE_FILTER_EXTENSION_MAGIC_NUMBER;
+
+ burn (&BootArgs.BootPassword, sizeof (BootArgs.BootPassword));
+
+ {
+ STORAGE_DEVICE_NUMBER storageDeviceNumber;
+ status = SendDeviceIoControlRequest (Extension->LowerDeviceObject, IOCTL_STORAGE_GET_DEVICE_NUMBER, NULL, 0, &storageDeviceNumber, sizeof (storageDeviceNumber));
+
+ if (!NT_SUCCESS (status))
+ {
+ Dump ("Failed to get drive number - error %x\n", status);
+ Extension->SystemStorageDeviceNumberValid = FALSE;
+ }
+ else
+ {
+ Extension->SystemStorageDeviceNumber = storageDeviceNumber.DeviceNumber;
+ Extension->SystemStorageDeviceNumberValid = TRUE;
+ }
+ }
+
+ status = SendDeviceIoControlRequest (Extension->LowerDeviceObject, IOCTL_DISK_GET_LENGTH_INFO, NULL, 0, &BootDriveLength, sizeof (BootDriveLength));
+
+ if (!NT_SUCCESS (status))
+ {
+ Dump ("Failed to get drive length - error %x\n", status);
+ BootDriveLength.QuadPart = 0;
+ Extension->Queue.MaxReadAheadOffset.QuadPart = 0;
+ }
+ else
+ Extension->Queue.MaxReadAheadOffset = BootDriveLength;
+
+ status = EncryptedIoQueueStart (&Extension->Queue);
+ if (!NT_SUCCESS (status))
+ TC_BUG_CHECK (status);
+
+ if (IsOSAtLeast (WIN_VISTA))
+ {
+ CrashDumpEnabled = TRUE;
+ HibernationEnabled = TRUE;
+ }
+ else if (!LegacyHibernationDriverFilterActive)
+ StartLegacyHibernationDriverFilter();
+
+ // Hidden system hibernation is not supported if an extra boot partition is present as the system is not allowed to update the boot partition
+ if (IsHiddenSystemRunning() && (BootArgs.Flags & TC_BOOT_ARGS_FLAG_EXTRA_BOOT_PARTITION))
+ {
+ CrashDumpEnabled = FALSE;
+ HibernationEnabled = FALSE;
+ }
+ }
+ else
+ {
+ Dump ("Header not decrypted\n");
+ crypto_close (Extension->HeaderCryptoInfo);
+ Extension->HeaderCryptoInfo = NULL;
+
+ status = STATUS_UNSUCCESSFUL;
+ }
+
+ret:
+ TCfree (header);
+ return status;
+}
+
+
+static NTSTATUS SaveDriveVolumeHeader (DriveFilterExtension *Extension)
+{
+ NTSTATUS status = STATUS_SUCCESS;
+ LARGE_INTEGER offset;
+ byte *header;
+
+ header = TCalloc (TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);
+ if (!header)
+ return STATUS_INSUFFICIENT_RESOURCES;
+
+ offset.QuadPart = TC_BOOT_VOLUME_HEADER_SECTOR_OFFSET;
+
+ status = TCReadDevice (Extension->LowerDeviceObject, header, offset, TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);
+ if (!NT_SUCCESS (status))
+ {
+ Dump ("TCReadDevice error %x", status);
+ goto ret;
+ }
+
+ Dump ("Saving: ConfiguredEncryptedAreaStart=%I64d (%I64d) ConfiguredEncryptedAreaEnd=%I64d (%I64d)\n", Extension->ConfiguredEncryptedAreaStart / 1024 / 1024, Extension->ConfiguredEncryptedAreaStart, Extension->ConfiguredEncryptedAreaEnd / 1024 / 1024, Extension->ConfiguredEncryptedAreaEnd);
+ Dump ("Saving: EncryptedAreaStart=%I64d (%I64d) EncryptedAreaEnd=%I64d (%I64d)\n", Extension->Queue.EncryptedAreaStart / 1024 / 1024, Extension->Queue.EncryptedAreaStart, Extension->Queue.EncryptedAreaEnd / 1024 / 1024, Extension->Queue.EncryptedAreaEnd);
+
+ if (Extension->Queue.EncryptedAreaStart == -1 || Extension->Queue.EncryptedAreaEnd == -1
+ || Extension->Queue.EncryptedAreaEnd <= Extension->Queue.EncryptedAreaStart)
+ {
+ if (SetupRequest.SetupMode == SetupDecryption)
+ {
+ memset (header, 0, TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);
+ Extension->VolumeHeaderPresent = FALSE;
+ }
+ }
+ else
+ {
+ uint32 headerCrc32;
+ uint64 encryptedAreaLength = Extension->Queue.EncryptedAreaEnd + 1 - Extension->Queue.EncryptedAreaStart;
+ byte *fieldPos = header + TC_HEADER_OFFSET_ENCRYPTED_AREA_LENGTH;
+
+ DecryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, Extension->HeaderCryptoInfo);
+
+ if (GetHeaderField32 (header, TC_HEADER_OFFSET_MAGIC) != 0x54525545)
+ {
+ Dump ("Header not decrypted");
+ status = STATUS_UNKNOWN_REVISION;
+ goto ret;
+ }
+
+ mputInt64 (fieldPos, encryptedAreaLength);
+
+ headerCrc32 = GetCrc32 (header + TC_HEADER_OFFSET_MAGIC, TC_HEADER_OFFSET_HEADER_CRC - TC_HEADER_OFFSET_MAGIC);
+ fieldPos = header + TC_HEADER_OFFSET_HEADER_CRC;
+ mputLong (fieldPos, headerCrc32);
+
+ EncryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, Extension->HeaderCryptoInfo);
+ }
+
+ status = TCWriteDevice (Extension->LowerDeviceObject, header, offset, TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);
+ if (!NT_SUCCESS (status))
+ {
+ Dump ("TCWriteDevice error %x", status);
+ goto ret;
+ }
+
+ret:
+ TCfree (header);
+ return status;
+}
+
+
+static NTSTATUS PassIrp (PDEVICE_OBJECT deviceObject, PIRP irp)
+{
+ IoSkipCurrentIrpStackLocation (irp);
+ return IoCallDriver (deviceObject, irp);
+}
+
+
+static NTSTATUS PassFilteredIrp (PDEVICE_OBJECT deviceObject, PIRP irp, PIO_COMPLETION_ROUTINE completionRoutine, PVOID completionRoutineArg)
+{
+ IoCopyCurrentIrpStackLocationToNext (irp);
+
+ if (completionRoutine)
+ IoSetCompletionRoutine (irp, completionRoutine, completionRoutineArg, TRUE, TRUE, TRUE);
+
+ return IoCallDriver (deviceObject, irp);
+}
+
+
+static NTSTATUS OnDeviceUsageNotificationCompleted (PDEVICE_OBJECT filterDeviceObject, PIRP Irp, DriveFilterExtension *Extension)
+{
+ if (Irp->PendingReturned)
+ IoMarkIrpPending (Irp);
+
+ if (!(Extension->LowerDeviceObject->Flags & DO_POWER_PAGABLE))
+ filterDeviceObject->Flags &= ~DO_POWER_PAGABLE;
+
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ return STATUS_CONTINUE_COMPLETION;
+}
+
+
+static BOOL IsVolumeDevice (PDEVICE_OBJECT deviceObject)
+{
+ VOLUME_NUMBER volNumber;
+ VOLUME_DISK_EXTENTS extents[2];
+ NTSTATUS extentStatus = SendDeviceIoControlRequest (deviceObject, IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS, NULL, 0, extents, sizeof (extents));
+
+ return NT_SUCCESS (SendDeviceIoControlRequest (deviceObject, IOCTL_VOLUME_SUPPORTS_ONLINE_OFFLINE, NULL, 0, NULL, 0))
+ || NT_SUCCESS (SendDeviceIoControlRequest (deviceObject, IOCTL_VOLUME_IS_OFFLINE, NULL, 0, NULL, 0))
+ || NT_SUCCESS (SendDeviceIoControlRequest (deviceObject, IOCTL_VOLUME_IS_IO_CAPABLE, NULL, 0, NULL, 0))
+ || NT_SUCCESS (SendDeviceIoControlRequest (deviceObject, IOCTL_VOLUME_IS_PARTITION, NULL, 0, NULL, 0))
+ || NT_SUCCESS (SendDeviceIoControlRequest (deviceObject, IOCTL_VOLUME_QUERY_VOLUME_NUMBER, NULL, 0, &volNumber, sizeof (volNumber)))
+ || NT_SUCCESS (extentStatus) || extentStatus == STATUS_BUFFER_OVERFLOW || extentStatus == STATUS_BUFFER_TOO_SMALL;
+}
+
+
+static void CheckDeviceTypeAndMount (DriveFilterExtension *filterExtension)
+{
+ if (BootArgsValid)
+ {
+ // Windows sometimes merges a removable drive PDO and its volume PDO to a single PDO having no volume interface (GUID_DEVINTERFACE_VOLUME).
+ // Therefore, we need to test whether the device supports volume IOCTLs.
+ if (VolumeClassFilterRegistered
+ && BootArgs.HiddenSystemPartitionStart != 0
+ && IsVolumeDevice (filterExtension->LowerDeviceObject))
+ {
+ Dump ("Drive and volume merged pdo=%p", filterExtension->Pdo);
+
+ filterExtension->IsVolumeFilterDevice = TRUE;
+ filterExtension->IsDriveFilterDevice = FALSE;
+ }
+ else
+ {
+ NTSTATUS status = KeWaitForMutexObject (&MountMutex, Executive, KernelMode, FALSE, NULL);
+ if (!NT_SUCCESS (status))
+ TC_BUG_CHECK (status);
+
+ if (!BootDriveFound)
+ MountDrive (filterExtension, &BootArgs.BootPassword, &BootArgs.HeaderSaltCrc32);
+
+ KeReleaseMutex (&MountMutex, FALSE);
+ }
+ }
+}
+
+
+static VOID MountDriveWorkItemRoutine (PDEVICE_OBJECT deviceObject, DriveFilterExtension *filterExtension)
+{
+ CheckDeviceTypeAndMount (filterExtension);
+ KeSetEvent (&filterExtension->MountWorkItemCompletedEvent, IO_NO_INCREMENT, FALSE);
+}
+
+
+static NTSTATUS OnStartDeviceCompleted (PDEVICE_OBJECT filterDeviceObject, PIRP Irp, DriveFilterExtension *Extension)
+{
+ if (Irp->PendingReturned)
+ IoMarkIrpPending (Irp);
+
+ if (Extension->LowerDeviceObject->Characteristics & FILE_REMOVABLE_MEDIA)
+ filterDeviceObject->Characteristics |= FILE_REMOVABLE_MEDIA;
+
+ if (KeGetCurrentIrql() == PASSIVE_LEVEL)
+ {
+ CheckDeviceTypeAndMount (Extension);
+ }
+ else
+ {
+ PIO_WORKITEM workItem = IoAllocateWorkItem (filterDeviceObject);
+ if (!workItem)
+ {
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ return STATUS_INSUFFICIENT_RESOURCES;
+ }
+
+ KeInitializeEvent (&Extension->MountWorkItemCompletedEvent, SynchronizationEvent, FALSE);
+ IoQueueWorkItem (workItem, MountDriveWorkItemRoutine, DelayedWorkQueue, Extension);
+
+ KeWaitForSingleObject (&Extension->MountWorkItemCompletedEvent, Executive, KernelMode, FALSE, NULL);
+ IoFreeWorkItem (workItem);
+ }
+
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ return STATUS_CONTINUE_COMPLETION;
+}
+
+
+static NTSTATUS DispatchPnp (PDEVICE_OBJECT DeviceObject, PIRP Irp, DriveFilterExtension *Extension, PIO_STACK_LOCATION irpSp)
+{
+ NTSTATUS status;
+
+ status = IoAcquireRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ if (!NT_SUCCESS (status))
+ return TCCompleteIrp (Irp, status, 0);
+
+ switch (irpSp->MinorFunction)
+ {
+ case IRP_MN_START_DEVICE:
+ Dump ("IRP_MN_START_DEVICE pdo=%p\n", Extension->Pdo);
+ return PassFilteredIrp (Extension->LowerDeviceObject, Irp, OnStartDeviceCompleted, Extension);
+
+
+ case IRP_MN_DEVICE_USAGE_NOTIFICATION:
+ Dump ("IRP_MN_DEVICE_USAGE_NOTIFICATION type=%d\n", (int) irpSp->Parameters.UsageNotification.Type);
+
+ {
+ PDEVICE_OBJECT attachedDevice = IoGetAttachedDeviceReference (DeviceObject);
+
+ if (attachedDevice == DeviceObject || (attachedDevice->Flags & DO_POWER_PAGABLE))
+ DeviceObject->Flags |= DO_POWER_PAGABLE;
+
+ ObDereferenceObject (attachedDevice);
+ }
+
+ // Prevent creation of hibernation and crash dump files if required
+ if (irpSp->Parameters.UsageNotification.InPath
+ && (
+ (irpSp->Parameters.UsageNotification.Type == DeviceUsageTypeDumpFile && !CrashDumpEnabled)
+ || (irpSp->Parameters.UsageNotification.Type == DeviceUsageTypeHibernation && !HibernationEnabled)
+ )
+ )
+ {
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+
+ if (irpSp->Parameters.UsageNotification.Type == DeviceUsageTypeHibernation)
+ ++HibernationPreventionCount;
+
+ Dump ("Preventing dump type=%d\n", (int) irpSp->Parameters.UsageNotification.Type);
+ return TCCompleteIrp (Irp, STATUS_UNSUCCESSFUL, 0);
+ }
+
+ return PassFilteredIrp (Extension->LowerDeviceObject, Irp, OnDeviceUsageNotificationCompleted, Extension);
+
+
+ case IRP_MN_REMOVE_DEVICE:
+ Dump ("IRP_MN_REMOVE_DEVICE pdo=%p\n", Extension->Pdo);
+
+ IoReleaseRemoveLockAndWait (&Extension->Queue.RemoveLock, Irp);
+ status = PassIrp (Extension->LowerDeviceObject, Irp);
+
+ IoDetachDevice (Extension->LowerDeviceObject);
+
+ if (Extension->DriveMounted)
+ DismountDrive (Extension, TRUE);
+
+ if (Extension->BootDrive)
+ {
+ BootDriveFound = FALSE;
+ BootDriveFilterExtension = NULL;
+ }
+
+ IoDeleteDevice (DeviceObject);
+ return status;
+
+
+ default:
+ status = PassIrp (Extension->LowerDeviceObject, Irp);
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ }
+ return status;
+}
+
+
+static NTSTATUS DispatchPower (PDEVICE_OBJECT DeviceObject, PIRP Irp, DriveFilterExtension *Extension, PIO_STACK_LOCATION irpSp)
+{
+ NTSTATUS status;
+ Dump ("IRP_MJ_POWER minor=%d type=%d shutdown=%d\n", (int) irpSp->MinorFunction, (int) irpSp->Parameters.Power.Type, (int) irpSp->Parameters.Power.ShutdownType);
+
+ if (SetupInProgress
+ && irpSp->MinorFunction == IRP_MN_SET_POWER
+ && irpSp->Parameters.Power.ShutdownType == PowerActionHibernate)
+ {
+ while (SendDeviceIoControlRequest (RootDeviceObject, TC_IOCTL_ABORT_BOOT_ENCRYPTION_SETUP, NULL, 0, NULL, 0) == STATUS_INSUFFICIENT_RESOURCES);
+ }
+
+#if 0 // Dismount of the system drive is disabled until there is a way to do it without causing system errors (see the documentation for more info)
+ if (DriverShuttingDown
+ && Extension->BootDrive
+ && Extension->DriveMounted
+ && irpSp->MinorFunction == IRP_MN_SET_POWER
+ && irpSp->Parameters.Power.Type == DevicePowerState)
+ {
+ DismountDrive (Extension, TRUE);
+ }
+#endif // 0
+
+ PoStartNextPowerIrp (Irp);
+
+ status = IoAcquireRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ if (!NT_SUCCESS (status))
+ return TCCompleteIrp (Irp, status, 0);
+
+ IoSkipCurrentIrpStackLocation (Irp);
+ status = PoCallDriver (Extension->LowerDeviceObject, Irp);
+
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ return status;
+}
+
+
+NTSTATUS DriveFilterDispatchIrp (PDEVICE_OBJECT DeviceObject, PIRP Irp)
+{
+ DriveFilterExtension *Extension = (DriveFilterExtension *) DeviceObject->DeviceExtension;
+ PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (Irp);
+ NTSTATUS status;
+
+ ASSERT (!Extension->bRootDevice && Extension->IsDriveFilterDevice);
+
+ switch (irpSp->MajorFunction)
+ {
+ case IRP_MJ_READ:
+ case IRP_MJ_WRITE:
+ if (Extension->BootDrive)
+ {
+ status = EncryptedIoQueueAddIrp (&Extension->Queue, Irp);
+
+ if (status != STATUS_PENDING)
+ TCCompleteDiskIrp (Irp, status, 0);
+
+ return status;
+ }
+ break;
+
+ case IRP_MJ_PNP:
+ return DispatchPnp (DeviceObject, Irp, Extension, irpSp);
+
+ case IRP_MJ_POWER:
+ return DispatchPower (DeviceObject, Irp, Extension, irpSp);
+ }
+
+ status = IoAcquireRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ if (!NT_SUCCESS (status))
+ return TCCompleteIrp (Irp, status, 0);
+
+ status = PassIrp (Extension->LowerDeviceObject, Irp);
+
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ return status;
+}
+
+
+void ReopenBootVolumeHeader (PIRP irp, PIO_STACK_LOCATION irpSp)
+{
+ LARGE_INTEGER offset;
+ char *header;
+ ReopenBootVolumeHeaderRequest *request = (ReopenBootVolumeHeaderRequest *) irp->AssociatedIrp.SystemBuffer;
+
+ irp->IoStatus.Information = 0;
+
+ if (!IoIsSystemThread (PsGetCurrentThread()) && !UserCanAccessDriveDevice())
+ {
+ irp->IoStatus.Status = STATUS_ACCESS_DENIED;
+ return;
+ }
+
+ if (!ValidateIOBufferSize (irp, sizeof (ReopenBootVolumeHeaderRequest), ValidateInput))
+ return;
+
+ if (!BootDriveFound || !BootDriveFilterExtension || !BootDriveFilterExtension->DriveMounted || !BootDriveFilterExtension->HeaderCryptoInfo
+ || request->VolumePassword.Length > MAX_PASSWORD)
+ {
+ irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+ goto wipe;
+ }
+
+ header = TCalloc (TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);
+ if (!header)
+ {
+ irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
+ goto wipe;
+ }
+
+ if (BootDriveFilterExtension->HiddenSystem)
+ offset.QuadPart = BootArgs.HiddenSystemPartitionStart + TC_HIDDEN_VOLUME_HEADER_OFFSET;
+ else
+ offset.QuadPart = TC_BOOT_VOLUME_HEADER_SECTOR_OFFSET;
+
+ irp->IoStatus.Status = TCReadDevice (BootDriveFilterExtension->LowerDeviceObject, header, offset, TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);
+ if (!NT_SUCCESS (irp->IoStatus.Status))
+ {
+ Dump ("TCReadDevice error %x\n", irp->IoStatus.Status);
+ goto ret;
+ }
+
+ if (ReadVolumeHeader (!BootDriveFilterExtension->HiddenSystem, header, &request->VolumePassword, NULL, BootDriveFilterExtension->HeaderCryptoInfo) == 0)
+ {
+ Dump ("Header reopened\n");
+
+ BootDriveFilterExtension->Queue.CryptoInfo->header_creation_time = BootDriveFilterExtension->HeaderCryptoInfo->header_creation_time;
+ BootDriveFilterExtension->Queue.CryptoInfo->pkcs5 = BootDriveFilterExtension->HeaderCryptoInfo->pkcs5;
+ BootDriveFilterExtension->Queue.CryptoInfo->noIterations = BootDriveFilterExtension->HeaderCryptoInfo->noIterations;
+
+ irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ else
+ {
+ crypto_close (BootDriveFilterExtension->HeaderCryptoInfo);
+ BootDriveFilterExtension->HeaderCryptoInfo = NULL;
+
+ Dump ("Header not reopened\n");
+ irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+ }
+
+ret:
+ TCfree (header);
+wipe:
+ burn (request, sizeof (*request));
+}
+
+
+// Legacy Windows XP/2003 hibernation dump filter
+
+typedef NTSTATUS (*HiberDriverWriteFunctionA) (ULONG arg0, PLARGE_INTEGER writeOffset, PMDL dataMdl, PVOID arg3);
+typedef NTSTATUS (*HiberDriverWriteFunctionB) (PLARGE_INTEGER writeOffset, PMDL dataMdl);
+
+typedef struct
+{
+#ifdef _WIN64
+ byte FieldPad1[64];
+ HiberDriverWriteFunctionB WriteFunctionB;
+ byte FieldPad2[56];
+#else
+ byte FieldPad1[48];
+ HiberDriverWriteFunctionB WriteFunctionB;
+ byte FieldPad2[32];
+#endif
+ HiberDriverWriteFunctionA WriteFunctionA;
+ byte FieldPad3[24];
+ LARGE_INTEGER PartitionStartOffset;
+} HiberDriverContext;
+
+typedef NTSTATUS (*HiberDriverEntry) (PVOID arg0, HiberDriverContext *hiberDriverContext);
+
+typedef struct
+{
+ LIST_ENTRY ModuleList;
+#ifdef _WIN64
+ byte FieldPad1[32];
+#else
+ byte FieldPad1[16];
+#endif
+ PVOID ModuleBaseAddress;
+ HiberDriverEntry ModuleEntryAddress;
+#ifdef _WIN64
+ byte FieldPad2[24];
+#else
+ byte FieldPad2[12];
+#endif
+ UNICODE_STRING ModuleName;
+} ModuleTableItem;
+
+
+#define TC_MAX_HIBER_FILTER_COUNT 3
+static int LastHiberFilterNumber = 0;
+
+static HiberDriverEntry OriginalHiberDriverEntries[TC_MAX_HIBER_FILTER_COUNT];
+static HiberDriverWriteFunctionA OriginalHiberDriverWriteFunctionsA[TC_MAX_HIBER_FILTER_COUNT];
+static HiberDriverWriteFunctionB OriginalHiberDriverWriteFunctionsB[TC_MAX_HIBER_FILTER_COUNT];
+
+static LARGE_INTEGER HiberPartitionOffset;
+
+
+static NTSTATUS HiberDriverWriteFunctionFilter (int filterNumber, PLARGE_INTEGER writeOffset, PMDL dataMdl, BOOL writeB, ULONG arg0WriteA, PVOID arg3WriteA)
+{
+ MDL *encryptedDataMdl = dataMdl;
+
+ if (writeOffset && dataMdl && BootDriveFilterExtension && BootDriveFilterExtension->DriveMounted)
+ {
+ ULONG dataLength = MmGetMdlByteCount (dataMdl);
+
+ if (dataMdl->MappedSystemVa && dataLength > 0)
+ {
+ uint64 offset = HiberPartitionOffset.QuadPart + writeOffset->QuadPart;
+ uint64 intersectStart;
+ uint32 intersectLength;
+
+ if (dataLength > TC_HIBERNATION_WRITE_BUFFER_SIZE)
+ TC_BUG_CHECK (STATUS_BUFFER_OVERFLOW);
+
+ if ((dataLength & (ENCRYPTION_DATA_UNIT_SIZE - 1)) != 0)
+ TC_BUG_CHECK (STATUS_INVALID_PARAMETER);
+
+ if ((offset & (ENCRYPTION_DATA_UNIT_SIZE - 1)) != 0)
+ TC_BUG_CHECK (STATUS_INVALID_PARAMETER);
+
+ GetIntersection (offset,
+ dataLength,
+ BootDriveFilterExtension->Queue.EncryptedAreaStart,
+ BootDriveFilterExtension->Queue.EncryptedAreaEnd,
+ &intersectStart,
+ &intersectLength);
+
+ if (intersectLength > 0)
+ {
+ UINT64_STRUCT dataUnit;
+ dataUnit.Value = intersectStart / ENCRYPTION_DATA_UNIT_SIZE;
+
+ memcpy (HibernationWriteBuffer, dataMdl->MappedSystemVa, dataLength);
+
+ if (BootDriveFilterExtension->Queue.RemapEncryptedArea)
+ dataUnit.Value += BootDriveFilterExtension->Queue.RemappedAreaDataUnitOffset;
+
+ EncryptDataUnitsCurrentThread (HibernationWriteBuffer + (intersectStart - offset),
+ &dataUnit,
+ intersectLength / ENCRYPTION_DATA_UNIT_SIZE,
+ BootDriveFilterExtension->Queue.CryptoInfo);
+
+ encryptedDataMdl = HibernationWriteBufferMdl;
+ MmInitializeMdl (encryptedDataMdl, HibernationWriteBuffer, dataLength);
+ encryptedDataMdl->MdlFlags = dataMdl->MdlFlags;
+ }
+ }
+ }
+
+ if (writeB)
+ return (*OriginalHiberDriverWriteFunctionsB[filterNumber]) (writeOffset, encryptedDataMdl);
+
+ return (*OriginalHiberDriverWriteFunctionsA[filterNumber]) (arg0WriteA, writeOffset, encryptedDataMdl, arg3WriteA);
+}
+
+
+static NTSTATUS HiberDriverWriteFunctionAFilter0 (ULONG arg0, PLARGE_INTEGER writeOffset, PMDL dataMdl, PVOID arg3)
+{
+ return HiberDriverWriteFunctionFilter (0, writeOffset, dataMdl, FALSE, arg0, arg3);
+}
+
+static NTSTATUS HiberDriverWriteFunctionAFilter1 (ULONG arg0, PLARGE_INTEGER writeOffset, PMDL dataMdl, PVOID arg3)
+{
+ return HiberDriverWriteFunctionFilter (1, writeOffset, dataMdl, FALSE, arg0, arg3);
+}
+
+static NTSTATUS HiberDriverWriteFunctionAFilter2 (ULONG arg0, PLARGE_INTEGER writeOffset, PMDL dataMdl, PVOID arg3)
+{
+ return HiberDriverWriteFunctionFilter (2, writeOffset, dataMdl, FALSE, arg0, arg3);
+}
+
+
+static NTSTATUS HiberDriverWriteFunctionBFilter0 (PLARGE_INTEGER writeOffset, PMDL dataMdl)
+{
+ return HiberDriverWriteFunctionFilter (0, writeOffset, dataMdl, TRUE, 0, NULL);
+}
+
+static NTSTATUS HiberDriverWriteFunctionBFilter1 (PLARGE_INTEGER writeOffset, PMDL dataMdl)
+{
+ return HiberDriverWriteFunctionFilter (1, writeOffset, dataMdl, TRUE, 0, NULL);
+}
+
+static NTSTATUS HiberDriverWriteFunctionBFilter2 (PLARGE_INTEGER writeOffset, PMDL dataMdl)
+{
+ return HiberDriverWriteFunctionFilter (2, writeOffset, dataMdl, TRUE, 0, NULL);
+}
+
+
+static NTSTATUS HiberDriverEntryFilter (int filterNumber, PVOID arg0, HiberDriverContext *hiberDriverContext)
+{
+ BOOL filterInstalled = FALSE;
+ NTSTATUS status;
+
+ if (!OriginalHiberDriverEntries[filterNumber])
+ return STATUS_UNSUCCESSFUL;
+
+ status = (*OriginalHiberDriverEntries[filterNumber]) (arg0, hiberDriverContext);
+
+ if (!NT_SUCCESS (status) || !hiberDriverContext)
+ return status;
+
+ if (SetupInProgress)
+ TC_BUG_CHECK (STATUS_INVALID_PARAMETER);
+
+ if (hiberDriverContext->WriteFunctionA)
+ {
+ Dump ("Filtering WriteFunctionA %d\n", filterNumber);
+ OriginalHiberDriverWriteFunctionsA[filterNumber] = hiberDriverContext->WriteFunctionA;
+
+ switch (filterNumber)
+ {
+ case 0: hiberDriverContext->WriteFunctionA = HiberDriverWriteFunctionAFilter0; break;
+ case 1: hiberDriverContext->WriteFunctionA = HiberDriverWriteFunctionAFilter1; break;
+ case 2: hiberDriverContext->WriteFunctionA = HiberDriverWriteFunctionAFilter2; break;
+ default: TC_THROW_FATAL_EXCEPTION;
+ }
+
+ filterInstalled = TRUE;
+ }
+
+ if (hiberDriverContext->WriteFunctionB)
+ {
+ Dump ("Filtering WriteFunctionB %d\n", filterNumber);
+ OriginalHiberDriverWriteFunctionsB[filterNumber] = hiberDriverContext->WriteFunctionB;
+
+ switch (filterNumber)
+ {
+ case 0: hiberDriverContext->WriteFunctionB = HiberDriverWriteFunctionBFilter0; break;
+ case 1: hiberDriverContext->WriteFunctionB = HiberDriverWriteFunctionBFilter1; break;
+ case 2: hiberDriverContext->WriteFunctionB = HiberDriverWriteFunctionBFilter2; break;
+ default: TC_THROW_FATAL_EXCEPTION;
+ }
+
+ filterInstalled = TRUE;
+ }
+
+ if (filterInstalled && hiberDriverContext->PartitionStartOffset.QuadPart != 0)
+ {
+ HiberPartitionOffset = hiberDriverContext->PartitionStartOffset;
+
+ if (BootDriveFilterExtension->Queue.RemapEncryptedArea)
+ hiberDriverContext->PartitionStartOffset.QuadPart += BootDriveFilterExtension->Queue.RemappedAreaOffset;
+ }
+
+ return STATUS_SUCCESS;
+}
+
+
+static NTSTATUS HiberDriverEntryFilter0 (PVOID arg0, HiberDriverContext *hiberDriverContext)
+{
+ return HiberDriverEntryFilter (0, arg0, hiberDriverContext);
+}
+
+
+static NTSTATUS HiberDriverEntryFilter1 (PVOID arg0, HiberDriverContext *hiberDriverContext)
+{
+ return HiberDriverEntryFilter (1, arg0, hiberDriverContext);
+}
+
+
+static NTSTATUS HiberDriverEntryFilter2 (PVOID arg0, HiberDriverContext *hiberDriverContext)
+{
+ return HiberDriverEntryFilter (2, arg0, hiberDriverContext);
+}
+
+
+static VOID LoadImageNotifyRoutine (PUNICODE_STRING fullImageName, HANDLE processId, PIMAGE_INFO imageInfo)
+{
+ ModuleTableItem *moduleItem;
+ LIST_ENTRY *listEntry;
+ KIRQL origIrql;
+
+ if (!imageInfo || !imageInfo->SystemModeImage || !imageInfo->ImageBase || !TCDriverObject->DriverSection)
+ return;
+
+ moduleItem = *(ModuleTableItem **) TCDriverObject->DriverSection;
+ if (!moduleItem || !moduleItem->ModuleList.Flink)
+ return;
+
+ // Search loaded system modules for hibernation driver
+ origIrql = KeRaiseIrqlToDpcLevel();
+
+ for (listEntry = moduleItem->ModuleList.Flink->Blink;
+ listEntry && listEntry != TCDriverObject->DriverSection;
+ listEntry = listEntry->Flink)
+ {
+ moduleItem = CONTAINING_RECORD (listEntry, ModuleTableItem, ModuleList);
+
+ if (moduleItem && imageInfo->ImageBase == moduleItem->ModuleBaseAddress)
+ {
+ if (moduleItem->ModuleName.Buffer && moduleItem->ModuleName.Length >= 5 * sizeof (wchar_t))
+ {
+ if (memcmp (moduleItem->ModuleName.Buffer, L"hiber", 5 * sizeof (wchar_t)) == 0
+ || memcmp (moduleItem->ModuleName.Buffer, L"Hiber", 5 * sizeof (wchar_t)) == 0
+ || memcmp (moduleItem->ModuleName.Buffer, L"HIBER", 5 * sizeof (wchar_t)) == 0)
+ {
+ HiberDriverEntry filterEntry;
+
+ switch (LastHiberFilterNumber)
+ {
+ case 0: filterEntry = HiberDriverEntryFilter0; break;
+ case 1: filterEntry = HiberDriverEntryFilter1; break;
+ case 2: filterEntry = HiberDriverEntryFilter2; break;
+ default: TC_THROW_FATAL_EXCEPTION;
+ }
+
+ if (moduleItem->ModuleEntryAddress != filterEntry)
+ {
+ // Install filter
+ OriginalHiberDriverEntries[LastHiberFilterNumber] = moduleItem->ModuleEntryAddress;
+ moduleItem->ModuleEntryAddress = filterEntry;
+
+ if (++LastHiberFilterNumber > TC_MAX_HIBER_FILTER_COUNT - 1)
+ LastHiberFilterNumber = 0;
+ }
+ }
+ }
+ break;
+ }
+ }
+
+ KeLowerIrql (origIrql);
+}
+
+
+void StartLegacyHibernationDriverFilter ()
+{
+ PHYSICAL_ADDRESS highestAcceptableWriteBufferAddr;
+ NTSTATUS status;
+
+ ASSERT (KeGetCurrentIrql() == PASSIVE_LEVEL);
+ ASSERT (!IsOSAtLeast (WIN_VISTA));
+
+ if (!TCDriverObject->DriverSection || !*(ModuleTableItem **) TCDriverObject->DriverSection)
+ goto err;
+
+ // All buffers required for hibernation must be allocated here
+#ifdef _WIN64
+ highestAcceptableWriteBufferAddr.QuadPart = 0x7FFffffFFFFULL;
+#else
+ highestAcceptableWriteBufferAddr.QuadPart = 0xffffFFFFULL;
+#endif
+
+ HibernationWriteBuffer = MmAllocateContiguousMemory (TC_HIBERNATION_WRITE_BUFFER_SIZE, highestAcceptableWriteBufferAddr);
+ if (!HibernationWriteBuffer)
+ goto err;
+
+ HibernationWriteBufferMdl = IoAllocateMdl (HibernationWriteBuffer, TC_HIBERNATION_WRITE_BUFFER_SIZE, FALSE, FALSE, NULL);
+ if (!HibernationWriteBufferMdl)
+ goto err;
+
+ MmBuildMdlForNonPagedPool (HibernationWriteBufferMdl);
+
+ status = PsSetLoadImageNotifyRoutine (LoadImageNotifyRoutine);
+ if (!NT_SUCCESS (status))
+ goto err;
+
+ LegacyHibernationDriverFilterActive = TRUE;
+ CrashDumpEnabled = FALSE;
+ HibernationEnabled = TRUE;
+ return;
+
+err:
+ LegacyHibernationDriverFilterActive = FALSE;
+ CrashDumpEnabled = FALSE;
+ HibernationEnabled = FALSE;
+
+ if (HibernationWriteBufferMdl)
+ {
+ IoFreeMdl (HibernationWriteBufferMdl);
+ HibernationWriteBufferMdl = NULL;
+ }
+
+ if (HibernationWriteBuffer)
+ {
+ MmFreeContiguousMemory (HibernationWriteBuffer);
+ HibernationWriteBuffer = NULL;
+ }
+}
+
+
+static VOID SetupThreadProc (PVOID threadArg)
+{
+ DriveFilterExtension *Extension = BootDriveFilterExtension;
+
+ LARGE_INTEGER offset;
+ UINT64_STRUCT dataUnit;
+ ULONG setupBlockSize = TC_ENCRYPTION_SETUP_IO_BLOCK_SIZE;
+ BOOL headerUpdateRequired = FALSE;
+ int64 bytesWrittenSinceHeaderUpdate = 0;
+
+ byte *buffer = NULL;
+ byte *wipeBuffer = NULL;
+ byte wipeRandChars[TC_WIPE_RAND_CHAR_COUNT];
+ byte wipeRandCharsUpdate[TC_WIPE_RAND_CHAR_COUNT];
+
+ KIRQL irql;
+ NTSTATUS status;
+
+ SetupResult = STATUS_UNSUCCESSFUL;
+
+ // Make sure volume header can be updated
+ if (Extension->HeaderCryptoInfo == NULL)
+ {
+ SetupResult = STATUS_INVALID_PARAMETER;
+ goto ret;
+ }
+
+ buffer = TCalloc (TC_ENCRYPTION_SETUP_IO_BLOCK_SIZE);
+ if (!buffer)
+ {
+ SetupResult = STATUS_INSUFFICIENT_RESOURCES;
+ goto ret;
+ }
+
+ if (SetupRequest.SetupMode == SetupEncryption && SetupRequest.WipeAlgorithm != TC_WIPE_NONE)
+ {
+ wipeBuffer = TCalloc (TC_ENCRYPTION_SETUP_IO_BLOCK_SIZE);
+ if (!wipeBuffer)
+ {
+ SetupResult = STATUS_INSUFFICIENT_RESOURCES;
+ goto ret;
+ }
+ }
+
+ while (!NT_SUCCESS (EncryptedIoQueueHoldWhenIdle (&Extension->Queue, 1000)))
+ {
+ if (EncryptionSetupThreadAbortRequested)
+ goto abort;
+
+ TransformWaitingForIdle = TRUE;
+ }
+ TransformWaitingForIdle = FALSE;
+
+ switch (SetupRequest.SetupMode)
+ {
+ case SetupEncryption:
+ Dump ("Encrypting...\n");
+ if (Extension->Queue.EncryptedAreaStart == -1 || Extension->Queue.EncryptedAreaEnd == -1)
+ {
+ // Start encryption
+ Extension->Queue.EncryptedAreaStart = Extension->ConfiguredEncryptedAreaStart;
+ Extension->Queue.EncryptedAreaEnd = -1;
+ offset.QuadPart = Extension->ConfiguredEncryptedAreaStart;
+ }
+ else
+ {
+ // Resume aborted encryption
+ if (Extension->Queue.EncryptedAreaEnd == Extension->ConfiguredEncryptedAreaEnd)
+ goto err;
+
+ offset.QuadPart = Extension->Queue.EncryptedAreaEnd + 1;
+ }
+
+ break;
+
+ case SetupDecryption:
+ Dump ("Decrypting...\n");
+ if (Extension->Queue.EncryptedAreaStart == -1 || Extension->Queue.EncryptedAreaEnd == -1)
+ {
+ SetupResult = STATUS_SUCCESS;
+ goto abort;
+ }
+
+ offset.QuadPart = Extension->Queue.EncryptedAreaEnd + 1;
+ break;
+
+ default:
+ goto err;
+ }
+
+ EncryptedIoQueueResumeFromHold (&Extension->Queue);
+
+ Dump ("EncryptedAreaStart=%I64d\n", Extension->Queue.EncryptedAreaStart);
+ Dump ("EncryptedAreaEnd=%I64d\n", Extension->Queue.EncryptedAreaEnd);
+ Dump ("ConfiguredEncryptedAreaStart=%I64d\n", Extension->ConfiguredEncryptedAreaStart);
+ Dump ("ConfiguredEncryptedAreaEnd=%I64d\n", Extension->ConfiguredEncryptedAreaEnd);
+ Dump ("offset=%I64d\n", offset.QuadPart);
+ Dump ("EncryptedAreaStart=%I64d (%I64d) EncryptedAreaEnd=%I64d\n", Extension->Queue.EncryptedAreaStart / 1024 / 1024, Extension->Queue.EncryptedAreaStart, Extension->Queue.EncryptedAreaEnd / 1024 / 1024);
+
+ while (!EncryptionSetupThreadAbortRequested)
+ {
+ if (SetupRequest.SetupMode == SetupEncryption)
+ {
+ if (offset.QuadPart + setupBlockSize > Extension->ConfiguredEncryptedAreaEnd + 1)
+ setupBlockSize = (ULONG) (Extension->ConfiguredEncryptedAreaEnd + 1 - offset.QuadPart);
+
+ if (offset.QuadPart > Extension->ConfiguredEncryptedAreaEnd)
+ break;
+ }
+ else
+ {
+ if (offset.QuadPart - setupBlockSize < Extension->Queue.EncryptedAreaStart)
+ setupBlockSize = (ULONG) (offset.QuadPart - Extension->Queue.EncryptedAreaStart);
+
+ offset.QuadPart -= setupBlockSize;
+
+ if (setupBlockSize == 0 || offset.QuadPart < Extension->Queue.EncryptedAreaStart)
+ break;
+ }
+
+ while (!NT_SUCCESS (EncryptedIoQueueHoldWhenIdle (&Extension->Queue, 500)))
+ {
+ if (EncryptionSetupThreadAbortRequested)
+ goto abort;
+
+ TransformWaitingForIdle = TRUE;
+ }
+ TransformWaitingForIdle = FALSE;
+
+ status = TCReadDevice (BootDriveFilterExtension->LowerDeviceObject, buffer, offset, setupBlockSize);
+ if (!NT_SUCCESS (status))
+ {
+ Dump ("TCReadDevice error %x offset=%I64d\n", status, offset.QuadPart);
+
+ if (SetupRequest.ZeroUnreadableSectors && SetupRequest.SetupMode == SetupEncryption)
+ {
+ // Zero unreadable sectors
+ uint64 zeroedSectorCount;
+
+ status = ZeroUnreadableSectors (BootDriveFilterExtension->LowerDeviceObject, offset, setupBlockSize, &zeroedSectorCount);
+ if (!NT_SUCCESS (status))
+ {
+ SetupResult = status;
+ goto err;
+ }
+
+ // Retry read
+ status = TCReadDevice (BootDriveFilterExtension->LowerDeviceObject, buffer, offset, setupBlockSize);
+ if (!NT_SUCCESS (status))
+ {
+ SetupResult = status;
+ goto err;
+ }
+ }
+ else if (SetupRequest.DiscardUnreadableEncryptedSectors && SetupRequest.SetupMode == SetupDecryption)
+ {
+ // Discard unreadable encrypted sectors
+ uint64 badSectorCount;
+
+ status = ReadDeviceSkipUnreadableSectors (BootDriveFilterExtension->LowerDeviceObject, buffer, offset, setupBlockSize, &badSectorCount);
+ if (!NT_SUCCESS (status))
+ {
+ SetupResult = status;
+ goto err;
+ }
+ }
+ else
+ {
+ SetupResult = status;
+ goto err;
+ }
+ }
+
+ dataUnit.Value = offset.QuadPart / ENCRYPTION_DATA_UNIT_SIZE;
+
+ if (SetupRequest.SetupMode == SetupEncryption)
+ {
+ EncryptDataUnits (buffer, &dataUnit, setupBlockSize / ENCRYPTION_DATA_UNIT_SIZE, Extension->Queue.CryptoInfo);
+
+ if (SetupRequest.WipeAlgorithm != TC_WIPE_NONE)
+ {
+ byte wipePass;
+ for (wipePass = 1; wipePass <= GetWipePassCount (SetupRequest.WipeAlgorithm); ++wipePass)
+ {
+ if (!WipeBuffer (SetupRequest.WipeAlgorithm, wipeRandChars, wipePass, wipeBuffer, setupBlockSize))
+ {
+ ULONG i;
+ for (i = 0; i < setupBlockSize; ++i)
+ {
+ wipeBuffer[i] = buffer[i] + wipePass;
+ }
+
+ EncryptDataUnits (wipeBuffer, &dataUnit, setupBlockSize / ENCRYPTION_DATA_UNIT_SIZE, Extension->Queue.CryptoInfo);
+ memcpy (wipeRandCharsUpdate, wipeBuffer, sizeof (wipeRandCharsUpdate));
+ }
+
+ status = TCWriteDevice (BootDriveFilterExtension->LowerDeviceObject, wipeBuffer, offset, setupBlockSize);
+ if (!NT_SUCCESS (status))
+ {
+ // Undo failed write operation
+ DecryptDataUnits (buffer, &dataUnit, setupBlockSize / ENCRYPTION_DATA_UNIT_SIZE, Extension->Queue.CryptoInfo);
+ TCWriteDevice (BootDriveFilterExtension->LowerDeviceObject, buffer, offset, setupBlockSize);
+
+ SetupResult = status;
+ goto err;
+ }
+ }
+
+ memcpy (wipeRandChars, wipeRandCharsUpdate, sizeof (wipeRandCharsUpdate));
+ }
+ }
+ else
+ {
+ DecryptDataUnits (buffer, &dataUnit, setupBlockSize / ENCRYPTION_DATA_UNIT_SIZE, Extension->Queue.CryptoInfo);
+ }
+
+ status = TCWriteDevice (BootDriveFilterExtension->LowerDeviceObject, buffer, offset, setupBlockSize);
+ if (!NT_SUCCESS (status))
+ {
+ Dump ("TCWriteDevice error %x\n", status);
+
+ // Undo failed write operation
+ if (SetupRequest.SetupMode == SetupEncryption)
+ DecryptDataUnits (buffer, &dataUnit, setupBlockSize / ENCRYPTION_DATA_UNIT_SIZE, Extension->Queue.CryptoInfo);
+ else
+ EncryptDataUnits (buffer, &dataUnit, setupBlockSize / ENCRYPTION_DATA_UNIT_SIZE, Extension->Queue.CryptoInfo);
+
+ TCWriteDevice (BootDriveFilterExtension->LowerDeviceObject, buffer, offset, setupBlockSize);
+
+ SetupResult = status;
+ goto err;
+ }
+
+ if (SetupRequest.SetupMode == SetupEncryption)
+ offset.QuadPart += setupBlockSize;
+
+ Extension->Queue.EncryptedAreaEndUpdatePending = TRUE;
+ Extension->Queue.EncryptedAreaEnd = offset.QuadPart - 1;
+ Extension->Queue.EncryptedAreaEndUpdatePending = FALSE;
+
+ headerUpdateRequired = TRUE;
+
+ EncryptedIoQueueResumeFromHold (&Extension->Queue);
+
+ KeAcquireSpinLock (&SetupStatusSpinLock, &irql);
+ SetupStatusEncryptedAreaEnd = Extension->Queue.EncryptedAreaEnd;
+ KeReleaseSpinLock (&SetupStatusSpinLock, irql);
+
+ // Update volume header
+ bytesWrittenSinceHeaderUpdate += setupBlockSize;
+ if (bytesWrittenSinceHeaderUpdate >= TC_ENCRYPTION_SETUP_HEADER_UPDATE_THRESHOLD)
+ {
+ status = SaveDriveVolumeHeader (Extension);
+ ASSERT (NT_SUCCESS (status));
+
+ headerUpdateRequired = FALSE;
+ bytesWrittenSinceHeaderUpdate = 0;
+ }
+ }
+
+abort:
+ SetupResult = STATUS_SUCCESS;
+err:
+
+ if (Extension->Queue.EncryptedAreaEnd == -1)
+ Extension->Queue.EncryptedAreaStart = -1;
+
+ if (EncryptedIoQueueIsSuspended (&Extension->Queue))
+ EncryptedIoQueueResumeFromHold (&Extension->Queue);
+
+ if (SetupRequest.SetupMode == SetupDecryption && Extension->Queue.EncryptedAreaStart >= Extension->Queue.EncryptedAreaEnd)
+ {
+ while (!NT_SUCCESS (EncryptedIoQueueHoldWhenIdle (&Extension->Queue, 0)));
+
+ Extension->ConfiguredEncryptedAreaStart = Extension->ConfiguredEncryptedAreaEnd = -1;
+ Extension->Queue.EncryptedAreaStart = Extension->Queue.EncryptedAreaEnd = -1;
+
+ EncryptedIoQueueResumeFromHold (&Extension->Queue);
+
+ headerUpdateRequired = TRUE;
+ }
+
+ Dump ("Setup completed: EncryptedAreaStart=%I64d (%I64d) EncryptedAreaEnd=%I64d (%I64d)\n", Extension->Queue.EncryptedAreaStart / 1024 / 1024, Extension->Queue.EncryptedAreaStart, Extension->Queue.EncryptedAreaEnd / 1024 / 1024, Extension->Queue.EncryptedAreaEnd);
+
+ if (headerUpdateRequired)
+ {
+ status = SaveDriveVolumeHeader (Extension);
+
+ if (!NT_SUCCESS (status) && NT_SUCCESS (SetupResult))
+ SetupResult = status;
+ }
+
+ if (SetupRequest.SetupMode == SetupDecryption && Extension->ConfiguredEncryptedAreaEnd == -1 && Extension->DriveMounted)
+ {
+ while (!RootDeviceControlMutexAcquireNoWait() && !EncryptionSetupThreadAbortRequested)
+ {
+ TCSleep (10);
+ }
+
+ // Disable hibernation (resume would fail due to a change in the system memory map)
+ HibernationEnabled = FALSE;
+
+ DismountDrive (Extension, FALSE);
+
+ if (!EncryptionSetupThreadAbortRequested)
+ RootDeviceControlMutexRelease();
+ }
+
+ret:
+ if (buffer)
+ TCfree (buffer);
+ if (wipeBuffer)
+ TCfree (wipeBuffer);
+
+ SetupInProgress = FALSE;
+ PsTerminateSystemThread (SetupResult);
+}
+
+
+NTSTATUS StartBootEncryptionSetup (PDEVICE_OBJECT DeviceObject, PIRP irp, PIO_STACK_LOCATION irpSp)
+{
+ NTSTATUS status;
+
+ if (!UserCanAccessDriveDevice())
+ return STATUS_ACCESS_DENIED;
+
+ if (SetupInProgress || !BootDriveFound || !BootDriveFilterExtension
+ || !BootDriveFilterExtension->DriveMounted
+ || BootDriveFilterExtension->HiddenSystem
+ || irpSp->Parameters.DeviceIoControl.InputBufferLength < sizeof (BootEncryptionSetupRequest))
+ return STATUS_INVALID_PARAMETER;
+
+ if (EncryptionSetupThread)
+ AbortBootEncryptionSetup();
+
+ SetupRequest = *(BootEncryptionSetupRequest *) irp->AssociatedIrp.SystemBuffer;
+
+ EncryptionSetupThreadAbortRequested = FALSE;
+ KeInitializeSpinLock (&SetupStatusSpinLock);
+ SetupStatusEncryptedAreaEnd = BootDriveFilterExtension ? BootDriveFilterExtension->Queue.EncryptedAreaEnd : -1;
+
+ SetupInProgress = TRUE;
+ status = TCStartThread (SetupThreadProc, DeviceObject, &EncryptionSetupThread);
+
+ if (!NT_SUCCESS (status))
+ SetupInProgress = FALSE;
+
+ return status;
+}
+
+
+void GetBootDriveVolumeProperties (PIRP irp, PIO_STACK_LOCATION irpSp)
+{
+ if (ValidateIOBufferSize (irp, sizeof (VOLUME_PROPERTIES_STRUCT), ValidateOutput))
+ {
+ DriveFilterExtension *Extension = BootDriveFilterExtension;
+ VOLUME_PROPERTIES_STRUCT *prop = (VOLUME_PROPERTIES_STRUCT *) irp->AssociatedIrp.SystemBuffer;
+ memset (prop, 0, sizeof (*prop));
+
+ if (!BootDriveFound || !Extension || !Extension->DriveMounted)
+ {
+ irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+ irp->IoStatus.Information = 0;
+ }
+ else
+ {
+ prop->hiddenVolume = Extension->Queue.CryptoInfo->hiddenVolume;
+ prop->diskLength = Extension->ConfiguredEncryptedAreaEnd + 1 - Extension->ConfiguredEncryptedAreaStart;
+ prop->ea = Extension->Queue.CryptoInfo->ea;
+ prop->mode = Extension->Queue.CryptoInfo->mode;
+ prop->pkcs5 = Extension->Queue.CryptoInfo->pkcs5;
+ prop->pkcs5Iterations = Extension->Queue.CryptoInfo->noIterations;
+#if 0
+ prop->volumeCreationTime = Extension->Queue.CryptoInfo->volume_creation_time;
+ prop->headerCreationTime = Extension->Queue.CryptoInfo->header_creation_time;
+#endif
+ prop->volFormatVersion = Extension->Queue.CryptoInfo->LegacyVolume ? TC_VOLUME_FORMAT_VERSION_PRE_6_0 : TC_VOLUME_FORMAT_VERSION;
+
+ prop->totalBytesRead = Extension->Queue.TotalBytesRead;
+ prop->totalBytesWritten = Extension->Queue.TotalBytesWritten;
+
+ irp->IoStatus.Information = sizeof (VOLUME_PROPERTIES_STRUCT);
+ irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ }
+}
+
+
+void GetBootEncryptionStatus (PIRP irp, PIO_STACK_LOCATION irpSp)
+{
+ /* IMPORTANT: Do NOT add any potentially time-consuming operations to this function. */
+
+ if (ValidateIOBufferSize (irp, sizeof (BootEncryptionStatus), ValidateOutput))
+ {
+ DriveFilterExtension *Extension = BootDriveFilterExtension;
+ BootEncryptionStatus *bootEncStatus = (BootEncryptionStatus *) irp->AssociatedIrp.SystemBuffer;
+ memset (bootEncStatus, 0, sizeof (*bootEncStatus));
+
+ if (BootArgsValid)
+ bootEncStatus->BootLoaderVersion = BootArgs.BootLoaderVersion;
+
+ bootEncStatus->DeviceFilterActive = DeviceFilterActive;
+ bootEncStatus->SetupInProgress = SetupInProgress;
+ bootEncStatus->SetupMode = SetupRequest.SetupMode;
+ bootEncStatus->TransformWaitingForIdle = TransformWaitingForIdle;
+
+ if (!BootDriveFound || !Extension || !Extension->DriveMounted)
+ {
+ bootEncStatus->DriveEncrypted = FALSE;
+ bootEncStatus->DriveMounted = FALSE;
+ bootEncStatus->VolumeHeaderPresent = FALSE;
+ }
+ else
+ {
+ bootEncStatus->DriveMounted = Extension->DriveMounted;
+ bootEncStatus->VolumeHeaderPresent = Extension->VolumeHeaderPresent;
+ bootEncStatus->DriveEncrypted = Extension->Queue.EncryptedAreaStart != -1;
+ bootEncStatus->BootDriveLength = BootDriveLength;
+
+ bootEncStatus->ConfiguredEncryptedAreaStart = Extension->ConfiguredEncryptedAreaStart;
+ bootEncStatus->ConfiguredEncryptedAreaEnd = Extension->ConfiguredEncryptedAreaEnd;
+ bootEncStatus->EncryptedAreaStart = Extension->Queue.EncryptedAreaStart;
+
+ if (SetupInProgress)
+ {
+ KIRQL irql;
+ KeAcquireSpinLock (&SetupStatusSpinLock, &irql);
+ bootEncStatus->EncryptedAreaEnd = SetupStatusEncryptedAreaEnd;
+ KeReleaseSpinLock (&SetupStatusSpinLock, irql);
+ }
+ else
+ bootEncStatus->EncryptedAreaEnd = Extension->Queue.EncryptedAreaEnd;
+
+ bootEncStatus->VolumeHeaderSaltCrc32 = Extension->VolumeHeaderSaltCrc32;
+ bootEncStatus->HibernationPreventionCount = HibernationPreventionCount;
+ bootEncStatus->HiddenSysLeakProtectionCount = HiddenSysLeakProtectionCount;
+
+ bootEncStatus->HiddenSystem = Extension->HiddenSystem;
+
+ if (Extension->HiddenSystem)
+ bootEncStatus->HiddenSystemPartitionStart = BootArgs.HiddenSystemPartitionStart;
+ }
+
+ irp->IoStatus.Information = sizeof (BootEncryptionStatus);
+ irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+}
+
+
+void GetBootLoaderVersion (PIRP irp, PIO_STACK_LOCATION irpSp)
+{
+ if (ValidateIOBufferSize (irp, sizeof (uint16), ValidateOutput))
+ {
+ if (BootArgsValid)
+ {
+ *(uint16 *) irp->AssociatedIrp.SystemBuffer = BootArgs.BootLoaderVersion;
+ irp->IoStatus.Information = sizeof (uint16);
+ irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ else
+ {
+ irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+ irp->IoStatus.Information = 0;
+ }
+ }
+}
+
+
+void GetBootEncryptionAlgorithmName (PIRP irp, PIO_STACK_LOCATION irpSp)
+{
+ if (ValidateIOBufferSize (irp, sizeof (GetBootEncryptionAlgorithmNameRequest), ValidateOutput))
+ {
+ if (BootDriveFilterExtension && BootDriveFilterExtension->DriveMounted)
+ {
+ GetBootEncryptionAlgorithmNameRequest *request = (GetBootEncryptionAlgorithmNameRequest *) irp->AssociatedIrp.SystemBuffer;
+ EAGetName (request->BootEncryptionAlgorithmName, BootDriveFilterExtension->Queue.CryptoInfo->ea);
+
+ irp->IoStatus.Information = sizeof (GetBootEncryptionAlgorithmNameRequest);
+ irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ else
+ {
+ irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+ irp->IoStatus.Information = 0;
+ }
+ }
+}
+
+
+NTSTATUS GetSetupResult()
+{
+ return SetupResult;
+}
+
+
+BOOL IsBootDriveMounted ()
+{
+ return BootDriveFilterExtension && BootDriveFilterExtension->DriveMounted;
+}
+
+
+BOOL IsBootEncryptionSetupInProgress ()
+{
+ return SetupInProgress;
+}
+
+
+BOOL IsHiddenSystemRunning ()
+{
+ return BootDriveFilterExtension && BootDriveFilterExtension->HiddenSystem;
+}
+
+
+DriveFilterExtension *GetBootDriveFilterExtension ()
+{
+ return BootDriveFilterExtension;
+}
+
+
+CRYPTO_INFO *GetSystemDriveCryptoInfo ()
+{
+ return BootDriveFilterExtension->Queue.CryptoInfo;
+}
+
+
+NTSTATUS AbortBootEncryptionSetup ()
+{
+ if (!IoIsSystemThread (PsGetCurrentThread()) && !UserCanAccessDriveDevice())
+ return STATUS_ACCESS_DENIED;
+
+ if (EncryptionSetupThread)
+ {
+ EncryptionSetupThreadAbortRequested = TRUE;
+
+ TCStopThread (EncryptionSetupThread, NULL);
+ EncryptionSetupThread = NULL;
+ }
+
+ return STATUS_SUCCESS;
+}
+
+
+static VOID DecoySystemWipeThreadProc (PVOID threadArg)
+{
+ DriveFilterExtension *Extension = BootDriveFilterExtension;
+
+ LARGE_INTEGER offset;
+ UINT64_STRUCT dataUnit;
+ ULONG wipeBlockSize = TC_ENCRYPTION_SETUP_IO_BLOCK_SIZE;
+
+ CRYPTO_INFO *wipeCryptoInfo = NULL;
+ byte *wipeBuffer = NULL;
+ byte *wipeRandBuffer = NULL;
+ byte wipeRandChars[TC_WIPE_RAND_CHAR_COUNT];
+ int wipePass;
+ int ea = Extension->Queue.CryptoInfo->ea;
+
+ KIRQL irql;
+ NTSTATUS status;
+
+ DecoySystemWipeResult = STATUS_UNSUCCESSFUL;
+
+ wipeBuffer = TCalloc (TC_ENCRYPTION_SETUP_IO_BLOCK_SIZE);
+ if (!wipeBuffer)
+ {
+ DecoySystemWipeResult = STATUS_INSUFFICIENT_RESOURCES;
+ goto ret;
+ }
+
+ wipeRandBuffer = TCalloc (TC_ENCRYPTION_SETUP_IO_BLOCK_SIZE);
+ if (!wipeRandBuffer)
+ {
+ DecoySystemWipeResult = STATUS_INSUFFICIENT_RESOURCES;
+ goto ret;
+ }
+
+ wipeCryptoInfo = crypto_open();
+ if (!wipeCryptoInfo)
+ {
+ DecoySystemWipeResult = STATUS_INSUFFICIENT_RESOURCES;
+ goto ret;
+ }
+
+ wipeCryptoInfo->ea = ea;
+ wipeCryptoInfo->mode = Extension->Queue.CryptoInfo->mode;
+
+ if (EAInit (ea, WipeDecoyRequest.WipeKey, wipeCryptoInfo->ks) != ERR_SUCCESS)
+ {
+ DecoySystemWipeResult = STATUS_INVALID_PARAMETER;
+ goto ret;
+ }
+
+ memcpy (wipeCryptoInfo->k2, WipeDecoyRequest.WipeKey + EAGetKeySize (ea), EAGetKeySize (ea));
+
+ if (!EAInitMode (wipeCryptoInfo))
+ {
+ DecoySystemWipeResult = STATUS_INVALID_PARAMETER;
+ goto err;
+ }
+
+ EncryptDataUnits (wipeRandBuffer, &dataUnit, wipeBlockSize / ENCRYPTION_DATA_UNIT_SIZE, wipeCryptoInfo);
+ memcpy (wipeRandChars, wipeRandBuffer, sizeof (wipeRandChars));
+
+ burn (WipeDecoyRequest.WipeKey, sizeof (WipeDecoyRequest.WipeKey));
+
+ offset.QuadPart = Extension->ConfiguredEncryptedAreaStart;
+
+ Dump ("Wiping decoy system: start offset = %I64d\n", offset.QuadPart);
+
+ while (!DecoySystemWipeThreadAbortRequested)
+ {
+ if (offset.QuadPart + wipeBlockSize > Extension->ConfiguredEncryptedAreaEnd + 1)
+ wipeBlockSize = (ULONG) (Extension->ConfiguredEncryptedAreaEnd + 1 - offset.QuadPart);
+
+ if (offset.QuadPart > Extension->ConfiguredEncryptedAreaEnd)
+ break;
+
+ for (wipePass = 1; wipePass <= GetWipePassCount (WipeDecoyRequest.WipeAlgorithm); ++wipePass)
+ {
+ if (!WipeBuffer (WipeDecoyRequest.WipeAlgorithm, wipeRandChars, wipePass, wipeBuffer, wipeBlockSize))
+ {
+ dataUnit.Value = offset.QuadPart / ENCRYPTION_DATA_UNIT_SIZE;
+ EncryptDataUnits (wipeRandBuffer, &dataUnit, wipeBlockSize / ENCRYPTION_DATA_UNIT_SIZE, wipeCryptoInfo);
+ memcpy (wipeBuffer, wipeRandBuffer, wipeBlockSize);
+ }
+
+ while (!NT_SUCCESS (EncryptedIoQueueHoldWhenIdle (&Extension->Queue, 500)))
+ {
+ if (DecoySystemWipeThreadAbortRequested)
+ goto abort;
+ }
+
+ status = TCWriteDevice (BootDriveFilterExtension->LowerDeviceObject, wipeBuffer, offset, wipeBlockSize);
+
+ if (!NT_SUCCESS (status))
+ {
+ DecoySystemWipeResult = status;
+ goto err;
+ }
+
+ EncryptedIoQueueResumeFromHold (&Extension->Queue);
+ }
+
+ offset.QuadPart += wipeBlockSize;
+
+ KeAcquireSpinLock (&DecoySystemWipeStatusSpinLock, &irql);
+ DecoySystemWipedAreaEnd = offset.QuadPart - 1;
+ KeReleaseSpinLock (&DecoySystemWipeStatusSpinLock, irql);
+ }
+
+abort:
+ DecoySystemWipeResult = STATUS_SUCCESS;
+err:
+
+ if (EncryptedIoQueueIsSuspended (&Extension->Queue))
+ EncryptedIoQueueResumeFromHold (&Extension->Queue);
+
+ Dump ("Wipe end: DecoySystemWipedAreaEnd=%I64d (%I64d)\n", DecoySystemWipedAreaEnd, DecoySystemWipedAreaEnd / 1024 / 1024);
+
+ret:
+ if (wipeCryptoInfo)
+ crypto_close (wipeCryptoInfo);
+
+ if (wipeRandBuffer)
+ TCfree (wipeRandBuffer);
+
+ if (wipeBuffer)
+ TCfree (wipeBuffer);
+
+ DecoySystemWipeInProgress = FALSE;
+ PsTerminateSystemThread (DecoySystemWipeResult);
+}
+
+
+NTSTATUS StartDecoySystemWipe (PDEVICE_OBJECT DeviceObject, PIRP irp, PIO_STACK_LOCATION irpSp)
+{
+ NTSTATUS status;
+ WipeDecoySystemRequest *request;
+
+ if (!UserCanAccessDriveDevice())
+ return STATUS_ACCESS_DENIED;
+
+ if (!IsHiddenSystemRunning()
+ || irpSp->Parameters.DeviceIoControl.InputBufferLength < sizeof (WipeDecoySystemRequest))
+ return STATUS_INVALID_PARAMETER;
+
+ if (DecoySystemWipeInProgress)
+ return STATUS_SUCCESS;
+
+ if (DecoySystemWipeThread)
+ AbortDecoySystemWipe();
+
+ request = (WipeDecoySystemRequest *) irp->AssociatedIrp.SystemBuffer;
+ WipeDecoyRequest = *request;
+
+ burn (request->WipeKey, sizeof (request->WipeKey));
+
+ DecoySystemWipeThreadAbortRequested = FALSE;
+ KeInitializeSpinLock (&DecoySystemWipeStatusSpinLock);
+ DecoySystemWipedAreaEnd = BootDriveFilterExtension->ConfiguredEncryptedAreaStart;
+
+ DecoySystemWipeInProgress = TRUE;
+ status = TCStartThread (DecoySystemWipeThreadProc, DeviceObject, &DecoySystemWipeThread);
+
+ if (!NT_SUCCESS (status))
+ DecoySystemWipeInProgress = FALSE;
+
+ return status;
+}
+
+
+BOOL IsDecoySystemWipeInProgress()
+{
+ return DecoySystemWipeInProgress;
+}
+
+
+void GetDecoySystemWipeStatus (PIRP irp, PIO_STACK_LOCATION irpSp)
+{
+ if (ValidateIOBufferSize (irp, sizeof (DecoySystemWipeStatus), ValidateOutput))
+ {
+ DecoySystemWipeStatus *wipeStatus = (DecoySystemWipeStatus *) irp->AssociatedIrp.SystemBuffer;
+
+ if (!IsHiddenSystemRunning())
+ {
+ irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+ irp->IoStatus.Information = 0;
+ }
+ else
+ {
+ wipeStatus->WipeInProgress = DecoySystemWipeInProgress;
+ wipeStatus->WipeAlgorithm = WipeDecoyRequest.WipeAlgorithm;
+
+ if (DecoySystemWipeInProgress)
+ {
+ KIRQL irql;
+ KeAcquireSpinLock (&DecoySystemWipeStatusSpinLock, &irql);
+ wipeStatus->WipedAreaEnd = DecoySystemWipedAreaEnd;
+ KeReleaseSpinLock (&DecoySystemWipeStatusSpinLock, irql);
+ }
+ else
+ wipeStatus->WipedAreaEnd = DecoySystemWipedAreaEnd;
+
+ irp->IoStatus.Information = sizeof (DecoySystemWipeStatus);
+ irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ }
+}
+
+
+NTSTATUS GetDecoySystemWipeResult()
+{
+ return DecoySystemWipeResult;
+}
+
+
+NTSTATUS AbortDecoySystemWipe ()
+{
+ if (!IoIsSystemThread (PsGetCurrentThread()) && !UserCanAccessDriveDevice())
+ return STATUS_ACCESS_DENIED;
+
+ if (DecoySystemWipeThread)
+ {
+ DecoySystemWipeThreadAbortRequested = TRUE;
+
+ TCStopThread (DecoySystemWipeThread, NULL);
+ DecoySystemWipeThread = NULL;
+ }
+
+ return STATUS_SUCCESS;
+}
+
+
+uint64 GetBootDriveLength ()
+{
+ return BootDriveLength.QuadPart;
+}
+
+
+NTSTATUS WriteBootDriveSector (PIRP irp, PIO_STACK_LOCATION irpSp)
+{
+ WriteBootDriveSectorRequest *request;
+
+ if (!UserCanAccessDriveDevice())
+ return STATUS_ACCESS_DENIED;
+
+ if (!BootDriveFilterExtension
+ || irpSp->Parameters.DeviceIoControl.InputBufferLength < sizeof (WriteBootDriveSectorRequest))
+ return STATUS_INVALID_PARAMETER;
+
+ request = (WriteBootDriveSectorRequest *) irp->AssociatedIrp.SystemBuffer;
+ return TCWriteDevice (BootDriveFilterExtension->LowerDeviceObject, request->Data, request->Offset, sizeof (request->Data));
+}
diff --git a/src/Driver/DriveFilter.h b/src/Driver/DriveFilter.h
new file mode 100644
index 00000000..ca3a75dd
--- /dev/null
+++ b/src/Driver/DriveFilter.h
@@ -0,0 +1,85 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_DRIVER_DRIVE_FILTER
+#define TC_HEADER_DRIVER_DRIVE_FILTER
+
+#include "TCdefs.h"
+#include "Boot/Windows/BootCommon.h"
+#include "EncryptedIoQueue.h"
+
+typedef struct _DriveFilterExtension
+{
+ BOOL bRootDevice;
+ BOOL IsVolumeDevice;
+ BOOL IsDriveFilterDevice;
+ BOOL IsVolumeFilterDevice;
+ uint64 MagicNumber;
+
+ PDEVICE_OBJECT DeviceObject;
+ PDEVICE_OBJECT LowerDeviceObject;
+ PDEVICE_OBJECT Pdo;
+
+ ULONG SystemStorageDeviceNumber;
+ BOOL SystemStorageDeviceNumberValid;
+
+ int64 ConfiguredEncryptedAreaStart;
+ int64 ConfiguredEncryptedAreaEnd;
+
+ uint32 VolumeHeaderSaltCrc32;
+ EncryptedIoQueue Queue;
+
+ BOOL BootDrive;
+ BOOL VolumeHeaderPresent;
+ BOOL DriveMounted;
+
+ KEVENT MountWorkItemCompletedEvent;
+
+ CRYPTO_INFO *HeaderCryptoInfo;
+ BOOL HiddenSystem;
+
+} DriveFilterExtension;
+
+#define TC_BOOT_DRIVE_FILTER_EXTENSION_MAGIC_NUMBER 0x5452554542455854
+
+extern BOOL BootArgsValid;
+extern BootArguments BootArgs;
+extern PKTHREAD EncryptionSetupThread;
+extern PKTHREAD DecoySystemWipeThread;
+
+NTSTATUS AbortBootEncryptionSetup ();
+NTSTATUS DriveFilterAddDevice (PDRIVER_OBJECT driverObject, PDEVICE_OBJECT pdo);
+NTSTATUS DriveFilterDispatchIrp (PDEVICE_OBJECT DeviceObject, PIRP Irp);
+void GetBootDriveVolumeProperties (PIRP irp, PIO_STACK_LOCATION irpSp);
+void GetBootEncryptionAlgorithmName (PIRP irp, PIO_STACK_LOCATION irpSp);
+void GetBootEncryptionStatus (PIRP irp, PIO_STACK_LOCATION irpSp);
+void GetBootLoaderVersion (PIRP irp, PIO_STACK_LOCATION irpSp);
+NTSTATUS GetSetupResult ();
+DriveFilterExtension *GetBootDriveFilterExtension ();
+CRYPTO_INFO *GetSystemDriveCryptoInfo ();
+BOOL IsBootDriveMounted ();
+BOOL IsBootEncryptionSetupInProgress ();
+BOOL IsHiddenSystemRunning ();
+NTSTATUS LoadBootArguments ();
+static NTSTATUS SaveDriveVolumeHeader (DriveFilterExtension *Extension);
+NTSTATUS StartBootEncryptionSetup (PDEVICE_OBJECT DeviceObject, PIRP irp, PIO_STACK_LOCATION irpSp);
+void ReopenBootVolumeHeader (PIRP irp, PIO_STACK_LOCATION irpSp);
+NTSTATUS StartDecoySystemWipe (PDEVICE_OBJECT DeviceObject, PIRP irp, PIO_STACK_LOCATION irpSp);
+void StartLegacyHibernationDriverFilter ();
+NTSTATUS AbortDecoySystemWipe ();
+BOOL IsDecoySystemWipeInProgress();
+NTSTATUS GetDecoySystemWipeResult();
+void GetDecoySystemWipeStatus (PIRP irp, PIO_STACK_LOCATION irpSp);
+uint64 GetBootDriveLength ();
+NTSTATUS WriteBootDriveSector (PIRP irp, PIO_STACK_LOCATION irpSp);
+
+#define TC_ENCRYPTION_SETUP_IO_BLOCK_SIZE (1536 * 1024)
+#define TC_ENCRYPTION_SETUP_HEADER_UPDATE_THRESHOLD (64 * 1024 * 1024)
+#define TC_HIBERNATION_WRITE_BUFFER_SIZE (128 * 1024)
+
+#endif // TC_HEADER_DRIVER_DRIVE_FILTER
diff --git a/src/Driver/Driver.rc b/src/Driver/Driver.rc
new file mode 100644
index 00000000..6f1f9a9a
--- /dev/null
+++ b/src/Driver/Driver.rc
@@ -0,0 +1,101 @@
+// Microsoft Visual C++ generated resource script.
+//
+#include "resource.h"
+
+#define APSTUDIO_READONLY_SYMBOLS
+/////////////////////////////////////////////////////////////////////////////
+//
+// Generated from the TEXTINCLUDE 2 resource.
+//
+#include "afxres.h"
+
+/////////////////////////////////////////////////////////////////////////////
+#undef APSTUDIO_READONLY_SYMBOLS
+
+/////////////////////////////////////////////////////////////////////////////
+// English (U.S.) resources
+
+#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_ENU)
+#ifdef _WIN32
+LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
+#pragma code_page(1252)
+#endif //_WIN32
+
+/////////////////////////////////////////////////////////////////////////////
+//
+// Version
+//
+
+VS_VERSION_INFO VERSIONINFO
+ FILEVERSION 7,1,1,0
+ PRODUCTVERSION 7,1,1,0
+ FILEFLAGSMASK 0x17L
+#ifdef _DEBUG
+ FILEFLAGS 0x1L
+#else
+ FILEFLAGS 0x0L
+#endif
+ FILEOS 0x4L
+ FILETYPE 0x3L
+ FILESUBTYPE 0x0L
+BEGIN
+ BLOCK "StringFileInfo"
+ BEGIN
+ BLOCK "040904b0"
+ BEGIN
+ VALUE "CompanyName", "TrueCrypt Foundation"
+ VALUE "FileDescription", "TrueCrypt Driver"
+ VALUE "FileVersion", "7.1a"
+ VALUE "LegalTrademarks", "TrueCrypt"
+ VALUE "OriginalFilename", "truecrypt.sys"
+ VALUE "ProductName", "TrueCrypt"
+ VALUE "ProductVersion", "7.1a"
+ END
+ END
+ BLOCK "VarFileInfo"
+ BEGIN
+ VALUE "Translation", 0x409, 1200
+ END
+END
+
+
+#ifdef APSTUDIO_INVOKED
+/////////////////////////////////////////////////////////////////////////////
+//
+// TEXTINCLUDE
+//
+
+1 TEXTINCLUDE
+BEGIN
+ "resource.h\0"
+END
+
+2 TEXTINCLUDE
+BEGIN
+ "#include ""afxres.h""\r\n"
+ "\0"
+END
+
+3 TEXTINCLUDE
+BEGIN
+ "\r\n"
+ "\0"
+END
+
+#endif // APSTUDIO_INVOKED
+
+#endif // English (U.S.) resources
+/////////////////////////////////////////////////////////////////////////////
+
+
+
+#ifndef APSTUDIO_INVOKED
+/////////////////////////////////////////////////////////////////////////////
+//
+// Generated from the TEXTINCLUDE 3 resource.
+//
+
+
+/////////////////////////////////////////////////////////////////////////////
+#endif // not APSTUDIO_INVOKED
+
diff --git a/src/Driver/Driver.vcproj b/src/Driver/Driver.vcproj
new file mode 100644
index 00000000..2021a2c3
--- /dev/null
+++ b/src/Driver/Driver.vcproj
@@ -0,0 +1,414 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioProject
+ ProjectType="Visual C++"
+ Version="9.00"
+ Name="Driver"
+ ProjectGUID="{EF5EF444-18D0-40D7-8DFA-775EC4448602}"
+ RootNamespace="Driver"
+ Keyword="MakeFileProj"
+ TargetFrameworkVersion="131072"
+ >
+ <Platforms>
+ <Platform
+ Name="Win32"
+ />
+ </Platforms>
+ <ToolFiles>
+ </ToolFiles>
+ <Configurations>
+ <Configuration
+ Name="Debug|Win32"
+ OutputDirectory="Debug"
+ IntermediateDirectory="Debug"
+ ConfigurationType="0"
+ InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
+ >
+ <Tool
+ Name="VCNMakeTool"
+ BuildCommandLine="echo ------ Building truecrypt.sys: Debug x86 ------&#x0D;&#x0A;cmd.exe /c BuildDriver.cmd -build -debug -x86 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;&#x0D;&#x0A;if errorlevel 1 exit %errorlevel%&#x0D;&#x0A;echo.&#x0D;&#x0A;echo ------ Building truecrypt.sys: Debug x64 ------&#x0D;&#x0A;BuildDriver.cmd -build -debug -x64 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ ReBuildCommandLine="echo ------ Rebuilding truecrypt.sys: Debug x86 ------&#x0D;&#x0A;cmd.exe /c BuildDriver.cmd -rebuild -debug -x86 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;&#x0D;&#x0A;if errorlevel 1 exit %errorlevel%&#x0D;&#x0A;echo.&#x0D;&#x0A;echo ------ Rebuilding truecrypt.sys: Debug x64 ------&#x0D;&#x0A;BuildDriver.cmd -rebuild -debug -x64 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ CleanCommandLine="echo ------ Cleaning truecrypt.sys: Debug x86 ------&#x0D;&#x0A;cmd.exe /c BuildDriver.cmd -clean -debug -x86 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;&#x0D;&#x0A;if errorlevel 1 exit %errorlevel%&#x0D;&#x0A;echo.&#x0D;&#x0A;echo ------ Cleaning truecrypt.sys: Debug x64 ------&#x0D;&#x0A;BuildDriver.cmd -clean -debug -x64 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ Output=""
+ PreprocessorDefinitions="DEBUG;_DEBUG;TC_WINDOWS_DRIVER"
+ IncludeSearchPath="&quot;$(ProjectDir)&quot;;&quot;$(SolutionDir)&quot;;&quot;$(SolutionDir)\Common&quot;;&quot;$(SolutionDir)\Crypto&quot;;&quot;$(WINDDK_ROOT)\inc\ddk&quot;;&quot;$(WINDDK_ROOT)\inc\api&quot;"
+ ForcedIncludes=""
+ AssemblySearchPath=""
+ ForcedUsingAssemblies=""
+ CompileAsManaged=""
+ />
+ </Configuration>
+ <Configuration
+ Name="Release|Win32"
+ OutputDirectory="Release"
+ IntermediateDirectory="Release"
+ ConfigurationType="0"
+ InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
+ >
+ <Tool
+ Name="VCNMakeTool"
+ BuildCommandLine="echo ------ Building truecrypt.sys: Release x86 ------&#x0D;&#x0A;cmd.exe /c BuildDriver.cmd -build -release -x86 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;&#x0D;&#x0A;if errorlevel 1 exit %errorlevel%&#x0D;&#x0A;echo.&#x0D;&#x0A;echo ------ Building truecrypt.sys: Release x64 ------&#x0D;&#x0A;BuildDriver.cmd -build -release -x64 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ ReBuildCommandLine="echo ------ Rebuilding truecrypt.sys: Release x86 ------&#x0D;&#x0A;cmd.exe /c BuildDriver.cmd -rebuild -release -x86 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;&#x0D;&#x0A;if errorlevel 1 exit %errorlevel%&#x0D;&#x0A;echo.&#x0D;&#x0A;echo ------ Rebuilding truecrypt.sys: Release x64 ------&#x0D;&#x0A;BuildDriver.cmd -rebuild -release -x64 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ CleanCommandLine="echo ------ Cleaning truecrypt.sys: Release x86 ------&#x0D;&#x0A;cmd.exe /c BuildDriver.cmd -clean -release -x86 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;&#x0D;&#x0A;if errorlevel 1 exit %errorlevel%&#x0D;&#x0A;echo.&#x0D;&#x0A;echo ------ Cleaning truecrypt.sys: Release x64 ------&#x0D;&#x0A;BuildDriver.cmd -clean -release -x64 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ Output=""
+ PreprocessorDefinitions="TC_WINDOWS_DRIVER"
+ IncludeSearchPath="&quot;$(ProjectDir)&quot;;&quot;$(SolutionDir)&quot;;&quot;$(SolutionDir)\Common&quot;;&quot;$(SolutionDir)\Crypto&quot;;&quot;$(WINDDK_ROOT)\inc\ddk&quot;;&quot;$(WINDDK_ROOT)\inc\api&quot;"
+ ForcedIncludes=""
+ AssemblySearchPath=""
+ ForcedUsingAssemblies=""
+ CompileAsManaged=""
+ />
+ </Configuration>
+ <Configuration
+ Name="Release x86|Win32"
+ OutputDirectory="$(ConfigurationName)"
+ IntermediateDirectory="$(ConfigurationName)"
+ ConfigurationType="0"
+ InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
+ >
+ <Tool
+ Name="VCNMakeTool"
+ BuildCommandLine="BuildDriver.cmd -build -release -x86 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ ReBuildCommandLine="BuildDriver.cmd -rebuild -release -x86 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ CleanCommandLine="BuildDriver.cmd -clean -release -x86 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ Output=""
+ PreprocessorDefinitions="TC_WINDOWS_DRIVER"
+ IncludeSearchPath="&quot;$(ProjectDir)&quot;;&quot;$(SolutionDir)&quot;;&quot;$(SolutionDir)\Common&quot;;&quot;$(SolutionDir)\Crypto&quot;;&quot;$(WINDDK_ROOT)\inc\ddk&quot;;&quot;$(WINDDK_ROOT)\inc\api&quot;"
+ ForcedIncludes=""
+ AssemblySearchPath=""
+ ForcedUsingAssemblies=""
+ CompileAsManaged=""
+ />
+ </Configuration>
+ <Configuration
+ Name="Debug x86|Win32"
+ OutputDirectory="$(ConfigurationName)"
+ IntermediateDirectory="$(ConfigurationName)"
+ ConfigurationType="0"
+ InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
+ >
+ <Tool
+ Name="VCNMakeTool"
+ BuildCommandLine="if exist $(SolutionDir)\Mount\Debug\TrueCrypt.exe ( copy $(SolutionDir)\Mount\Debug\TrueCrypt.exe $(ProjectDir)\obj_driver_debug\i386\TrueCrypt.exe &gt;NUL:&#x0D;&#x0A;) else ( copy $(SolutionDir)\Mount\Release\TrueCrypt.exe $(ProjectDir)\obj_driver_debug\i386\TrueCrypt.exe &gt;NUL: )&#x0D;&#x0A;&#x0D;&#x0A;BuildDriver.cmd -build -debug -x86 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ ReBuildCommandLine="if exist $(SolutionDir)\Mount\Debug\TrueCrypt.exe ( copy $(SolutionDir)\Mount\Debug\TrueCrypt.exe $(ProjectDir)\obj_driver_debug\i386\TrueCrypt.exe &gt;NUL:&#x0D;&#x0A;) else ( copy $(SolutionDir)\Mount\Release\TrueCrypt.exe $(ProjectDir)\obj_driver_debug\i386\TrueCrypt.exe &gt;NUL: )&#x0D;&#x0A;&#x0D;&#x0A;BuildDriver.cmd -rebuild -debug -x86 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ CleanCommandLine="BuildDriver.cmd -clean -debug -x86 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ Output="$(ProjectDir)\obj_driver_debug\i386\TrueCrypt.exe"
+ PreprocessorDefinitions="DEBUG;_DEBUG;TC_WINDOWS_DRIVER"
+ IncludeSearchPath="&quot;$(ProjectDir)&quot;;&quot;$(SolutionDir)&quot;;&quot;$(SolutionDir)\Common&quot;;&quot;$(SolutionDir)\Crypto&quot;;&quot;$(WINDDK_ROOT)\inc\ddk&quot;;&quot;$(WINDDK_ROOT)\inc\api&quot;"
+ ForcedIncludes=""
+ AssemblySearchPath=""
+ ForcedUsingAssemblies=""
+ CompileAsManaged=""
+ />
+ </Configuration>
+ <Configuration
+ Name="Release x64|Win32"
+ OutputDirectory="$(ConfigurationName)"
+ IntermediateDirectory="$(ConfigurationName)"
+ ConfigurationType="0"
+ InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
+ >
+ <Tool
+ Name="VCNMakeTool"
+ BuildCommandLine="BuildDriver.cmd -build -release -x64 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ ReBuildCommandLine="BuildDriver.cmd -rebuild -release -x64 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ CleanCommandLine="BuildDriver.cmd -clean -release -x64 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ Output=""
+ PreprocessorDefinitions="TC_WINDOWS_DRIVER"
+ IncludeSearchPath="&quot;$(ProjectDir)&quot;;&quot;$(SolutionDir)&quot;;&quot;$(SolutionDir)\Common&quot;;&quot;$(SolutionDir)\Crypto&quot;;&quot;$(WINDDK_ROOT)\inc\ddk&quot;;&quot;$(WINDDK_ROOT)\inc\api&quot;"
+ ForcedIncludes=""
+ AssemblySearchPath=""
+ ForcedUsingAssemblies=""
+ CompileAsManaged=""
+ />
+ </Configuration>
+ <Configuration
+ Name="Debug x64|Win32"
+ OutputDirectory="$(ConfigurationName)"
+ IntermediateDirectory="$(ConfigurationName)"
+ ConfigurationType="0"
+ InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
+ >
+ <Tool
+ Name="VCNMakeTool"
+ BuildCommandLine="if exist $(SolutionDir)\Mount\Debug\TrueCrypt.exe ( copy $(SolutionDir)\Mount\Debug\TrueCrypt.exe $(ProjectDir)\obj_driver_debug\amd64\TrueCrypt.exe &gt;NUL:&#x0D;&#x0A;) else ( copy $(SolutionDir)\Mount\Release\TrueCrypt.exe $(ProjectDir)\obj_driver_debug\amd64\TrueCrypt.exe &gt;NUL: )&#x0D;&#x0A;&#x0D;&#x0A;BuildDriver.cmd -build -debug -x64 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ ReBuildCommandLine="if exist $(SolutionDir)\Mount\Debug\TrueCrypt.exe ( copy $(SolutionDir)\Mount\Debug\TrueCrypt.exe $(ProjectDir)\obj_driver_debug\amd64\TrueCrypt.exe &gt;NUL:&#x0D;&#x0A;) else ( copy $(SolutionDir)\Mount\Release\TrueCrypt.exe $(ProjectDir)\obj_driver_debug\amd64\TrueCrypt.exe &gt;NUL: )&#x0D;&#x0A;&#x0D;&#x0A;BuildDriver.cmd -rebuild -debug -x64 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ CleanCommandLine="BuildDriver.cmd -clean -debug -x64 &quot;$(SolutionDir)\Common&quot; &quot;$(SolutionDir)\Crypto&quot; &quot;$(ProjectDir)&quot;"
+ Output="$(ProjectDir)\obj_driver_debug\amd64\TrueCrypt.exe"
+ PreprocessorDefinitions="DEBUG;_DEBUG;TC_WINDOWS_DRIVER"
+ IncludeSearchPath="&quot;$(ProjectDir)&quot;;&quot;$(SolutionDir)&quot;;&quot;$(SolutionDir)\Common&quot;;&quot;$(SolutionDir)\Crypto&quot;;&quot;$(WINDDK_ROOT)\inc\ddk&quot;;&quot;$(WINDDK_ROOT)\inc\api&quot;"
+ ForcedIncludes=""
+ AssemblySearchPath=""
+ ForcedUsingAssemblies=""
+ CompileAsManaged=""
+ />
+ </Configuration>
+ </Configurations>
+ <References>
+ </References>
+ <Files>
+ <Filter
+ Name="Source Files"
+ Filter="cpp;c;cxx;def;odl;idl;hpj;bat;asm;asmx"
+ UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
+ >
+ <File
+ RelativePath=".\DriveFilter.c"
+ >
+ </File>
+ <File
+ RelativePath=".\DumpFilter.c"
+ >
+ </File>
+ <File
+ RelativePath=".\EncryptedIoQueue.c"
+ >
+ </File>
+ <File
+ RelativePath=".\Ntdriver.c"
+ >
+ </File>
+ <File
+ RelativePath=".\Ntvol.c"
+ >
+ </File>
+ <File
+ RelativePath=".\VolumeFilter.c"
+ >
+ </File>
+ <Filter
+ Name="Common"
+ >
+ <File
+ RelativePath="..\Common\Cache.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Crc.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Crypto.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\EncryptionThreadPool.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Endian.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\GfMul.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Pkcs5.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Tests.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Volumes.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Wipe.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Xts.c"
+ >
+ </File>
+ </Filter>
+ <Filter
+ Name="Crypto"
+ >
+ <File
+ RelativePath="..\Crypto\Aes_hw_cpu.asm"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Aes_x64.asm"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Aes_x86.asm"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Aeskey.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Aestab.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Blowfish.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Cast.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Des.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Rmd160.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Serpent.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Sha1.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Sha2.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Twofish.c"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Whirlpool.c"
+ >
+ </File>
+ </Filter>
+ </Filter>
+ <Filter
+ Name="Header Files"
+ Filter="h;hpp;hxx;hm;inl;inc;xsd"
+ UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"
+ >
+ <File
+ RelativePath="..\Common\Apidrvr.h"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Cache.h"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Common.h"
+ >
+ </File>
+ <File
+ RelativePath=".\DriveFilter.h"
+ >
+ </File>
+ <File
+ RelativePath=".\DumpFilter.h"
+ >
+ </File>
+ <File
+ RelativePath=".\EncryptedIoQueue.h"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\EncryptionThreadPool.h"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\GfMul.h"
+ >
+ </File>
+ <File
+ RelativePath=".\Ntdriver.h"
+ >
+ </File>
+ <File
+ RelativePath=".\Ntvol.h"
+ >
+ </File>
+ <File
+ RelativePath=".\resource.h"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Tcdefs.h"
+ >
+ </File>
+ <File
+ RelativePath=".\VolumeFilter.h"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Volumes.h"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Wipe.h"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Xts.h"
+ >
+ </File>
+ </Filter>
+ <Filter
+ Name="Resource Files"
+ Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx"
+ UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"
+ >
+ <File
+ RelativePath=".\Driver.rc"
+ >
+ </File>
+ </Filter>
+ <Filter
+ Name="Build Files"
+ >
+ <File
+ RelativePath=".\BuildDriver.cmd"
+ >
+ </File>
+ <File
+ RelativePath=".\Makefile"
+ >
+ </File>
+ <File
+ RelativePath=".\Sources"
+ >
+ </File>
+ <Filter
+ Name="Common"
+ >
+ <File
+ RelativePath="..\Common\Makefile"
+ >
+ </File>
+ <File
+ RelativePath="..\Common\Sources"
+ >
+ </File>
+ </Filter>
+ <Filter
+ Name="Crypto"
+ >
+ <File
+ RelativePath="..\Crypto\Makefile"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Makefile.inc"
+ >
+ </File>
+ <File
+ RelativePath="..\Crypto\Sources"
+ >
+ </File>
+ </Filter>
+ </Filter>
+ </Files>
+ <Globals>
+ </Globals>
+</VisualStudioProject>
diff --git a/src/Driver/DumpFilter.c b/src/Driver/DumpFilter.c
new file mode 100644
index 00000000..1ba85c93
--- /dev/null
+++ b/src/Driver/DumpFilter.c
@@ -0,0 +1,244 @@
+/*
+ Copyright (c) 2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#include "DumpFilter.h"
+#include "DriveFilter.h"
+#include "Ntdriver.h"
+#include "Tests.h"
+
+static DriveFilterExtension *BootDriveFilterExtension = NULL;
+static LARGE_INTEGER DumpPartitionOffset;
+static byte *WriteFilterBuffer = NULL;
+static SIZE_T WriteFilterBufferSize;
+
+
+NTSTATUS DumpFilterEntry (PFILTER_EXTENSION filterExtension, PFILTER_INITIALIZATION_DATA filterInitData)
+{
+ GetSystemDriveDumpConfigRequest dumpConfig;
+ PHYSICAL_ADDRESS highestAcceptableWriteBufferAddr;
+ STORAGE_DEVICE_NUMBER storageDeviceNumber;
+ PARTITION_INFORMATION partitionInfo;
+ LONG version;
+ NTSTATUS status;
+
+ Dump ("DumpFilterEntry type=%d\n", filterExtension->DumpType);
+
+ filterInitData->MajorVersion = DUMP_FILTER_MAJOR_VERSION;
+ filterInitData->MinorVersion = DUMP_FILTER_MINOR_VERSION;
+ filterInitData->Flags |= DUMP_FILTER_CRITICAL;
+
+ // Check driver version of the main device
+ status = TCDeviceIoControl (NT_ROOT_PREFIX, TC_IOCTL_GET_DRIVER_VERSION, NULL, 0, &version, sizeof (version));
+ if (!NT_SUCCESS (status))
+ goto err;
+
+ if (version != VERSION_NUM)
+ {
+ status = STATUS_INVALID_PARAMETER;
+ goto err;
+ }
+
+ // Get dump configuration from the main device
+ status = TCDeviceIoControl (NT_ROOT_PREFIX, TC_IOCTL_GET_SYSTEM_DRIVE_DUMP_CONFIG, NULL, 0, &dumpConfig, sizeof (dumpConfig));
+ if (!NT_SUCCESS (status))
+ goto err;
+
+ BootDriveFilterExtension = dumpConfig.BootDriveFilterExtension;
+
+ if (BootDriveFilterExtension->MagicNumber != TC_BOOT_DRIVE_FILTER_EXTENSION_MAGIC_NUMBER)
+ {
+ status = STATUS_CRC_ERROR;
+ goto err;
+ }
+
+ // KeSaveFloatingPointState() may generate a bug check during crash dump
+#if !defined (_WIN64)
+ if (filterExtension->DumpType == DumpTypeCrashdump)
+ dumpConfig.HwEncryptionEnabled = FALSE;
+#endif
+
+ EnableHwEncryption (dumpConfig.HwEncryptionEnabled);
+
+ if (!AutoTestAlgorithms())
+ {
+ status = STATUS_INVALID_PARAMETER;
+ goto err;
+ }
+
+ // Check dump volume is located on the system drive
+ status = SendDeviceIoControlRequest (filterExtension->DeviceObject, IOCTL_STORAGE_GET_DEVICE_NUMBER, NULL, 0, &storageDeviceNumber, sizeof (storageDeviceNumber));
+ if (!NT_SUCCESS (status))
+ goto err;
+
+ if (!BootDriveFilterExtension->SystemStorageDeviceNumberValid)
+ {
+ status = STATUS_INVALID_PARAMETER;
+ goto err;
+ }
+
+ if (storageDeviceNumber.DeviceNumber != BootDriveFilterExtension->SystemStorageDeviceNumber)
+ {
+ status = STATUS_ACCESS_DENIED;
+ goto err;
+ }
+
+ // Check dump volume is located within the scope of system encryption
+ status = SendDeviceIoControlRequest (filterExtension->DeviceObject, IOCTL_DISK_GET_PARTITION_INFO, NULL, 0, &partitionInfo, sizeof (partitionInfo));
+ if (!NT_SUCCESS (status))
+ goto err;
+
+ DumpPartitionOffset = partitionInfo.StartingOffset;
+
+ if (DumpPartitionOffset.QuadPart < BootDriveFilterExtension->ConfiguredEncryptedAreaStart
+ || DumpPartitionOffset.QuadPart > BootDriveFilterExtension->ConfiguredEncryptedAreaEnd)
+ {
+ status = STATUS_ACCESS_DENIED;
+ goto err;
+ }
+
+ // Allocate buffer for encryption
+ if (filterInitData->MaxPagesPerWrite == 0)
+ {
+ status = STATUS_INVALID_PARAMETER;
+ goto err;
+ }
+
+ WriteFilterBufferSize = filterInitData->MaxPagesPerWrite * PAGE_SIZE;
+
+#ifdef _WIN64
+ highestAcceptableWriteBufferAddr.QuadPart = 0x7FFffffFFFFLL;
+#else
+ highestAcceptableWriteBufferAddr.QuadPart = 0xffffFFFFLL;
+#endif
+
+ WriteFilterBuffer = MmAllocateContiguousMemory (WriteFilterBufferSize, highestAcceptableWriteBufferAddr);
+ if (!WriteFilterBuffer)
+ {
+ status = STATUS_INSUFFICIENT_RESOURCES;
+ goto err;
+ }
+
+ filterInitData->DumpStart = DumpFilterStart;
+ filterInitData->DumpWrite = DumpFilterWrite;
+ filterInitData->DumpFinish = DumpFilterFinish;
+ filterInitData->DumpUnload = DumpFilterUnload;
+
+ Dump ("Dump filter loaded type=%d\n", filterExtension->DumpType);
+ return STATUS_SUCCESS;
+
+err:
+ Dump ("DumpFilterEntry error %x\n", status);
+ return status;
+}
+
+
+static NTSTATUS DumpFilterStart (PFILTER_EXTENSION filterExtension)
+{
+ Dump ("DumpFilterStart type=%d\n", filterExtension->DumpType);
+
+ if (BootDriveFilterExtension->MagicNumber != TC_BOOT_DRIVE_FILTER_EXTENSION_MAGIC_NUMBER)
+ TC_BUG_CHECK (STATUS_CRC_ERROR);
+
+ return BootDriveFilterExtension->DriveMounted ? STATUS_SUCCESS : STATUS_UNSUCCESSFUL;
+}
+
+
+static NTSTATUS DumpFilterWrite (PFILTER_EXTENSION filterExtension, PLARGE_INTEGER diskWriteOffset, PMDL writeMdl)
+{
+ ULONG dataLength = MmGetMdlByteCount (writeMdl);
+ uint64 offset = DumpPartitionOffset.QuadPart + diskWriteOffset->QuadPart;
+ uint64 intersectStart;
+ uint32 intersectLength;
+ PVOID writeBuffer;
+ CSHORT origMdlFlags;
+
+ if (BootDriveFilterExtension->MagicNumber != TC_BOOT_DRIVE_FILTER_EXTENSION_MAGIC_NUMBER)
+ TC_BUG_CHECK (STATUS_CRC_ERROR);
+
+ if (BootDriveFilterExtension->Queue.EncryptedAreaEndUpdatePending) // Hibernation should always abort the setup thread
+ TC_BUG_CHECK (STATUS_INVALID_PARAMETER);
+
+ if (BootDriveFilterExtension->Queue.EncryptedAreaStart == -1 || BootDriveFilterExtension->Queue.EncryptedAreaEnd == -1)
+ return STATUS_SUCCESS;
+
+ if (dataLength > WriteFilterBufferSize)
+ TC_BUG_CHECK (STATUS_BUFFER_OVERFLOW); // Bug check is required as returning an error does not prevent data from being written to disk
+
+ if ((dataLength & (ENCRYPTION_DATA_UNIT_SIZE - 1)) != 0)
+ TC_BUG_CHECK (STATUS_INVALID_PARAMETER);
+
+ if ((offset & (ENCRYPTION_DATA_UNIT_SIZE - 1)) != 0)
+ TC_BUG_CHECK (STATUS_INVALID_PARAMETER);
+
+ writeBuffer = MmGetSystemAddressForMdlSafe (writeMdl, HighPagePriority);
+ if (!writeBuffer)
+ TC_BUG_CHECK (STATUS_INSUFFICIENT_RESOURCES);
+
+ memcpy (WriteFilterBuffer, writeBuffer, dataLength);
+
+ GetIntersection (offset,
+ dataLength,
+ BootDriveFilterExtension->Queue.EncryptedAreaStart,
+ BootDriveFilterExtension->Queue.EncryptedAreaEnd,
+ &intersectStart,
+ &intersectLength);
+
+ if (intersectLength > 0)
+ {
+ UINT64_STRUCT dataUnit;
+ dataUnit.Value = intersectStart / ENCRYPTION_DATA_UNIT_SIZE;
+
+ if (BootDriveFilterExtension->Queue.RemapEncryptedArea)
+ {
+ diskWriteOffset->QuadPart += BootDriveFilterExtension->Queue.RemappedAreaOffset;
+ dataUnit.Value += BootDriveFilterExtension->Queue.RemappedAreaDataUnitOffset;
+ }
+
+ EncryptDataUnitsCurrentThread (WriteFilterBuffer + (intersectStart - offset),
+ &dataUnit,
+ intersectLength / ENCRYPTION_DATA_UNIT_SIZE,
+ BootDriveFilterExtension->Queue.CryptoInfo);
+ }
+
+ origMdlFlags = writeMdl->MdlFlags;
+
+ MmInitializeMdl (writeMdl, WriteFilterBuffer, dataLength);
+ MmBuildMdlForNonPagedPool (writeMdl);
+
+ // Instead of using MmGetSystemAddressForMdlSafe(), some buggy custom storage drivers may directly test MDL_MAPPED_TO_SYSTEM_VA flag,
+ // disregarding the fact that other MDL flags may be set by the system or a dump filter (e.g. MDL_SOURCE_IS_NONPAGED_POOL flag only).
+ // Therefore, to work around this issue, the original flags will be restored even if they do not match the new MDL.
+ // MS BitLocker also uses this hack/workaround (it should be safe to use until the MDL structure is changed).
+
+ writeMdl->MdlFlags = origMdlFlags;
+
+ return STATUS_SUCCESS;
+}
+
+
+static NTSTATUS DumpFilterFinish (PFILTER_EXTENSION filterExtension)
+{
+ Dump ("DumpFilterFinish type=%d\n", filterExtension->DumpType);
+
+ return STATUS_SUCCESS;
+}
+
+
+static NTSTATUS DumpFilterUnload (PFILTER_EXTENSION filterExtension)
+{
+ Dump ("DumpFilterUnload type=%d\n", filterExtension->DumpType);
+
+ if (WriteFilterBuffer)
+ {
+ memset (WriteFilterBuffer, 0, WriteFilterBufferSize);
+ MmFreeContiguousMemory (WriteFilterBuffer);
+ WriteFilterBuffer = NULL;
+ }
+
+ return STATUS_SUCCESS;
+}
diff --git a/src/Driver/DumpFilter.h b/src/Driver/DumpFilter.h
new file mode 100644
index 00000000..63c39e32
--- /dev/null
+++ b/src/Driver/DumpFilter.h
@@ -0,0 +1,21 @@
+/*
+ Copyright (c) 2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_DRIVER_DUMP_FILTER
+#define TC_HEADER_DRIVER_DUMP_FILTER
+
+#include "Tcdefs.h"
+#include <ntdddump.h>
+
+NTSTATUS DumpFilterEntry (PFILTER_EXTENSION filterExtension, PFILTER_INITIALIZATION_DATA filterInitData);
+static NTSTATUS DumpFilterStart (PFILTER_EXTENSION filterExtension);
+static NTSTATUS DumpFilterWrite (PFILTER_EXTENSION filterExtension, PLARGE_INTEGER diskWriteOffset, PMDL writeMdl);
+static NTSTATUS DumpFilterFinish (PFILTER_EXTENSION filterExtension);
+static NTSTATUS DumpFilterUnload (PFILTER_EXTENSION filterExtension);
+
+#endif // TC_HEADER_DRIVER_DUMP_FILTER
diff --git a/src/Driver/EncryptedIoQueue.c b/src/Driver/EncryptedIoQueue.c
new file mode 100644
index 00000000..7cf48cd6
--- /dev/null
+++ b/src/Driver/EncryptedIoQueue.c
@@ -0,0 +1,1008 @@
+/*
+ Copyright (c) 2008-2009 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#include "TCdefs.h"
+#include "Apidrvr.h"
+#include "Ntdriver.h"
+#include "DriveFilter.h"
+#include "EncryptedIoQueue.h"
+#include "EncryptionThreadPool.h"
+#include "Volumes.h"
+
+
+static void AcquireBufferPoolMutex (EncryptedIoQueue *queue)
+{
+ NTSTATUS status;
+
+ status = KeWaitForMutexObject (&queue->BufferPoolMutex, Executive, KernelMode, FALSE, NULL);
+ if (!NT_SUCCESS (status))
+ TC_BUG_CHECK (status);
+}
+
+
+static void ReleaseBufferPoolMutex (EncryptedIoQueue *queue)
+{
+ KeReleaseMutex (&queue->BufferPoolMutex, FALSE);
+}
+
+
+static void *GetPoolBuffer (EncryptedIoQueue *queue, ULONG requestedSize)
+{
+ EncryptedIoQueueBuffer *buffer;
+ void *bufferAddress = NULL;
+ BOOL requestedSizePresentInPool = FALSE;
+
+ while (TRUE)
+ {
+ AcquireBufferPoolMutex (queue);
+
+ for (buffer = queue->FirstPoolBuffer; ; buffer = buffer->NextBuffer)
+ {
+ if (buffer && buffer->Size == requestedSize)
+ {
+ requestedSizePresentInPool = TRUE;
+
+ if (!buffer->InUse)
+ {
+ // Reuse a free buffer
+ buffer->InUse = TRUE;
+ bufferAddress = buffer->Address;
+ break;
+ }
+ }
+
+ if (!buffer || !buffer->NextBuffer)
+ {
+ EncryptedIoQueueBuffer *newBuffer;
+
+ if (requestedSizePresentInPool && !queue->StartPending)
+ break;
+
+ // Allocate a new buffer
+ newBuffer = TCalloc (sizeof (EncryptedIoQueueBuffer));
+ if (!newBuffer)
+ {
+ bufferAddress = NULL;
+ break;
+ }
+
+ bufferAddress = TCalloc (requestedSize);
+ if (bufferAddress)
+ {
+ newBuffer->NextBuffer = NULL;
+ newBuffer->Address = bufferAddress;
+ newBuffer->Size = requestedSize;
+ newBuffer->InUse = TRUE;
+
+ if (!buffer)
+ queue->FirstPoolBuffer = newBuffer;
+ else
+ buffer->NextBuffer = newBuffer;
+ }
+ else
+ TCfree (newBuffer);
+
+ break;
+ }
+ }
+
+ ReleaseBufferPoolMutex (queue);
+
+ if (bufferAddress || !requestedSizePresentInPool || queue->StartPending)
+ break;
+
+ KeWaitForSingleObject (&queue->PoolBufferFreeEvent, Executive, KernelMode, FALSE, NULL);
+ }
+
+ return bufferAddress;
+}
+
+
+static void ReleasePoolBuffer (EncryptedIoQueue *queue, void *address)
+{
+ EncryptedIoQueueBuffer *buffer;
+ AcquireBufferPoolMutex (queue);
+
+ for (buffer = queue->FirstPoolBuffer; buffer != NULL; buffer = buffer->NextBuffer)
+ {
+ if (buffer->Address == address)
+ {
+ ASSERT (buffer->InUse);
+
+ buffer->InUse = FALSE;
+ break;
+ }
+ }
+
+ ReleaseBufferPoolMutex (queue);
+ KeSetEvent (&queue->PoolBufferFreeEvent, IO_DISK_INCREMENT, FALSE);
+}
+
+
+static void FreePoolBuffers (EncryptedIoQueue *queue)
+{
+ EncryptedIoQueueBuffer *buffer;
+ AcquireBufferPoolMutex (queue);
+
+ for (buffer = queue->FirstPoolBuffer; buffer != NULL; )
+ {
+ EncryptedIoQueueBuffer *nextBuffer = buffer->NextBuffer;
+
+ ASSERT (!buffer->InUse || queue->StartPending);
+
+ TCfree (buffer->Address);
+ TCfree (buffer);
+
+ buffer = nextBuffer;
+ }
+
+ queue->FirstPoolBuffer = NULL;
+ ReleaseBufferPoolMutex (queue);
+}
+
+
+static void DecrementOutstandingIoCount (EncryptedIoQueue *queue)
+{
+ if (InterlockedDecrement (&queue->OutstandingIoCount) == 0 && (queue->SuspendPending || queue->StopPending))
+ KeSetEvent (&queue->NoOutstandingIoEvent, IO_DISK_INCREMENT, FALSE);
+}
+
+
+static void OnItemCompleted (EncryptedIoQueueItem *item, BOOL freeItem)
+{
+ DecrementOutstandingIoCount (item->Queue);
+ IoReleaseRemoveLock (&item->Queue->RemoveLock, item->OriginalIrp);
+
+ if (NT_SUCCESS (item->Status))
+ {
+ if (item->Write)
+ item->Queue->TotalBytesWritten += item->OriginalLength;
+ else
+ item->Queue->TotalBytesRead += item->OriginalLength;
+ }
+
+ if (freeItem)
+ ReleasePoolBuffer (item->Queue, item);
+}
+
+
+static NTSTATUS CompleteOriginalIrp (EncryptedIoQueueItem *item, NTSTATUS status, ULONG_PTR information)
+{
+#ifdef TC_TRACE_IO_QUEUE
+ Dump ("< %I64d [%I64d] %c status=%x info=%I64d\n", item->OriginalIrpOffset, GetElapsedTime (&item->Queue->LastPerformanceCounter), item->Write ? 'W' : 'R', status, (int64) information);
+#endif
+
+ TCCompleteDiskIrp (item->OriginalIrp, status, information);
+
+ item->Status = status;
+ OnItemCompleted (item, TRUE);
+
+ return status;
+}
+
+
+static void AcquireFragmentBuffer (EncryptedIoQueue *queue, byte *buffer)
+{
+ NTSTATUS status = STATUS_INVALID_PARAMETER;
+
+ if (buffer == queue->FragmentBufferA)
+ {
+ status = KeWaitForSingleObject (&queue->FragmentBufferAFreeEvent, Executive, KernelMode, FALSE, NULL);
+ }
+ else if (buffer == queue->FragmentBufferB)
+ {
+ status = KeWaitForSingleObject (&queue->FragmentBufferBFreeEvent, Executive, KernelMode, FALSE, NULL);
+ }
+
+ if (!NT_SUCCESS (status))
+ TC_BUG_CHECK (status);
+}
+
+
+static void ReleaseFragmentBuffer (EncryptedIoQueue *queue, byte *buffer)
+{
+ if (buffer == queue->FragmentBufferA)
+ {
+ KeSetEvent (&queue->FragmentBufferAFreeEvent, IO_DISK_INCREMENT, FALSE);
+ }
+ else if (buffer == queue->FragmentBufferB)
+ {
+ KeSetEvent (&queue->FragmentBufferBFreeEvent, IO_DISK_INCREMENT, FALSE);
+ }
+ else
+ {
+ TC_BUG_CHECK (STATUS_INVALID_PARAMETER);
+ }
+}
+
+
+static VOID CompletionThreadProc (PVOID threadArg)
+{
+ EncryptedIoQueue *queue = (EncryptedIoQueue *) threadArg;
+ PLIST_ENTRY listEntry;
+ EncryptedIoRequest *request;
+ UINT64_STRUCT dataUnit;
+
+ if (IsEncryptionThreadPoolRunning())
+ KeSetPriorityThread (KeGetCurrentThread(), LOW_REALTIME_PRIORITY);
+
+ while (!queue->ThreadExitRequested)
+ {
+ if (!NT_SUCCESS (KeWaitForSingleObject (&queue->CompletionThreadQueueNotEmptyEvent, Executive, KernelMode, FALSE, NULL)))
+ continue;
+
+ if (queue->ThreadExitRequested)
+ break;
+
+ while ((listEntry = ExInterlockedRemoveHeadList (&queue->CompletionThreadQueue, &queue->CompletionThreadQueueLock)))
+ {
+ request = CONTAINING_RECORD (listEntry, EncryptedIoRequest, CompletionListEntry);
+
+ if (request->EncryptedLength > 0 && NT_SUCCESS (request->Item->Status))
+ {
+ ASSERT (request->EncryptedOffset + request->EncryptedLength <= request->Offset.QuadPart + request->Length);
+ dataUnit.Value = (request->Offset.QuadPart + request->EncryptedOffset) / ENCRYPTION_DATA_UNIT_SIZE;
+
+ if (queue->CryptoInfo->bPartitionInInactiveSysEncScope)
+ dataUnit.Value += queue->CryptoInfo->FirstDataUnitNo.Value;
+ else if (queue->RemapEncryptedArea)
+ dataUnit.Value += queue->RemappedAreaDataUnitOffset;
+
+ DecryptDataUnits (request->Data + request->EncryptedOffset, &dataUnit, request->EncryptedLength / ENCRYPTION_DATA_UNIT_SIZE, queue->CryptoInfo);
+ }
+
+ if (request->CompleteOriginalIrp)
+ {
+ CompleteOriginalIrp (request->Item, request->Item->Status,
+ NT_SUCCESS (request->Item->Status) ? request->Item->OriginalLength : 0);
+ }
+
+ ReleasePoolBuffer (queue, request);
+ }
+ }
+
+ PsTerminateSystemThread (STATUS_SUCCESS);
+}
+
+
+static NTSTATUS TCCachedRead (EncryptedIoQueue *queue, IO_STATUS_BLOCK *ioStatus, PVOID buffer, LARGE_INTEGER offset, ULONG length)
+{
+ queue->LastReadOffset = offset;
+ queue->LastReadLength = length;
+
+ if (queue->ReadAheadBufferValid && queue->ReadAheadOffset.QuadPart == offset.QuadPart && queue->ReadAheadLength >= length)
+ {
+ memcpy (buffer, queue->ReadAheadBuffer, length);
+
+ if (!queue->IsFilterDevice)
+ {
+ ioStatus->Information = length;
+ ioStatus->Status = STATUS_SUCCESS;
+ }
+
+ return STATUS_SUCCESS;
+ }
+
+ if (queue->IsFilterDevice)
+ return TCReadDevice (queue->LowerDeviceObject, buffer, offset, length);
+
+ return ZwReadFile (queue->HostFileHandle, NULL, NULL, NULL, ioStatus, buffer, length, &offset, NULL);
+}
+
+
+static VOID IoThreadProc (PVOID threadArg)
+{
+ EncryptedIoQueue *queue = (EncryptedIoQueue *) threadArg;
+ PLIST_ENTRY listEntry;
+ EncryptedIoRequest *request;
+
+ KeSetPriorityThread (KeGetCurrentThread(), LOW_REALTIME_PRIORITY);
+
+ if (!queue->IsFilterDevice && queue->SecurityClientContext)
+ {
+#ifdef DEBUG
+ NTSTATUS status =
+#endif
+ SeImpersonateClientEx (queue->SecurityClientContext, NULL);
+ ASSERT (NT_SUCCESS (status));
+ }
+
+ while (!queue->ThreadExitRequested)
+ {
+ if (!NT_SUCCESS (KeWaitForSingleObject (&queue->IoThreadQueueNotEmptyEvent, Executive, KernelMode, FALSE, NULL)))
+ continue;
+
+ if (queue->ThreadExitRequested)
+ break;
+
+ while ((listEntry = ExInterlockedRemoveHeadList (&queue->IoThreadQueue, &queue->IoThreadQueueLock)))
+ {
+ InterlockedDecrement (&queue->IoThreadPendingRequestCount);
+ request = CONTAINING_RECORD (listEntry, EncryptedIoRequest, ListEntry);
+
+#ifdef TC_TRACE_IO_QUEUE
+ Dump ("%c %I64d [%I64d] roff=%I64d rlen=%d\n", request->Item->Write ? 'W' : 'R', request->Item->OriginalIrpOffset.QuadPart, GetElapsedTime (&queue->LastPerformanceCounter), request->Offset.QuadPart, request->Length);
+#endif
+
+ // Perform IO request if no preceding request of the item failed
+ if (NT_SUCCESS (request->Item->Status))
+ {
+ if (queue->IsFilterDevice)
+ {
+ if (queue->RemapEncryptedArea && request->EncryptedLength > 0)
+ {
+ if (request->EncryptedLength != request->Length)
+ {
+ // Up to three subfragments may be required to handle a partially remapped fragment
+ int subFragment;
+ byte *subFragmentData = request->Data;
+
+ for (subFragment = 0 ; subFragment < 3; ++subFragment)
+ {
+ LARGE_INTEGER subFragmentOffset;
+ ULONG subFragmentLength;
+ subFragmentOffset.QuadPart = request->Offset.QuadPart;
+
+ switch (subFragment)
+ {
+ case 0:
+ subFragmentLength = (ULONG) request->EncryptedOffset;
+ break;
+
+ case 1:
+ subFragmentOffset.QuadPart += request->EncryptedOffset + queue->RemappedAreaOffset;
+ subFragmentLength = request->EncryptedLength;
+ break;
+
+ case 2:
+ subFragmentOffset.QuadPart += request->EncryptedOffset + request->EncryptedLength;
+ subFragmentLength = (ULONG) (request->Length - (request->EncryptedOffset + request->EncryptedLength));
+ break;
+ }
+
+ if (subFragmentLength > 0)
+ {
+ if (request->Item->Write)
+ request->Item->Status = TCWriteDevice (queue->LowerDeviceObject, subFragmentData, subFragmentOffset, subFragmentLength);
+ else
+ request->Item->Status = TCCachedRead (queue, NULL, subFragmentData, subFragmentOffset, subFragmentLength);
+
+ subFragmentData += subFragmentLength;
+ }
+ }
+ }
+ else
+ {
+ // Remap the fragment
+ LARGE_INTEGER remappedOffset;
+ remappedOffset.QuadPart = request->Offset.QuadPart + queue->RemappedAreaOffset;
+
+ if (request->Item->Write)
+ request->Item->Status = TCWriteDevice (queue->LowerDeviceObject, request->Data, remappedOffset, request->Length);
+ else
+ request->Item->Status = TCCachedRead (queue, NULL, request->Data, remappedOffset, request->Length);
+ }
+ }
+ else
+ {
+ if (request->Item->Write)
+ request->Item->Status = TCWriteDevice (queue->LowerDeviceObject, request->Data, request->Offset, request->Length);
+ else
+ request->Item->Status = TCCachedRead (queue, NULL, request->Data, request->Offset, request->Length);
+ }
+ }
+ else
+ {
+ IO_STATUS_BLOCK ioStatus;
+
+ if (request->Item->Write)
+ request->Item->Status = ZwWriteFile (queue->HostFileHandle, NULL, NULL, NULL, &ioStatus, request->Data, request->Length, &request->Offset, NULL);
+ else
+ request->Item->Status = TCCachedRead (queue, &ioStatus, request->Data, request->Offset, request->Length);
+
+ if (NT_SUCCESS (request->Item->Status) && ioStatus.Information != request->Length)
+ request->Item->Status = STATUS_END_OF_FILE;
+ }
+ }
+
+ if (request->Item->Write)
+ {
+ queue->ReadAheadBufferValid = FALSE;
+
+ ReleaseFragmentBuffer (queue, request->Data);
+
+ if (request->CompleteOriginalIrp)
+ {
+ CompleteOriginalIrp (request->Item, request->Item->Status,
+ NT_SUCCESS (request->Item->Status) ? request->Item->OriginalLength : 0);
+ }
+
+ ReleasePoolBuffer (queue, request);
+ }
+ else
+ {
+ BOOL readAhead = FALSE;
+
+ if (NT_SUCCESS (request->Item->Status))
+ memcpy (request->OrigDataBufferFragment, request->Data, request->Length);
+
+ ReleaseFragmentBuffer (queue, request->Data);
+ request->Data = request->OrigDataBufferFragment;
+
+ if (request->CompleteOriginalIrp
+ && queue->LastReadLength > 0
+ && NT_SUCCESS (request->Item->Status)
+ && InterlockedExchangeAdd (&queue->IoThreadPendingRequestCount, 0) == 0)
+ {
+ readAhead = TRUE;
+ InterlockedIncrement (&queue->OutstandingIoCount);
+ }
+
+ ExInterlockedInsertTailList (&queue->CompletionThreadQueue, &request->CompletionListEntry, &queue->CompletionThreadQueueLock);
+ KeSetEvent (&queue->CompletionThreadQueueNotEmptyEvent, IO_DISK_INCREMENT, FALSE);
+
+ if (readAhead)
+ {
+ queue->ReadAheadBufferValid = FALSE;
+ queue->ReadAheadOffset.QuadPart = queue->LastReadOffset.QuadPart + queue->LastReadLength;
+ queue->ReadAheadLength = queue->LastReadLength;
+
+ if (queue->ReadAheadOffset.QuadPart + queue->ReadAheadLength <= queue->MaxReadAheadOffset.QuadPart)
+ {
+#ifdef TC_TRACE_IO_QUEUE
+ Dump ("A %I64d [%I64d] roff=%I64d rlen=%d\n", request->Item->OriginalIrpOffset.QuadPart, GetElapsedTime (&queue->LastPerformanceCounter), queue->ReadAheadOffset, queue->ReadAheadLength);
+#endif
+ if (queue->IsFilterDevice)
+ {
+ queue->ReadAheadBufferValid = NT_SUCCESS (TCReadDevice (queue->LowerDeviceObject, queue->ReadAheadBuffer, queue->ReadAheadOffset, queue->ReadAheadLength));
+ }
+ else
+ {
+ IO_STATUS_BLOCK ioStatus;
+ queue->ReadAheadBufferValid = NT_SUCCESS (ZwReadFile (queue->HostFileHandle, NULL, NULL, NULL, &ioStatus, queue->ReadAheadBuffer, queue->ReadAheadLength, &queue->ReadAheadOffset, NULL));
+ queue->ReadAheadLength = (ULONG) ioStatus.Information;
+ }
+ }
+
+ DecrementOutstandingIoCount (queue);
+ }
+ }
+ }
+ }
+
+ PsTerminateSystemThread (STATUS_SUCCESS);
+}
+
+
+static VOID MainThreadProc (PVOID threadArg)
+{
+ EncryptedIoQueue *queue = (EncryptedIoQueue *) threadArg;
+ PLIST_ENTRY listEntry;
+ EncryptedIoQueueItem *item;
+
+ LARGE_INTEGER fragmentOffset;
+ ULONG dataRemaining;
+ PUCHAR activeFragmentBuffer = queue->FragmentBufferA;
+ PUCHAR dataBuffer;
+ EncryptedIoRequest *request;
+ uint64 intersectStart;
+ uint32 intersectLength;
+
+ if (IsEncryptionThreadPoolRunning())
+ KeSetPriorityThread (KeGetCurrentThread(), LOW_REALTIME_PRIORITY);
+
+ while (!queue->ThreadExitRequested)
+ {
+ if (!NT_SUCCESS (KeWaitForSingleObject (&queue->MainThreadQueueNotEmptyEvent, Executive, KernelMode, FALSE, NULL)))
+ continue;
+
+ while ((listEntry = ExInterlockedRemoveHeadList (&queue->MainThreadQueue, &queue->MainThreadQueueLock)))
+ {
+ PIRP irp = CONTAINING_RECORD (listEntry, IRP, Tail.Overlay.ListEntry);
+ PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (irp);
+
+ if (queue->Suspended)
+ KeWaitForSingleObject (&queue->QueueResumedEvent, Executive, KernelMode, FALSE, NULL);
+
+ item = GetPoolBuffer (queue, sizeof (EncryptedIoQueueItem));
+ item->Queue = queue;
+ item->OriginalIrp = irp;
+ item->Status = STATUS_SUCCESS;
+
+ IoSetCancelRoutine (irp, NULL);
+ if (irp->Cancel)
+ {
+ CompleteOriginalIrp (item, STATUS_CANCELLED, 0);
+ continue;
+ }
+
+ switch (irpSp->MajorFunction)
+ {
+ case IRP_MJ_READ:
+ item->Write = FALSE;
+ item->OriginalOffset = irpSp->Parameters.Read.ByteOffset;
+ item->OriginalLength = irpSp->Parameters.Read.Length;
+ break;
+
+ case IRP_MJ_WRITE:
+ item->Write = TRUE;
+ item->OriginalOffset = irpSp->Parameters.Write.ByteOffset;
+ item->OriginalLength = irpSp->Parameters.Write.Length;
+ break;
+
+ default:
+ CompleteOriginalIrp (item, STATUS_INVALID_PARAMETER, 0);
+ continue;
+ }
+
+#ifdef TC_TRACE_IO_QUEUE
+ item->OriginalIrpOffset = item->OriginalOffset;
+#endif
+
+ // Handle misaligned read operations to work around a bug in Windows System Assessment Tool which does not follow FILE_FLAG_NO_BUFFERING requirements when benchmarking disk devices
+ if (queue->IsFilterDevice
+ && !item->Write
+ && item->OriginalLength > 0
+ && (item->OriginalLength & (ENCRYPTION_DATA_UNIT_SIZE - 1)) == 0
+ && (item->OriginalOffset.QuadPart & (ENCRYPTION_DATA_UNIT_SIZE - 1)) != 0)
+ {
+ byte *buffer;
+ ULONG alignedLength = item->OriginalLength + ENCRYPTION_DATA_UNIT_SIZE;
+ LARGE_INTEGER alignedOffset;
+ alignedOffset.QuadPart = item->OriginalOffset.QuadPart & ~((LONGLONG) ENCRYPTION_DATA_UNIT_SIZE - 1);
+
+ buffer = TCalloc (alignedLength);
+ if (!buffer)
+ {
+ CompleteOriginalIrp (item, STATUS_INSUFFICIENT_RESOURCES, 0);
+ continue;
+ }
+
+ item->Status = TCReadDevice (queue->LowerDeviceObject, buffer, alignedOffset, alignedLength);
+
+ if (NT_SUCCESS (item->Status))
+ {
+ UINT64_STRUCT dataUnit;
+
+ dataBuffer = (PUCHAR) MmGetSystemAddressForMdlSafe (irp->MdlAddress, HighPagePriority);
+ if (!dataBuffer)
+ {
+ TCfree (buffer);
+ CompleteOriginalIrp (item, STATUS_INSUFFICIENT_RESOURCES, 0);
+ continue;
+ }
+
+ if (queue->EncryptedAreaStart != -1 && queue->EncryptedAreaEnd != -1)
+ {
+ GetIntersection (alignedOffset.QuadPart, alignedLength, queue->EncryptedAreaStart, queue->EncryptedAreaEnd, &intersectStart, &intersectLength);
+ if (intersectLength > 0)
+ {
+ dataUnit.Value = intersectStart / ENCRYPTION_DATA_UNIT_SIZE;
+ DecryptDataUnits (buffer + (intersectStart - alignedOffset.QuadPart), &dataUnit, intersectLength / ENCRYPTION_DATA_UNIT_SIZE, queue->CryptoInfo);
+ }
+ }
+
+ memcpy (dataBuffer, buffer + (item->OriginalOffset.LowPart & (ENCRYPTION_DATA_UNIT_SIZE - 1)), item->OriginalLength);
+ }
+
+ TCfree (buffer);
+ CompleteOriginalIrp (item, item->Status, NT_SUCCESS (item->Status) ? item->OriginalLength : 0);
+ continue;
+ }
+
+ // Validate offset and length
+ if (item->OriginalLength == 0
+ || (item->OriginalLength & (ENCRYPTION_DATA_UNIT_SIZE - 1)) != 0
+ || (item->OriginalOffset.QuadPart & (ENCRYPTION_DATA_UNIT_SIZE - 1)) != 0
+ || (!queue->IsFilterDevice && item->OriginalOffset.QuadPart + item->OriginalLength > queue->VirtualDeviceLength))
+ {
+ CompleteOriginalIrp (item, STATUS_INVALID_PARAMETER, 0);
+ continue;
+ }
+
+#ifdef TC_TRACE_IO_QUEUE
+ Dump ("Q %I64d [%I64d] %c len=%d\n", item->OriginalOffset.QuadPart, GetElapsedTime (&queue->LastPerformanceCounter), item->Write ? 'W' : 'R', item->OriginalLength);
+#endif
+
+ if (!queue->IsFilterDevice)
+ {
+ // Adjust the offset for host file or device
+ if (queue->CryptoInfo->hiddenVolume)
+ item->OriginalOffset.QuadPart += queue->CryptoInfo->hiddenVolumeOffset;
+ else
+ item->OriginalOffset.QuadPart += queue->CryptoInfo->volDataAreaOffset;
+
+ // Hidden volume protection
+ if (item->Write && queue->CryptoInfo->bProtectHiddenVolume)
+ {
+ // If there has already been a write operation denied in order to protect the
+ // hidden volume (since the volume mount time)
+ if (queue->CryptoInfo->bHiddenVolProtectionAction)
+ {
+ // Do not allow writing to this volume anymore. This is to fake a complete volume
+ // or system failure (otherwise certain kinds of inconsistency within the file
+ // system could indicate that this volume has used hidden volume protection).
+ CompleteOriginalIrp (item, STATUS_INVALID_PARAMETER, 0);
+ continue;
+ }
+
+ // Verify that no byte is going to be written to the hidden volume area
+ if (RegionsOverlap ((unsigned __int64) item->OriginalOffset.QuadPart,
+ (unsigned __int64) item->OriginalOffset.QuadPart + item->OriginalLength - 1,
+ queue->CryptoInfo->hiddenVolumeOffset,
+ (unsigned __int64) queue->CryptoInfo->hiddenVolumeOffset + queue->CryptoInfo->hiddenVolumeProtectedSize - 1))
+ {
+ Dump ("Hidden volume protection triggered: write %I64d-%I64d (protected %I64d-%I64d)\n", item->OriginalOffset.QuadPart, item->OriginalOffset.QuadPart + item->OriginalLength - 1, queue->CryptoInfo->hiddenVolumeOffset, queue->CryptoInfo->hiddenVolumeOffset + queue->CryptoInfo->hiddenVolumeProtectedSize - 1);
+ queue->CryptoInfo->bHiddenVolProtectionAction = TRUE;
+
+ // Deny this write operation to prevent the hidden volume from being overwritten
+ CompleteOriginalIrp (item, STATUS_INVALID_PARAMETER, 0);
+ continue;
+ }
+ }
+ }
+ else if (item->Write
+ && RegionsOverlap (item->OriginalOffset.QuadPart, item->OriginalOffset.QuadPart + item->OriginalLength - 1, TC_BOOT_VOLUME_HEADER_SECTOR_OFFSET, TC_BOOT_VOLUME_HEADER_SECTOR_OFFSET + TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE - 1))
+ {
+ // Prevent inappropriately designed software from damaging important data that may be out of sync with the backup on the Rescue Disk (such as the end of the encrypted area).
+ Dump ("Preventing write to the system encryption key data area\n");
+ CompleteOriginalIrp (item, STATUS_MEDIA_WRITE_PROTECTED, 0);
+ continue;
+ }
+ else if (item->Write && IsHiddenSystemRunning()
+ && (RegionsOverlap (item->OriginalOffset.QuadPart, item->OriginalOffset.QuadPart + item->OriginalLength - 1, TC_SECTOR_SIZE_BIOS, TC_BOOT_LOADER_AREA_SECTOR_COUNT * TC_SECTOR_SIZE_BIOS - 1)
+ || RegionsOverlap (item->OriginalOffset.QuadPart, item->OriginalOffset.QuadPart + item->OriginalLength - 1, GetBootDriveLength(), _I64_MAX)))
+ {
+ Dump ("Preventing write to boot loader or host protected area\n");
+ CompleteOriginalIrp (item, STATUS_MEDIA_WRITE_PROTECTED, 0);
+ continue;
+ }
+
+ dataBuffer = (PUCHAR) MmGetSystemAddressForMdlSafe (irp->MdlAddress, HighPagePriority);
+
+ if (dataBuffer == NULL)
+ {
+ CompleteOriginalIrp (item, STATUS_INSUFFICIENT_RESOURCES, 0);
+ continue;
+ }
+
+ // Divide data block to fragments to enable efficient overlapping of encryption and IO operations
+
+ dataRemaining = item->OriginalLength;
+ fragmentOffset = item->OriginalOffset;
+
+ while (dataRemaining > 0)
+ {
+ BOOL isLastFragment = dataRemaining <= TC_ENC_IO_QUEUE_MAX_FRAGMENT_SIZE;
+
+ ULONG dataFragmentLength = isLastFragment ? dataRemaining : TC_ENC_IO_QUEUE_MAX_FRAGMENT_SIZE;
+ activeFragmentBuffer = (activeFragmentBuffer == queue->FragmentBufferA ? queue->FragmentBufferB : queue->FragmentBufferA);
+
+ InterlockedIncrement (&queue->IoThreadPendingRequestCount);
+
+ // Create IO request
+ request = GetPoolBuffer (queue, sizeof (EncryptedIoRequest));
+ request->Item = item;
+ request->CompleteOriginalIrp = isLastFragment;
+ request->Offset = fragmentOffset;
+ request->Data = activeFragmentBuffer;
+ request->OrigDataBufferFragment = dataBuffer;
+ request->Length = dataFragmentLength;
+
+ if (queue->IsFilterDevice)
+ {
+ if (queue->EncryptedAreaStart == -1 || queue->EncryptedAreaEnd == -1)
+ {
+ request->EncryptedLength = 0;
+ }
+ else
+ {
+ // Get intersection of data fragment with encrypted area
+ GetIntersection (fragmentOffset.QuadPart, dataFragmentLength, queue->EncryptedAreaStart, queue->EncryptedAreaEnd, &intersectStart, &intersectLength);
+
+ request->EncryptedOffset = intersectStart - fragmentOffset.QuadPart;
+ request->EncryptedLength = intersectLength;
+ }
+ }
+ else
+ {
+ request->EncryptedOffset = 0;
+ request->EncryptedLength = dataFragmentLength;
+ }
+
+ AcquireFragmentBuffer (queue, activeFragmentBuffer);
+
+ if (item->Write)
+ {
+ // Encrypt data
+ memcpy (activeFragmentBuffer, dataBuffer, dataFragmentLength);
+
+ if (request->EncryptedLength > 0)
+ {
+ UINT64_STRUCT dataUnit;
+ ASSERT (request->EncryptedOffset + request->EncryptedLength <= request->Offset.QuadPart + request->Length);
+
+ dataUnit.Value = (request->Offset.QuadPart + request->EncryptedOffset) / ENCRYPTION_DATA_UNIT_SIZE;
+
+ if (queue->CryptoInfo->bPartitionInInactiveSysEncScope)
+ dataUnit.Value += queue->CryptoInfo->FirstDataUnitNo.Value;
+ else if (queue->RemapEncryptedArea)
+ dataUnit.Value += queue->RemappedAreaDataUnitOffset;
+
+ EncryptDataUnits (activeFragmentBuffer + request->EncryptedOffset, &dataUnit, request->EncryptedLength / ENCRYPTION_DATA_UNIT_SIZE, queue->CryptoInfo);
+ }
+ }
+
+ // Queue IO request
+ ExInterlockedInsertTailList (&queue->IoThreadQueue, &request->ListEntry, &queue->IoThreadQueueLock);
+ KeSetEvent (&queue->IoThreadQueueNotEmptyEvent, IO_DISK_INCREMENT, FALSE);
+
+ if (isLastFragment)
+ break;
+
+ dataRemaining -= TC_ENC_IO_QUEUE_MAX_FRAGMENT_SIZE;
+ dataBuffer += TC_ENC_IO_QUEUE_MAX_FRAGMENT_SIZE;
+ fragmentOffset.QuadPart += TC_ENC_IO_QUEUE_MAX_FRAGMENT_SIZE;
+ }
+ }
+ }
+
+ PsTerminateSystemThread (STATUS_SUCCESS);
+}
+
+
+NTSTATUS EncryptedIoQueueAddIrp (EncryptedIoQueue *queue, PIRP irp)
+{
+ NTSTATUS status;
+
+ InterlockedIncrement (&queue->OutstandingIoCount);
+ if (queue->StopPending)
+ {
+ Dump ("STATUS_DEVICE_NOT_READY out=%d\n", queue->OutstandingIoCount);
+ status = STATUS_DEVICE_NOT_READY;
+ goto err;
+ }
+
+ status = IoAcquireRemoveLock (&queue->RemoveLock, irp);
+ if (!NT_SUCCESS (status))
+ goto err;
+
+#ifdef TC_TRACE_IO_QUEUE
+ {
+ PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (irp);
+ Dump ("* %I64d [%I64d] %c len=%d out=%d\n", irpSp->MajorFunction == IRP_MJ_WRITE ? irpSp->Parameters.Write.ByteOffset : irpSp->Parameters.Read.ByteOffset, GetElapsedTime (&queue->LastPerformanceCounter), irpSp->MajorFunction == IRP_MJ_WRITE ? 'W' : 'R', irpSp->MajorFunction == IRP_MJ_WRITE ? irpSp->Parameters.Write.Length : irpSp->Parameters.Read.Length, queue->OutstandingIoCount);
+ }
+#endif
+
+ IoMarkIrpPending (irp);
+
+ ExInterlockedInsertTailList (&queue->MainThreadQueue, &irp->Tail.Overlay.ListEntry, &queue->MainThreadQueueLock);
+ KeSetEvent (&queue->MainThreadQueueNotEmptyEvent, IO_DISK_INCREMENT, FALSE);
+
+ return STATUS_PENDING;
+
+err:
+ DecrementOutstandingIoCount (queue);
+ return status;
+}
+
+
+NTSTATUS EncryptedIoQueueHoldWhenIdle (EncryptedIoQueue *queue, int64 timeout)
+{
+ NTSTATUS status;
+ ASSERT (!queue->Suspended);
+
+ queue->SuspendPending = TRUE;
+
+ while (TRUE)
+ {
+ while (InterlockedExchangeAdd (&queue->OutstandingIoCount, 0) > 0)
+ {
+ LARGE_INTEGER waitTimeout;
+
+ waitTimeout.QuadPart = timeout * -10000;
+ status = KeWaitForSingleObject (&queue->NoOutstandingIoEvent, Executive, KernelMode, FALSE, timeout != 0 ? &waitTimeout : NULL);
+
+ if (status == STATUS_TIMEOUT)
+ status = STATUS_UNSUCCESSFUL;
+
+ if (!NT_SUCCESS (status))
+ {
+ queue->SuspendPending = FALSE;
+ return status;
+ }
+
+ TCSleep (1);
+ if (InterlockedExchangeAdd (&queue->OutstandingIoCount, 0) > 0)
+ {
+ queue->SuspendPending = FALSE;
+ return STATUS_UNSUCCESSFUL;
+ }
+ }
+
+ KeClearEvent (&queue->QueueResumedEvent);
+ queue->Suspended = TRUE;
+
+ if (InterlockedExchangeAdd (&queue->OutstandingIoCount, 0) == 0)
+ break;
+
+ queue->Suspended = FALSE;
+ KeSetEvent (&queue->QueueResumedEvent, IO_DISK_INCREMENT, FALSE);
+ }
+
+ queue->ReadAheadBufferValid = FALSE;
+
+ queue->SuspendPending = FALSE;
+ return STATUS_SUCCESS;
+}
+
+
+BOOL EncryptedIoQueueIsSuspended (EncryptedIoQueue *queue)
+{
+ return queue->Suspended;
+}
+
+
+BOOL EncryptedIoQueueIsRunning (EncryptedIoQueue *queue)
+{
+ return !queue->StopPending;
+}
+
+
+NTSTATUS EncryptedIoQueueResumeFromHold (EncryptedIoQueue *queue)
+{
+ ASSERT (queue->Suspended);
+
+ queue->Suspended = FALSE;
+ KeSetEvent (&queue->QueueResumedEvent, IO_DISK_INCREMENT, FALSE);
+
+ return STATUS_SUCCESS;
+}
+
+
+NTSTATUS EncryptedIoQueueStart (EncryptedIoQueue *queue)
+{
+ NTSTATUS status;
+ EncryptedIoQueueBuffer *buffer;
+ int i;
+
+ queue->StartPending = TRUE;
+ queue->ThreadExitRequested = FALSE;
+
+ queue->OutstandingIoCount = 0;
+ queue->IoThreadPendingRequestCount = 0;
+
+ queue->FirstPoolBuffer = NULL;
+ KeInitializeMutex (&queue->BufferPoolMutex, 0);
+
+ KeInitializeEvent (&queue->NoOutstandingIoEvent, SynchronizationEvent, FALSE);
+ KeInitializeEvent (&queue->PoolBufferFreeEvent, SynchronizationEvent, FALSE);
+ KeInitializeEvent (&queue->QueueResumedEvent, SynchronizationEvent, FALSE);
+
+ queue->FragmentBufferA = TCalloc (TC_ENC_IO_QUEUE_MAX_FRAGMENT_SIZE);
+ if (!queue->FragmentBufferA)
+ goto noMemory;
+
+ queue->FragmentBufferB = TCalloc (TC_ENC_IO_QUEUE_MAX_FRAGMENT_SIZE);
+ if (!queue->FragmentBufferB)
+ goto noMemory;
+
+ KeInitializeEvent (&queue->FragmentBufferAFreeEvent, SynchronizationEvent, TRUE);
+ KeInitializeEvent (&queue->FragmentBufferBFreeEvent, SynchronizationEvent, TRUE);
+
+ queue->ReadAheadBufferValid = FALSE;
+ queue->ReadAheadBuffer = TCalloc (TC_ENC_IO_QUEUE_MAX_FRAGMENT_SIZE);
+ if (!queue->ReadAheadBuffer)
+ goto noMemory;
+
+ // Preallocate buffers
+ for (i = 0; i < TC_ENC_IO_QUEUE_PREALLOCATED_IO_REQUEST_COUNT; ++i)
+ {
+ if (i < TC_ENC_IO_QUEUE_PREALLOCATED_ITEM_COUNT && !GetPoolBuffer (queue, sizeof (EncryptedIoQueueItem)))
+ goto noMemory;
+
+ if (!GetPoolBuffer (queue, sizeof (EncryptedIoRequest)))
+ goto noMemory;
+ }
+
+ for (buffer = queue->FirstPoolBuffer; buffer != NULL; buffer = buffer->NextBuffer)
+ {
+ buffer->InUse = FALSE;
+ }
+
+ // Main thread
+ InitializeListHead (&queue->MainThreadQueue);
+ KeInitializeSpinLock (&queue->MainThreadQueueLock);
+ KeInitializeEvent (&queue->MainThreadQueueNotEmptyEvent, SynchronizationEvent, FALSE);
+
+ status = TCStartThread (MainThreadProc, queue, &queue->MainThread);
+ if (!NT_SUCCESS (status))
+ goto err;
+
+ // IO thread
+ InitializeListHead (&queue->IoThreadQueue);
+ KeInitializeSpinLock (&queue->IoThreadQueueLock);
+ KeInitializeEvent (&queue->IoThreadQueueNotEmptyEvent, SynchronizationEvent, FALSE);
+
+ status = TCStartThread (IoThreadProc, queue, &queue->IoThread);
+ if (!NT_SUCCESS (status))
+ {
+ queue->ThreadExitRequested = TRUE;
+ TCStopThread (queue->MainThread, &queue->MainThreadQueueNotEmptyEvent);
+ goto err;
+ }
+
+ // Completion thread
+ InitializeListHead (&queue->CompletionThreadQueue);
+ KeInitializeSpinLock (&queue->CompletionThreadQueueLock);
+ KeInitializeEvent (&queue->CompletionThreadQueueNotEmptyEvent, SynchronizationEvent, FALSE);
+
+ status = TCStartThread (CompletionThreadProc, queue, &queue->CompletionThread);
+ if (!NT_SUCCESS (status))
+ {
+ queue->ThreadExitRequested = TRUE;
+ TCStopThread (queue->MainThread, &queue->MainThreadQueueNotEmptyEvent);
+ TCStopThread (queue->IoThread, &queue->IoThreadQueueNotEmptyEvent);
+ goto err;
+ }
+
+#ifdef TC_TRACE_IO_QUEUE
+ GetElapsedTimeInit (&queue->LastPerformanceCounter);
+#endif
+
+ queue->StopPending = FALSE;
+ queue->StartPending = FALSE;
+
+ Dump ("Queue started\n");
+ return STATUS_SUCCESS;
+
+noMemory:
+ status = STATUS_INSUFFICIENT_RESOURCES;
+
+err:
+ if (queue->FragmentBufferA)
+ TCfree (queue->FragmentBufferA);
+ if (queue->FragmentBufferB)
+ TCfree (queue->FragmentBufferB);
+ if (queue->ReadAheadBuffer)
+ TCfree (queue->ReadAheadBuffer);
+
+ FreePoolBuffers (queue);
+
+ queue->StartPending = FALSE;
+ return status;
+}
+
+
+NTSTATUS EncryptedIoQueueStop (EncryptedIoQueue *queue)
+{
+ ASSERT (!queue->StopPending);
+ queue->StopPending = TRUE;
+
+ while (InterlockedExchangeAdd (&queue->OutstandingIoCount, 0) > 0)
+ {
+ KeWaitForSingleObject (&queue->NoOutstandingIoEvent, Executive, KernelMode, FALSE, NULL);
+ }
+
+ Dump ("Queue stopping out=%d\n", queue->OutstandingIoCount);
+
+ queue->ThreadExitRequested = TRUE;
+
+ TCStopThread (queue->MainThread, &queue->MainThreadQueueNotEmptyEvent);
+ TCStopThread (queue->IoThread, &queue->IoThreadQueueNotEmptyEvent);
+ TCStopThread (queue->CompletionThread, &queue->CompletionThreadQueueNotEmptyEvent);
+
+ TCfree (queue->FragmentBufferA);
+ TCfree (queue->FragmentBufferB);
+ TCfree (queue->ReadAheadBuffer);
+
+ FreePoolBuffers (queue);
+
+ Dump ("Queue stopped out=%d\n", queue->OutstandingIoCount);
+ return STATUS_SUCCESS;
+}
diff --git a/src/Driver/EncryptedIoQueue.h b/src/Driver/EncryptedIoQueue.h
new file mode 100644
index 00000000..b6e2e64e
--- /dev/null
+++ b/src/Driver/EncryptedIoQueue.h
@@ -0,0 +1,161 @@
+/*
+ Copyright (c) 2008-2009 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_DRIVER_ENCRYPTED_IO_QUEUE
+#define TC_HEADER_DRIVER_ENCRYPTED_IO_QUEUE
+
+#include "TCdefs.h"
+#include "Apidrvr.h"
+
+#if 0
+# define TC_TRACE_IO_QUEUE
+#endif
+
+#define TC_ENC_IO_QUEUE_MAX_FRAGMENT_SIZE (256 * 1024)
+
+#define TC_ENC_IO_QUEUE_PREALLOCATED_ITEM_COUNT 8
+#define TC_ENC_IO_QUEUE_PREALLOCATED_IO_REQUEST_COUNT 16
+
+
+typedef struct EncryptedIoQueueBufferStruct
+{
+ struct EncryptedIoQueueBufferStruct *NextBuffer;
+
+ void *Address;
+ ULONG Size;
+ BOOL InUse;
+
+} EncryptedIoQueueBuffer;
+
+
+typedef struct
+{
+ PDEVICE_OBJECT DeviceObject;
+
+ KMUTEX BufferPoolMutex;
+ EncryptedIoQueueBuffer *FirstPoolBuffer;
+
+ CRYPTO_INFO *CryptoInfo;
+
+ // File-handle-based IO
+ HANDLE HostFileHandle;
+ int64 VirtualDeviceLength;
+ SECURITY_CLIENT_CONTEXT *SecurityClientContext;
+
+ // Filter device
+ BOOL IsFilterDevice;
+ PDEVICE_OBJECT LowerDeviceObject;
+ int64 EncryptedAreaStart;
+ volatile int64 EncryptedAreaEnd;
+ volatile BOOL EncryptedAreaEndUpdatePending;
+ BOOL RemapEncryptedArea;
+ int64 RemappedAreaOffset;
+ int64 RemappedAreaDataUnitOffset;
+ IO_REMOVE_LOCK RemoveLock;
+
+ // Main tread
+ PKTHREAD MainThread;
+ LIST_ENTRY MainThreadQueue;
+ KSPIN_LOCK MainThreadQueueLock;
+ KEVENT MainThreadQueueNotEmptyEvent;
+
+ // IO thread
+ PKTHREAD IoThread;
+ LIST_ENTRY IoThreadQueue;
+ KSPIN_LOCK IoThreadQueueLock;
+ KEVENT IoThreadQueueNotEmptyEvent;
+
+ // Completion thread
+ PKTHREAD CompletionThread;
+ LIST_ENTRY CompletionThreadQueue;
+ KSPIN_LOCK CompletionThreadQueueLock;
+ KEVENT CompletionThreadQueueNotEmptyEvent;
+
+ // Fragment buffers
+ byte *FragmentBufferA;
+ byte *FragmentBufferB;
+ KEVENT FragmentBufferAFreeEvent;
+ KEVENT FragmentBufferBFreeEvent;
+
+ // Read-ahead buffer
+ BOOL ReadAheadBufferValid;
+ LARGE_INTEGER LastReadOffset;
+ ULONG LastReadLength;
+ LARGE_INTEGER ReadAheadOffset;
+ ULONG ReadAheadLength;
+ byte *ReadAheadBuffer;
+ LARGE_INTEGER MaxReadAheadOffset;
+
+ LONG OutstandingIoCount;
+ KEVENT NoOutstandingIoEvent;
+ LONG IoThreadPendingRequestCount;
+
+ KEVENT PoolBufferFreeEvent;
+
+ __int64 TotalBytesRead;
+ __int64 TotalBytesWritten;
+
+ volatile BOOL StartPending;
+ volatile BOOL ThreadExitRequested;
+
+ volatile BOOL Suspended;
+ volatile BOOL SuspendPending;
+ volatile BOOL StopPending;
+
+ KEVENT QueueResumedEvent;
+
+#ifdef TC_TRACE_IO_QUEUE
+ LARGE_INTEGER LastPerformanceCounter;
+#endif
+
+} EncryptedIoQueue;
+
+
+typedef struct
+{
+ EncryptedIoQueue *Queue;
+ PIRP OriginalIrp;
+ BOOL Write;
+ ULONG OriginalLength;
+ LARGE_INTEGER OriginalOffset;
+ NTSTATUS Status;
+
+#ifdef TC_TRACE_IO_QUEUE
+ LARGE_INTEGER OriginalIrpOffset;
+#endif
+
+} EncryptedIoQueueItem;
+
+
+typedef struct
+{
+ EncryptedIoQueueItem *Item;
+
+ BOOL CompleteOriginalIrp;
+ LARGE_INTEGER Offset;
+ ULONG Length;
+ int64 EncryptedOffset;
+ ULONG EncryptedLength;
+ byte *Data;
+ byte *OrigDataBufferFragment;
+
+ LIST_ENTRY ListEntry;
+ LIST_ENTRY CompletionListEntry;
+} EncryptedIoRequest;
+
+
+NTSTATUS EncryptedIoQueueAddIrp (EncryptedIoQueue *queue, PIRP irp);
+BOOL EncryptedIoQueueIsRunning (EncryptedIoQueue *queue);
+BOOL EncryptedIoQueueIsSuspended (EncryptedIoQueue *queue);
+NTSTATUS EncryptedIoQueueResumeFromHold (EncryptedIoQueue *queue);
+NTSTATUS EncryptedIoQueueStart (EncryptedIoQueue *queue);
+NTSTATUS EncryptedIoQueueStop (EncryptedIoQueue *queue);
+NTSTATUS EncryptedIoQueueHoldWhenIdle (EncryptedIoQueue *queue, int64 timeout);
+
+
+#endif // TC_HEADER_DRIVER_ENCRYPTED_IO_QUEUE
diff --git a/src/Driver/Makefile b/src/Driver/Makefile
new file mode 100644
index 00000000..53b9a3d6
--- /dev/null
+++ b/src/Driver/Makefile
@@ -0,0 +1 @@
+!INCLUDE $(NTMAKEENV)\makefile.def
diff --git a/src/Driver/Ntdriver.c b/src/Driver/Ntdriver.c
new file mode 100644
index 00000000..700d0c09
--- /dev/null
+++ b/src/Driver/Ntdriver.c
@@ -0,0 +1,3293 @@
+/*
+ Legal Notice: Some portions of the source code contained in this file were
+ derived from the source code of Encryption for the Masses 2.02a, which is
+ Copyright (c) 1998-2000 Paul Le Roux and which is governed by the 'License
+ Agreement for Encryption for the Masses'. Modifications and additions to
+ the original source code (contained in this file) and all other portions
+ of this file are Copyright (c) 2003-2012 TrueCrypt Developers Association
+ and are governed by the TrueCrypt License 3.0 the full text of which is
+ contained in the file License.txt included in TrueCrypt binary and source
+ code distribution packages. */
+
+#include "TCdefs.h"
+#include <ntddk.h>
+#include "Crypto.h"
+#include "Fat.h"
+#include "Tests.h"
+
+#include "Apidrvr.h"
+#include "Boot/Windows/BootDefs.h"
+#include "EncryptedIoQueue.h"
+#include "EncryptionThreadPool.h"
+#include "Ntdriver.h"
+#include "Ntvol.h"
+#include "DriveFilter.h"
+#include "DumpFilter.h"
+#include "Cache.h"
+#include "Volumes.h"
+#include "VolumeFilter.h"
+
+#include <tchar.h>
+#include <initguid.h>
+#include <mountmgr.h>
+#include <mountdev.h>
+#include <ntddvol.h>
+
+/* Init section, which is thrown away as soon as DriverEntry returns */
+#pragma alloc_text(INIT,DriverEntry)
+#pragma alloc_text(INIT,TCCreateRootDeviceObject)
+
+PDRIVER_OBJECT TCDriverObject;
+PDEVICE_OBJECT RootDeviceObject = NULL;
+static KMUTEX RootDeviceControlMutex;
+BOOL DriverShuttingDown = FALSE;
+BOOL SelfTestsPassed;
+int LastUniqueVolumeId;
+ULONG OsMajorVersion = 0;
+ULONG OsMinorVersion;
+BOOL DriverUnloadDisabled = FALSE;
+BOOL PortableMode = FALSE;
+BOOL VolumeClassFilterRegistered = FALSE;
+BOOL CacheBootPassword = FALSE;
+BOOL NonAdminSystemFavoritesAccessDisabled = FALSE;
+static size_t EncryptionThreadPoolFreeCpuCountLimit = 0;
+static BOOL SystemFavoriteVolumeDirty = FALSE;
+static BOOL PagingFileCreationPrevented = FALSE;
+
+PDEVICE_OBJECT VirtualVolumeDeviceObjects[MAX_MOUNTED_VOLUME_DRIVE_NUMBER + 1];
+
+
+NTSTATUS DriverEntry (PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
+{
+ PKEY_VALUE_PARTIAL_INFORMATION startKeyValue;
+ LONG version;
+ int i;
+
+ Dump ("DriverEntry " TC_APP_NAME " " VERSION_STRING "\n");
+
+ PsGetVersion (&OsMajorVersion, &OsMinorVersion, NULL, NULL);
+
+ // Load dump filter if the main driver is already loaded
+ if (NT_SUCCESS (TCDeviceIoControl (NT_ROOT_PREFIX, TC_IOCTL_GET_DRIVER_VERSION, NULL, 0, &version, sizeof (version))))
+ return DumpFilterEntry ((PFILTER_EXTENSION) DriverObject, (PFILTER_INITIALIZATION_DATA) RegistryPath);
+
+ TCDriverObject = DriverObject;
+ memset (VirtualVolumeDeviceObjects, 0, sizeof (VirtualVolumeDeviceObjects));
+
+ ReadRegistryConfigFlags (TRUE);
+ EncryptionThreadPoolStart (EncryptionThreadPoolFreeCpuCountLimit);
+ SelfTestsPassed = AutoTestAlgorithms();
+
+ // Enable device class filters and load boot arguments if the driver is set to start at system boot
+
+ if (NT_SUCCESS (TCReadRegistryKey (RegistryPath, L"Start", &startKeyValue)))
+ {
+ if (startKeyValue->Type == REG_DWORD && *((uint32 *) startKeyValue->Data) == SERVICE_BOOT_START)
+ {
+ if (!SelfTestsPassed)
+ TC_BUG_CHECK (STATUS_INVALID_PARAMETER);
+
+ LoadBootArguments();
+ VolumeClassFilterRegistered = IsVolumeClassFilterRegistered();
+
+ DriverObject->DriverExtension->AddDevice = DriverAddDevice;
+ }
+
+ TCfree (startKeyValue);
+ }
+
+ for (i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; ++i)
+ {
+ DriverObject->MajorFunction[i] = TCDispatchQueueIRP;
+ }
+
+ DriverObject->DriverUnload = TCUnloadDriver;
+ return TCCreateRootDeviceObject (DriverObject);
+}
+
+
+NTSTATUS DriverAddDevice (PDRIVER_OBJECT driverObject, PDEVICE_OBJECT pdo)
+{
+#ifdef DEBUG
+ char nameInfoBuffer[128];
+ POBJECT_NAME_INFORMATION nameInfo = (POBJECT_NAME_INFORMATION) nameInfoBuffer;
+ ULONG nameInfoSize;
+ Dump ("AddDevice pdo=%p type=%x name=%ws\n", pdo, pdo->DeviceType, NT_SUCCESS (ObQueryNameString (pdo, nameInfo, sizeof (nameInfoBuffer), &nameInfoSize)) ? nameInfo->Name.Buffer : L"?");
+#endif
+
+ if (VolumeClassFilterRegistered && BootArgsValid && BootArgs.HiddenSystemPartitionStart != 0)
+ {
+ PWSTR interfaceLinks;
+ if (NT_SUCCESS (IoGetDeviceInterfaces (&GUID_DEVINTERFACE_VOLUME, pdo, DEVICE_INTERFACE_INCLUDE_NONACTIVE, &interfaceLinks)))
+ {
+ if (interfaceLinks[0] != UNICODE_NULL)
+ {
+ Dump ("Volume pdo=%p interface=%ws\n", pdo, interfaceLinks);
+ ExFreePool (interfaceLinks);
+
+ return VolumeFilterAddDevice (driverObject, pdo);
+ }
+
+ ExFreePool (interfaceLinks);
+ }
+ }
+
+ return DriveFilterAddDevice (driverObject, pdo);
+}
+
+
+// Dumps a memory region to debug output
+void DumpMemory (void *mem, int size)
+{
+ unsigned char str[20];
+ unsigned char *m = mem;
+ int i,j;
+
+ for (j = 0; j < size / 8; j++)
+ {
+ memset (str,0,sizeof str);
+ for (i = 0; i < 8; i++)
+ {
+ if (m[i] > ' ' && m[i] <= '~')
+ str[i]=m[i];
+ else
+ str[i]='.';
+ }
+
+ Dump ("0x%08p %02x %02x %02x %02x %02x %02x %02x %02x %s\n",
+ m, m[0], m[1], m[2], m[3], m[4], m[5], m[6], m[7], str);
+
+ m+=8;
+ }
+}
+
+
+BOOL ValidateIOBufferSize (PIRP irp, size_t requiredBufferSize, ValidateIOBufferSizeType type)
+{
+ PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (irp);
+ BOOL input = (type == ValidateInput || type == ValidateInputOutput);
+ BOOL output = (type == ValidateOutput || type == ValidateInputOutput);
+
+ if ((input && irpSp->Parameters.DeviceIoControl.InputBufferLength < requiredBufferSize)
+ || (output && irpSp->Parameters.DeviceIoControl.OutputBufferLength < requiredBufferSize))
+ {
+ Dump ("STATUS_BUFFER_TOO_SMALL ioctl=0x%x,%d in=%d out=%d reqsize=%d insize=%d outsize=%d\n", (int) (irpSp->Parameters.DeviceIoControl.IoControlCode >> 16), (int) ((irpSp->Parameters.DeviceIoControl.IoControlCode & 0x1FFF) >> 2), input, output, requiredBufferSize, irpSp->Parameters.DeviceIoControl.InputBufferLength, irpSp->Parameters.DeviceIoControl.OutputBufferLength);
+
+ irp->IoStatus.Status = STATUS_BUFFER_TOO_SMALL;
+ irp->IoStatus.Information = 0;
+ return FALSE;
+ }
+
+ if (!input && output)
+ memset (irp->AssociatedIrp.SystemBuffer, 0, irpSp->Parameters.DeviceIoControl.OutputBufferLength);
+
+ return TRUE;
+}
+
+
+PDEVICE_OBJECT GetVirtualVolumeDeviceObject (int driveNumber)
+{
+ if (driveNumber < MIN_MOUNTED_VOLUME_DRIVE_NUMBER || driveNumber > MAX_MOUNTED_VOLUME_DRIVE_NUMBER)
+ return NULL;
+
+ return VirtualVolumeDeviceObjects[driveNumber];
+}
+
+
+/* TCDispatchQueueIRP queues any IRP's so that they can be processed later
+ by the thread -- or in some cases handles them immediately! */
+NTSTATUS TCDispatchQueueIRP (PDEVICE_OBJECT DeviceObject, PIRP Irp)
+{
+ PEXTENSION Extension = (PEXTENSION) DeviceObject->DeviceExtension;
+ PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (Irp);
+ NTSTATUS ntStatus;
+
+#ifdef _DEBUG
+ if (irpSp->MajorFunction == IRP_MJ_DEVICE_CONTROL && (Extension->bRootDevice || Extension->IsVolumeDevice))
+ {
+ switch (irpSp->Parameters.DeviceIoControl.IoControlCode)
+ {
+ case TC_IOCTL_GET_MOUNTED_VOLUMES:
+ case TC_IOCTL_GET_PASSWORD_CACHE_STATUS:
+ case TC_IOCTL_GET_PORTABLE_MODE_STATUS:
+ case TC_IOCTL_SET_PORTABLE_MODE_STATUS:
+ case TC_IOCTL_OPEN_TEST:
+ case TC_IOCTL_GET_RESOLVED_SYMLINK:
+ case TC_IOCTL_GET_DEVICE_REFCOUNT:
+ case TC_IOCTL_GET_DRIVE_PARTITION_INFO:
+ case TC_IOCTL_GET_BOOT_DRIVE_VOLUME_PROPERTIES:
+ case TC_IOCTL_GET_BOOT_ENCRYPTION_STATUS:
+ case TC_IOCTL_GET_DECOY_SYSTEM_WIPE_STATUS:
+ case TC_IOCTL_GET_WARNING_FLAGS:
+ case TC_IOCTL_IS_HIDDEN_SYSTEM_RUNNING:
+ case IOCTL_DISK_CHECK_VERIFY:
+ break;
+
+ default:
+ Dump ("%ls (0x%x %d)\n",
+ TCTranslateCode (irpSp->Parameters.DeviceIoControl.IoControlCode),
+ (int) (irpSp->Parameters.DeviceIoControl.IoControlCode >> 16),
+ (int) ((irpSp->Parameters.DeviceIoControl.IoControlCode & 0x1FFF) >> 2));
+ }
+ }
+#endif
+
+ if (!Extension->bRootDevice)
+ {
+ // Drive filter IRP
+ if (Extension->IsDriveFilterDevice)
+ return DriveFilterDispatchIrp (DeviceObject, Irp);
+
+ // Volume filter IRP
+ if (Extension->IsVolumeFilterDevice)
+ return VolumeFilterDispatchIrp (DeviceObject, Irp);
+ }
+
+ switch (irpSp->MajorFunction)
+ {
+ case IRP_MJ_CLOSE:
+ case IRP_MJ_CREATE:
+ case IRP_MJ_CLEANUP:
+ return COMPLETE_IRP (DeviceObject, Irp, STATUS_SUCCESS, 0);
+
+ case IRP_MJ_SHUTDOWN:
+ if (Extension->bRootDevice)
+ {
+ Dump ("Driver shutting down\n");
+ DriverShuttingDown = TRUE;
+
+ if (EncryptionSetupThread)
+ while (SendDeviceIoControlRequest (RootDeviceObject, TC_IOCTL_ABORT_BOOT_ENCRYPTION_SETUP, NULL, 0, NULL, 0) == STATUS_INSUFFICIENT_RESOURCES);
+
+ if (DecoySystemWipeThread)
+ while (SendDeviceIoControlRequest (RootDeviceObject, TC_IOCTL_ABORT_DECOY_SYSTEM_WIPE, NULL, 0, NULL, 0) == STATUS_INSUFFICIENT_RESOURCES);
+
+ OnShutdownPending();
+ }
+
+ return COMPLETE_IRP (DeviceObject, Irp, STATUS_SUCCESS, 0);
+
+ case IRP_MJ_FLUSH_BUFFERS:
+ case IRP_MJ_READ:
+ case IRP_MJ_WRITE:
+ case IRP_MJ_DEVICE_CONTROL:
+
+ if (Extension->bRootDevice)
+ {
+ if (irpSp->MajorFunction == IRP_MJ_DEVICE_CONTROL)
+ {
+ NTSTATUS status = KeWaitForMutexObject (&RootDeviceControlMutex, Executive, KernelMode, FALSE, NULL);
+ if (!NT_SUCCESS (status))
+ return status;
+
+ status = ProcessMainDeviceControlIrp (DeviceObject, Extension, Irp);
+
+ KeReleaseMutex (&RootDeviceControlMutex, FALSE);
+ return status;
+ }
+ break;
+ }
+
+ if (Extension->bShuttingDown)
+ {
+ Dump ("Device %d shutting down: STATUS_DELETE_PENDING\n", Extension->nDosDriveNo);
+ return TCCompleteDiskIrp (Irp, STATUS_DELETE_PENDING, 0);
+ }
+
+ if (Extension->bRemovable
+ && (DeviceObject->Flags & DO_VERIFY_VOLUME)
+ && !(irpSp->Flags & SL_OVERRIDE_VERIFY_VOLUME)
+ && irpSp->MajorFunction != IRP_MJ_FLUSH_BUFFERS)
+ {
+ Dump ("Removable device %d has DO_VERIFY_VOLUME flag: STATUS_DEVICE_NOT_READY\n", Extension->nDosDriveNo);
+ return TCCompleteDiskIrp (Irp, STATUS_DEVICE_NOT_READY, 0);
+ }
+
+ switch (irpSp->MajorFunction)
+ {
+ case IRP_MJ_READ:
+ case IRP_MJ_WRITE:
+ ntStatus = EncryptedIoQueueAddIrp (&Extension->Queue, Irp);
+
+ if (ntStatus != STATUS_PENDING)
+ TCCompleteDiskIrp (Irp, ntStatus, 0);
+
+ return ntStatus;
+
+ case IRP_MJ_DEVICE_CONTROL:
+ ntStatus = IoAcquireRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ if (!NT_SUCCESS (ntStatus))
+ return TCCompleteIrp (Irp, ntStatus, 0);
+
+ IoMarkIrpPending (Irp);
+
+ ExInterlockedInsertTailList (&Extension->ListEntry, &Irp->Tail.Overlay.ListEntry, &Extension->ListSpinLock);
+ KeReleaseSemaphore (&Extension->RequestSemaphore, IO_DISK_INCREMENT, 1, FALSE);
+
+ return STATUS_PENDING;
+
+ case IRP_MJ_FLUSH_BUFFERS:
+ return TCCompleteDiskIrp (Irp, STATUS_SUCCESS, 0);
+ }
+
+ break;
+
+ case IRP_MJ_PNP:
+ if (!Extension->bRootDevice
+ && Extension->IsVolumeDevice
+ && irpSp->MinorFunction == IRP_MN_DEVICE_USAGE_NOTIFICATION
+ && irpSp->Parameters.UsageNotification.Type == DeviceUsageTypePaging
+ && irpSp->Parameters.UsageNotification.InPath)
+ {
+ PagingFileCreationPrevented = TRUE;
+ return TCCompleteIrp (Irp, STATUS_UNSUCCESSFUL, 0);
+ }
+ break;
+ }
+
+ return TCCompleteIrp (Irp, STATUS_INVALID_DEVICE_REQUEST, 0);
+}
+
+NTSTATUS TCCreateRootDeviceObject (PDRIVER_OBJECT DriverObject)
+{
+ UNICODE_STRING Win32NameString, ntUnicodeString;
+ WCHAR dosname[32], ntname[32];
+ PDEVICE_OBJECT DeviceObject;
+ NTSTATUS ntStatus;
+ BOOL *bRootExtension;
+
+ Dump ("TCCreateRootDeviceObject BEGIN\n");
+ ASSERT (KeGetCurrentIrql() == PASSIVE_LEVEL);
+
+ wcscpy (dosname, (LPWSTR) DOS_ROOT_PREFIX);
+ wcscpy (ntname, (LPWSTR) NT_ROOT_PREFIX);
+ RtlInitUnicodeString (&ntUnicodeString, ntname);
+ RtlInitUnicodeString (&Win32NameString, dosname);
+
+ Dump ("Creating root device nt=%ls dos=%ls\n", ntname, dosname);
+
+ ntStatus = IoCreateDevice (
+ DriverObject,
+ sizeof (BOOL),
+ &ntUnicodeString,
+ FILE_DEVICE_UNKNOWN,
+ FILE_DEVICE_SECURE_OPEN,
+ FALSE,
+ &DeviceObject);
+
+ if (!NT_SUCCESS (ntStatus))
+ {
+ Dump ("TCCreateRootDeviceObject NTSTATUS = 0x%08x END\n", ntStatus);
+ return ntStatus;/* Failed to create DeviceObject */
+ }
+
+ DeviceObject->Flags |= DO_DIRECT_IO;
+ DeviceObject->AlignmentRequirement = FILE_WORD_ALIGNMENT;
+
+ /* Setup the device extension */
+ bRootExtension = (BOOL *) DeviceObject->DeviceExtension;
+ *bRootExtension = TRUE;
+
+ KeInitializeMutex (&RootDeviceControlMutex, 0);
+
+ ntStatus = IoCreateSymbolicLink (&Win32NameString, &ntUnicodeString);
+
+ if (!NT_SUCCESS (ntStatus))
+ {
+ Dump ("TCCreateRootDeviceObject NTSTATUS = 0x%08x END\n", ntStatus);
+ IoDeleteDevice (DeviceObject);
+ return ntStatus;
+ }
+
+ IoRegisterShutdownNotification (DeviceObject);
+ RootDeviceObject = DeviceObject;
+
+ Dump ("TCCreateRootDeviceObject STATUS_SUCCESS END\n");
+ return STATUS_SUCCESS;
+}
+
+NTSTATUS TCCreateDeviceObject (PDRIVER_OBJECT DriverObject,
+ PDEVICE_OBJECT * ppDeviceObject,
+ MOUNT_STRUCT * mount)
+{
+ UNICODE_STRING Win32NameString, ntUnicodeString;
+ WCHAR dosname[32], ntname[32];
+ PEXTENSION Extension;
+ NTSTATUS ntStatus;
+ ULONG devChars = 0;
+
+ Dump ("TCCreateDeviceObject BEGIN\n");
+ ASSERT (KeGetCurrentIrql() == PASSIVE_LEVEL);
+
+ TCGetDosNameFromNumber (dosname, mount->nDosDriveNo);
+ TCGetNTNameFromNumber (ntname, mount->nDosDriveNo);
+ RtlInitUnicodeString (&ntUnicodeString, ntname);
+ RtlInitUnicodeString (&Win32NameString, dosname);
+
+ devChars = FILE_DEVICE_SECURE_OPEN;
+ devChars |= mount->bMountReadOnly ? FILE_READ_ONLY_DEVICE : 0;
+ devChars |= mount->bMountRemovable ? FILE_REMOVABLE_MEDIA : 0;
+
+ Dump ("Creating device nt=%ls dos=%ls\n", ntname, dosname);
+
+ ntStatus = IoCreateDevice (
+ DriverObject, /* Our Driver Object */
+ sizeof (EXTENSION), /* Size of state information */
+ &ntUnicodeString, /* Device name "\Device\Name" */
+ FILE_DEVICE_DISK, /* Device type */
+ devChars, /* Device characteristics */
+ FALSE, /* Exclusive device */
+ ppDeviceObject); /* Returned ptr to Device Object */
+
+ if (!NT_SUCCESS (ntStatus))
+ {
+ Dump ("TCCreateDeviceObject NTSTATUS = 0x%08x END\n", ntStatus);
+ return ntStatus;/* Failed to create DeviceObject */
+ }
+ /* Initialize device object and extension. */
+
+ (*ppDeviceObject)->Flags |= DO_DIRECT_IO;
+ (*ppDeviceObject)->StackSize += 6; // Reduce occurrence of NO_MORE_IRP_STACK_LOCATIONS bug check caused by buggy drivers
+
+ /* Setup the device extension */
+ Extension = (PEXTENSION) (*ppDeviceObject)->DeviceExtension;
+ memset (Extension, 0, sizeof (EXTENSION));
+
+ Extension->IsVolumeDevice = TRUE;
+ Extension->nDosDriveNo = mount->nDosDriveNo;
+ Extension->bRemovable = mount->bMountRemovable;
+ Extension->PartitionInInactiveSysEncScope = mount->bPartitionInInactiveSysEncScope;
+ Extension->SystemFavorite = mount->SystemFavorite;
+
+ KeInitializeEvent (&Extension->keCreateEvent, SynchronizationEvent, FALSE);
+ KeInitializeSemaphore (&Extension->RequestSemaphore, 0L, MAXLONG);
+ KeInitializeSpinLock (&Extension->ListSpinLock);
+ InitializeListHead (&Extension->ListEntry);
+ IoInitializeRemoveLock (&Extension->Queue.RemoveLock, 'LRCT', 0, 0);
+
+ VirtualVolumeDeviceObjects[mount->nDosDriveNo] = *ppDeviceObject;
+
+ Dump ("TCCreateDeviceObject STATUS_SUCCESS END\n");
+
+ return STATUS_SUCCESS;
+}
+
+
+BOOL RootDeviceControlMutexAcquireNoWait ()
+{
+ NTSTATUS status;
+ LARGE_INTEGER timeout;
+ timeout.QuadPart = 0;
+
+ status = KeWaitForMutexObject (&RootDeviceControlMutex, Executive, KernelMode, FALSE, &timeout);
+ return NT_SUCCESS (status) && status != STATUS_TIMEOUT;
+}
+
+
+void RootDeviceControlMutexRelease ()
+{
+ KeReleaseMutex (&RootDeviceControlMutex, FALSE);
+}
+
+
+NTSTATUS ProcessVolumeDeviceControlIrp (PDEVICE_OBJECT DeviceObject, PEXTENSION Extension, PIRP Irp)
+{
+ PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (Irp);
+
+ switch (irpSp->Parameters.DeviceIoControl.IoControlCode)
+ {
+
+ case IOCTL_MOUNTDEV_QUERY_DEVICE_NAME:
+ if (!ValidateIOBufferSize (Irp, sizeof (MOUNTDEV_NAME), ValidateOutput))
+ {
+ Irp->IoStatus.Information = sizeof (MOUNTDEV_NAME);
+ Irp->IoStatus.Status = STATUS_BUFFER_OVERFLOW;
+ }
+ else
+ {
+ ULONG outLength;
+ UNICODE_STRING ntUnicodeString;
+ WCHAR ntName[256];
+ PMOUNTDEV_NAME outputBuffer = (PMOUNTDEV_NAME) Irp->AssociatedIrp.SystemBuffer;
+
+ TCGetNTNameFromNumber (ntName, Extension->nDosDriveNo);
+ RtlInitUnicodeString (&ntUnicodeString, ntName);
+
+ outputBuffer->NameLength = ntUnicodeString.Length;
+ outLength = ntUnicodeString.Length + sizeof(USHORT);
+
+ if (irpSp->Parameters.DeviceIoControl.OutputBufferLength < outLength)
+ {
+ Irp->IoStatus.Information = sizeof (MOUNTDEV_NAME);
+ Irp->IoStatus.Status = STATUS_BUFFER_OVERFLOW;
+
+ break;
+ }
+
+ RtlCopyMemory ((PCHAR)outputBuffer->Name,ntUnicodeString.Buffer, ntUnicodeString.Length);
+
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = outLength;
+
+ Dump ("name = %ls\n",ntName);
+ }
+ break;
+
+ case IOCTL_MOUNTDEV_QUERY_UNIQUE_ID:
+ if (!ValidateIOBufferSize (Irp, sizeof (MOUNTDEV_UNIQUE_ID), ValidateOutput))
+ {
+ Irp->IoStatus.Information = sizeof (MOUNTDEV_UNIQUE_ID);
+ Irp->IoStatus.Status = STATUS_BUFFER_OVERFLOW;
+ }
+ else
+ {
+ ULONG outLength;
+ UCHAR volId[128], tmp[] = { 0,0 };
+ PMOUNTDEV_UNIQUE_ID outputBuffer = (PMOUNTDEV_UNIQUE_ID) Irp->AssociatedIrp.SystemBuffer;
+
+ strcpy (volId, TC_UNIQUE_ID_PREFIX);
+ tmp[0] = 'A' + (UCHAR) Extension->nDosDriveNo;
+ strcat (volId, tmp);
+
+ outputBuffer->UniqueIdLength = (USHORT) strlen (volId);
+ outLength = (ULONG) (strlen (volId) + sizeof (USHORT));
+
+ if (irpSp->Parameters.DeviceIoControl.OutputBufferLength < outLength)
+ {
+ Irp->IoStatus.Information = sizeof (MOUNTDEV_UNIQUE_ID);
+ Irp->IoStatus.Status = STATUS_BUFFER_OVERFLOW;
+ break;
+ }
+
+ RtlCopyMemory ((PCHAR)outputBuffer->UniqueId, volId, strlen (volId));
+
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = outLength;
+
+ Dump ("id = %s\n",volId);
+ }
+ break;
+
+ case IOCTL_MOUNTDEV_QUERY_SUGGESTED_LINK_NAME:
+ {
+ ULONG outLength;
+ UNICODE_STRING ntUnicodeString;
+ WCHAR ntName[256];
+ PMOUNTDEV_SUGGESTED_LINK_NAME outputBuffer = (PMOUNTDEV_SUGGESTED_LINK_NAME) Irp->AssociatedIrp.SystemBuffer;
+
+ if (!ValidateIOBufferSize (Irp, sizeof (MOUNTDEV_SUGGESTED_LINK_NAME), ValidateOutput))
+ {
+ Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+ Irp->IoStatus.Information = 0;
+ break;
+ }
+
+ TCGetDosNameFromNumber (ntName, Extension->nDosDriveNo);
+ RtlInitUnicodeString (&ntUnicodeString, ntName);
+
+ outLength = FIELD_OFFSET(MOUNTDEV_SUGGESTED_LINK_NAME,Name) + ntUnicodeString.Length;
+
+ outputBuffer->UseOnlyIfThereAreNoOtherLinks = FALSE;
+ outputBuffer->NameLength = ntUnicodeString.Length;
+
+ if(irpSp->Parameters.DeviceIoControl.OutputBufferLength < outLength)
+ {
+ Irp->IoStatus.Information = sizeof (MOUNTDEV_SUGGESTED_LINK_NAME);
+ Irp->IoStatus.Status = STATUS_BUFFER_OVERFLOW;
+ break;
+ }
+
+ RtlCopyMemory ((PCHAR)outputBuffer->Name,ntUnicodeString.Buffer, ntUnicodeString.Length);
+
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = outLength;
+
+ Dump ("link = %ls\n",ntName);
+ }
+ break;
+
+ case IOCTL_DISK_GET_MEDIA_TYPES:
+ case IOCTL_DISK_GET_DRIVE_GEOMETRY:
+ /* Return the drive geometry for the disk. Note that we
+ return values which were made up to suit the disk size. */
+ if (ValidateIOBufferSize (Irp, sizeof (DISK_GEOMETRY), ValidateOutput))
+ {
+ PDISK_GEOMETRY outputBuffer = (PDISK_GEOMETRY)
+ Irp->AssociatedIrp.SystemBuffer;
+
+ outputBuffer->MediaType = Extension->bRemovable ? RemovableMedia : FixedMedia;
+ outputBuffer->Cylinders.QuadPart = Extension->NumberOfCylinders;
+ outputBuffer->TracksPerCylinder = Extension->TracksPerCylinder;
+ outputBuffer->SectorsPerTrack = Extension->SectorsPerTrack;
+ outputBuffer->BytesPerSector = Extension->BytesPerSector;
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = sizeof (DISK_GEOMETRY);
+ }
+ break;
+
+ case IOCTL_DISK_GET_PARTITION_INFO:
+ if (ValidateIOBufferSize (Irp, sizeof (PARTITION_INFORMATION), ValidateOutput))
+ {
+ PPARTITION_INFORMATION outputBuffer = (PPARTITION_INFORMATION)
+ Irp->AssociatedIrp.SystemBuffer;
+
+ outputBuffer->PartitionType = Extension->PartitionType;
+ outputBuffer->BootIndicator = FALSE;
+ outputBuffer->RecognizedPartition = TRUE;
+ outputBuffer->RewritePartition = FALSE;
+ outputBuffer->StartingOffset.QuadPart = Extension->BytesPerSector;
+ outputBuffer->PartitionLength.QuadPart= Extension->DiskLength;
+ outputBuffer->HiddenSectors = 0;
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = sizeof (PARTITION_INFORMATION);
+ }
+ break;
+
+ case IOCTL_DISK_GET_PARTITION_INFO_EX:
+ if (ValidateIOBufferSize (Irp, sizeof (PARTITION_INFORMATION_EX), ValidateOutput))
+ {
+ PPARTITION_INFORMATION_EX outputBuffer = (PPARTITION_INFORMATION_EX) Irp->AssociatedIrp.SystemBuffer;
+
+ outputBuffer->PartitionStyle = PARTITION_STYLE_MBR;
+ outputBuffer->RewritePartition = FALSE;
+ outputBuffer->StartingOffset.QuadPart = Extension->BytesPerSector;
+ outputBuffer->PartitionLength.QuadPart= Extension->DiskLength;
+ outputBuffer->Mbr.PartitionType = Extension->PartitionType;
+ outputBuffer->Mbr.BootIndicator = FALSE;
+ outputBuffer->Mbr.RecognizedPartition = TRUE;
+ outputBuffer->Mbr.HiddenSectors = 0;
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = sizeof (PARTITION_INFORMATION_EX);
+ }
+ break;
+
+ case IOCTL_DISK_GET_DRIVE_LAYOUT:
+ if (ValidateIOBufferSize (Irp, sizeof (DRIVE_LAYOUT_INFORMATION), ValidateOutput))
+ {
+ PDRIVE_LAYOUT_INFORMATION outputBuffer = (PDRIVE_LAYOUT_INFORMATION)
+ Irp->AssociatedIrp.SystemBuffer;
+
+ outputBuffer->PartitionCount = 1;
+ outputBuffer->Signature = 0;
+
+ outputBuffer->PartitionEntry->PartitionType = Extension->PartitionType;
+ outputBuffer->PartitionEntry->BootIndicator = FALSE;
+ outputBuffer->PartitionEntry->RecognizedPartition = TRUE;
+ outputBuffer->PartitionEntry->RewritePartition = FALSE;
+ outputBuffer->PartitionEntry->StartingOffset.QuadPart = Extension->BytesPerSector;
+ outputBuffer->PartitionEntry->PartitionLength.QuadPart = Extension->DiskLength;
+ outputBuffer->PartitionEntry->HiddenSectors = 0;
+
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = sizeof (PARTITION_INFORMATION);
+ }
+ break;
+
+ case IOCTL_DISK_GET_LENGTH_INFO:
+ if (!ValidateIOBufferSize (Irp, sizeof (GET_LENGTH_INFORMATION), ValidateOutput))
+ {
+ Irp->IoStatus.Status = STATUS_BUFFER_OVERFLOW;
+ Irp->IoStatus.Information = sizeof (GET_LENGTH_INFORMATION);
+ }
+ else
+ {
+ PGET_LENGTH_INFORMATION outputBuffer = (PGET_LENGTH_INFORMATION) Irp->AssociatedIrp.SystemBuffer;
+
+ outputBuffer->Length.QuadPart = Extension->DiskLength;
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = sizeof (GET_LENGTH_INFORMATION);
+ }
+ break;
+
+ case IOCTL_DISK_VERIFY:
+ if (ValidateIOBufferSize (Irp, sizeof (VERIFY_INFORMATION), ValidateInput))
+ {
+ PVERIFY_INFORMATION pVerifyInformation;
+ pVerifyInformation = (PVERIFY_INFORMATION) Irp->AssociatedIrp.SystemBuffer;
+
+ if (pVerifyInformation->StartingOffset.QuadPart + pVerifyInformation->Length > Extension->DiskLength)
+ Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+ else
+ {
+ IO_STATUS_BLOCK ioStatus;
+ PVOID buffer = TCalloc (max (pVerifyInformation->Length, PAGE_SIZE));
+
+ if (!buffer)
+ {
+ Irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
+ }
+ else
+ {
+ LARGE_INTEGER offset = pVerifyInformation->StartingOffset;
+ offset.QuadPart += Extension->cryptoInfo->hiddenVolume ? Extension->cryptoInfo->hiddenVolumeOffset : Extension->cryptoInfo->volDataAreaOffset;
+
+ Irp->IoStatus.Status = ZwReadFile (Extension->hDeviceFile, NULL, NULL, NULL, &ioStatus, buffer, pVerifyInformation->Length, &offset, NULL);
+ TCfree (buffer);
+
+ if (NT_SUCCESS (Irp->IoStatus.Status) && ioStatus.Information != pVerifyInformation->Length)
+ Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+ }
+ }
+
+ Irp->IoStatus.Information = 0;
+ }
+ break;
+
+ case IOCTL_DISK_CHECK_VERIFY:
+ case IOCTL_STORAGE_CHECK_VERIFY:
+ {
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = 0;
+
+ if (irpSp->Parameters.DeviceIoControl.OutputBufferLength >= sizeof (ULONG))
+ {
+ *((ULONG *) Irp->AssociatedIrp.SystemBuffer) = 0;
+ Irp->IoStatus.Information = sizeof (ULONG);
+ }
+ }
+ break;
+
+ case IOCTL_DISK_IS_WRITABLE:
+ {
+ if (Extension->bReadOnly)
+ Irp->IoStatus.Status = STATUS_MEDIA_WRITE_PROTECTED;
+ else
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = 0;
+
+ }
+ break;
+
+ case IOCTL_VOLUME_ONLINE:
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = 0;
+ break;
+
+ case IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS:
+
+ // Vista's filesystem defragmenter fails if IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS does not succeed.
+ if (!(OsMajorVersion == 6 && OsMinorVersion == 0))
+ {
+ Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
+ Irp->IoStatus.Information = 0;
+ }
+ else if (ValidateIOBufferSize (Irp, sizeof (VOLUME_DISK_EXTENTS), ValidateOutput))
+ {
+ VOLUME_DISK_EXTENTS *extents = (VOLUME_DISK_EXTENTS *) Irp->AssociatedIrp.SystemBuffer;
+
+ // No extent data can be returned as this is not a physical drive.
+ memset (extents, 0, sizeof (*extents));
+ extents->NumberOfDiskExtents = 0;
+
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = sizeof (*extents);
+ }
+ break;
+
+ default:
+ return TCCompleteIrp (Irp, STATUS_INVALID_DEVICE_REQUEST, 0);
+ }
+
+#ifdef DEBUG
+ if (!NT_SUCCESS (Irp->IoStatus.Status))
+ {
+ Dump ("IOCTL error 0x%08x (0x%x %d)\n",
+ Irp->IoStatus.Status,
+ (int) (irpSp->Parameters.DeviceIoControl.IoControlCode >> 16),
+ (int) ((irpSp->Parameters.DeviceIoControl.IoControlCode & 0x1FFF) >> 2));
+ }
+#endif
+
+ return TCCompleteDiskIrp (Irp, Irp->IoStatus.Status, Irp->IoStatus.Information);
+}
+
+
+NTSTATUS ProcessMainDeviceControlIrp (PDEVICE_OBJECT DeviceObject, PEXTENSION Extension, PIRP Irp)
+{
+ PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (Irp);
+ NTSTATUS ntStatus;
+
+ switch (irpSp->Parameters.DeviceIoControl.IoControlCode)
+ {
+ case TC_IOCTL_GET_DRIVER_VERSION:
+ case TC_IOCTL_LEGACY_GET_DRIVER_VERSION:
+ if (ValidateIOBufferSize (Irp, sizeof (LONG), ValidateOutput))
+ {
+ LONG tmp = VERSION_NUM;
+ memcpy (Irp->AssociatedIrp.SystemBuffer, &tmp, 4);
+ Irp->IoStatus.Information = sizeof (LONG);
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ break;
+
+ case TC_IOCTL_GET_DEVICE_REFCOUNT:
+ if (ValidateIOBufferSize (Irp, sizeof (int), ValidateOutput))
+ {
+ *(int *) Irp->AssociatedIrp.SystemBuffer = DeviceObject->ReferenceCount;
+ Irp->IoStatus.Information = sizeof (int);
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ break;
+
+ case TC_IOCTL_IS_DRIVER_UNLOAD_DISABLED:
+ if (ValidateIOBufferSize (Irp, sizeof (int), ValidateOutput))
+ {
+ LONG deviceObjectCount = 0;
+
+ *(int *) Irp->AssociatedIrp.SystemBuffer = DriverUnloadDisabled;
+
+ if (IoEnumerateDeviceObjectList (TCDriverObject, NULL, 0, &deviceObjectCount) == STATUS_BUFFER_TOO_SMALL && deviceObjectCount > 1)
+ *(int *) Irp->AssociatedIrp.SystemBuffer = TRUE;
+
+ Irp->IoStatus.Information = sizeof (int);
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ break;
+
+ case TC_IOCTL_IS_ANY_VOLUME_MOUNTED:
+ if (ValidateIOBufferSize (Irp, sizeof (int), ValidateOutput))
+ {
+ int drive;
+ *(int *) Irp->AssociatedIrp.SystemBuffer = 0;
+
+ for (drive = MIN_MOUNTED_VOLUME_DRIVE_NUMBER; drive <= MAX_MOUNTED_VOLUME_DRIVE_NUMBER; ++drive)
+ {
+ if (GetVirtualVolumeDeviceObject (drive))
+ {
+ *(int *) Irp->AssociatedIrp.SystemBuffer = 1;
+ break;
+ }
+ }
+
+ if (IsBootDriveMounted())
+ *(int *) Irp->AssociatedIrp.SystemBuffer = 1;
+
+ Irp->IoStatus.Information = sizeof (int);
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ break;
+
+ case TC_IOCTL_OPEN_TEST:
+ {
+ OPEN_TEST_STRUCT *opentest = (OPEN_TEST_STRUCT *) Irp->AssociatedIrp.SystemBuffer;
+ OBJECT_ATTRIBUTES ObjectAttributes;
+ HANDLE NtFileHandle;
+ UNICODE_STRING FullFileName;
+ IO_STATUS_BLOCK IoStatus;
+ LARGE_INTEGER offset;
+ ACCESS_MASK access = FILE_READ_ATTRIBUTES;
+
+ if (!ValidateIOBufferSize (Irp, sizeof (OPEN_TEST_STRUCT), ValidateInputOutput))
+ break;
+
+ EnsureNullTerminatedString (opentest->wszFileName, sizeof (opentest->wszFileName));
+ RtlInitUnicodeString (&FullFileName, opentest->wszFileName);
+
+ InitializeObjectAttributes (&ObjectAttributes, &FullFileName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
+
+ if (opentest->bDetectTCBootLoader || opentest->DetectFilesystem)
+ access |= FILE_READ_DATA;
+
+ ntStatus = ZwCreateFile (&NtFileHandle,
+ SYNCHRONIZE | access, &ObjectAttributes, &IoStatus, NULL,
+ 0, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);
+
+ if (NT_SUCCESS (ntStatus))
+ {
+ opentest->TCBootLoaderDetected = FALSE;
+ opentest->FilesystemDetected = FALSE;
+
+ if (opentest->bDetectTCBootLoader || opentest->DetectFilesystem)
+ {
+ byte *readBuffer = TCalloc (TC_MAX_VOLUME_SECTOR_SIZE);
+ if (!readBuffer)
+ {
+ ntStatus = STATUS_INSUFFICIENT_RESOURCES;
+ }
+ else
+ {
+ // Determine if the first sector contains a portion of the TrueCrypt Boot Loader
+
+ offset.QuadPart = 0;
+
+ ntStatus = ZwReadFile (NtFileHandle,
+ NULL,
+ NULL,
+ NULL,
+ &IoStatus,
+ readBuffer,
+ TC_MAX_VOLUME_SECTOR_SIZE,
+ &offset,
+ NULL);
+
+ if (NT_SUCCESS (ntStatus))
+ {
+ size_t i;
+
+ if (opentest->bDetectTCBootLoader && IoStatus.Information >= TC_SECTOR_SIZE_BIOS)
+ {
+ // Search for the string "TrueCrypt"
+ for (i = 0; i < TC_SECTOR_SIZE_BIOS - strlen (TC_APP_NAME); ++i)
+ {
+ if (memcmp (readBuffer + i, TC_APP_NAME, strlen (TC_APP_NAME)) == 0)
+ {
+ opentest->TCBootLoaderDetected = TRUE;
+ break;
+ }
+ }
+ }
+
+ if (opentest->DetectFilesystem && IoStatus.Information >= sizeof (int64))
+ {
+ switch (BE64 (*(uint64 *) readBuffer))
+ {
+ case 0xEB52904E54465320: // NTFS
+ case 0xEB3C904D53444F53: // FAT16
+ case 0xEB58904D53444F53: // FAT32
+ case 0xEB76904558464154: // exFAT
+
+ opentest->FilesystemDetected = TRUE;
+ break;
+ }
+ }
+ }
+
+ TCfree (readBuffer);
+ }
+ }
+
+ ZwClose (NtFileHandle);
+ Dump ("Open test on file %ls success.\n", opentest->wszFileName);
+ }
+ else
+ {
+#if 0
+ Dump ("Open test on file %ls failed NTSTATUS 0x%08x\n", opentest->wszFileName, ntStatus);
+#endif
+ }
+
+ Irp->IoStatus.Information = NT_SUCCESS (ntStatus) ? sizeof (OPEN_TEST_STRUCT) : 0;
+ Irp->IoStatus.Status = ntStatus;
+ }
+ break;
+
+ case TC_IOCTL_GET_SYSTEM_DRIVE_CONFIG:
+ {
+ GetSystemDriveConfigurationRequest *request = (GetSystemDriveConfigurationRequest *) Irp->AssociatedIrp.SystemBuffer;
+ OBJECT_ATTRIBUTES ObjectAttributes;
+ HANDLE NtFileHandle;
+ UNICODE_STRING FullFileName;
+ IO_STATUS_BLOCK IoStatus;
+ LARGE_INTEGER offset;
+ byte readBuffer [TC_SECTOR_SIZE_BIOS];
+
+ if (!ValidateIOBufferSize (Irp, sizeof (GetSystemDriveConfigurationRequest), ValidateInputOutput))
+ break;
+
+ EnsureNullTerminatedString (request->DevicePath, sizeof (request->DevicePath));
+ RtlInitUnicodeString (&FullFileName, request->DevicePath);
+
+ InitializeObjectAttributes (&ObjectAttributes, &FullFileName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
+
+ ntStatus = ZwCreateFile (&NtFileHandle,
+ SYNCHRONIZE | GENERIC_READ, &ObjectAttributes, &IoStatus, NULL,
+ FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT | FILE_RANDOM_ACCESS, NULL, 0);
+
+ if (NT_SUCCESS (ntStatus))
+ {
+ // Determine if the first sector contains a portion of the TrueCrypt Boot Loader
+ offset.QuadPart = 0; // MBR
+
+ ntStatus = ZwReadFile (NtFileHandle,
+ NULL,
+ NULL,
+ NULL,
+ &IoStatus,
+ readBuffer,
+ sizeof(readBuffer),
+ &offset,
+ NULL);
+
+ if (NT_SUCCESS (ntStatus))
+ {
+ size_t i;
+
+ // Check for dynamic drive
+ request->DriveIsDynamic = FALSE;
+
+ if (readBuffer[510] == 0x55 && readBuffer[511] == 0xaa)
+ {
+ int i;
+ for (i = 0; i < 4; ++i)
+ {
+ if (readBuffer[446 + i * 16 + 4] == PARTITION_LDM)
+ {
+ request->DriveIsDynamic = TRUE;
+ break;
+ }
+ }
+ }
+
+ request->BootLoaderVersion = 0;
+ request->Configuration = 0;
+ request->UserConfiguration = 0;
+ request->CustomUserMessage[0] = 0;
+
+ // Search for the string "TrueCrypt"
+ for (i = 0; i < sizeof (readBuffer) - strlen (TC_APP_NAME); ++i)
+ {
+ if (memcmp (readBuffer + i, TC_APP_NAME, strlen (TC_APP_NAME)) == 0)
+ {
+ request->BootLoaderVersion = BE16 (*(uint16 *) (readBuffer + TC_BOOT_SECTOR_VERSION_OFFSET));
+ request->Configuration = readBuffer[TC_BOOT_SECTOR_CONFIG_OFFSET];
+
+ if (request->BootLoaderVersion != 0 && request->BootLoaderVersion <= VERSION_NUM)
+ {
+ request->UserConfiguration = readBuffer[TC_BOOT_SECTOR_USER_CONFIG_OFFSET];
+ memcpy (request->CustomUserMessage, readBuffer + TC_BOOT_SECTOR_USER_MESSAGE_OFFSET, TC_BOOT_SECTOR_USER_MESSAGE_MAX_LENGTH);
+ }
+ break;
+ }
+ }
+
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = sizeof (*request);
+ }
+ else
+ {
+ Irp->IoStatus.Status = ntStatus;
+ Irp->IoStatus.Information = 0;
+ }
+
+ ZwClose (NtFileHandle);
+
+ }
+ else
+ {
+ Irp->IoStatus.Status = ntStatus;
+ Irp->IoStatus.Information = 0;
+ }
+ }
+ break;
+
+ case TC_IOCTL_WIPE_PASSWORD_CACHE:
+ WipeCache ();
+
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = 0;
+ break;
+
+ case TC_IOCTL_GET_PASSWORD_CACHE_STATUS:
+ Irp->IoStatus.Status = cacheEmpty ? STATUS_PIPE_EMPTY : STATUS_SUCCESS;
+ Irp->IoStatus.Information = 0;
+ break;
+
+ case TC_IOCTL_SET_PORTABLE_MODE_STATUS:
+ if (!UserCanAccessDriveDevice())
+ {
+ Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
+ Irp->IoStatus.Information = 0;
+ }
+ else
+ {
+ PortableMode = TRUE;
+ Dump ("Setting portable mode\n");
+ }
+ break;
+
+ case TC_IOCTL_GET_PORTABLE_MODE_STATUS:
+ Irp->IoStatus.Status = PortableMode ? STATUS_SUCCESS : STATUS_PIPE_EMPTY;
+ Irp->IoStatus.Information = 0;
+ break;
+
+ case TC_IOCTL_GET_MOUNTED_VOLUMES:
+
+ if (ValidateIOBufferSize (Irp, sizeof (MOUNT_LIST_STRUCT), ValidateOutput))
+ {
+ MOUNT_LIST_STRUCT *list = (MOUNT_LIST_STRUCT *) Irp->AssociatedIrp.SystemBuffer;
+ PDEVICE_OBJECT ListDevice;
+ int drive;
+
+ list->ulMountedDrives = 0;
+
+ for (drive = MIN_MOUNTED_VOLUME_DRIVE_NUMBER; drive <= MAX_MOUNTED_VOLUME_DRIVE_NUMBER; ++drive)
+ {
+ PEXTENSION ListExtension;
+
+ ListDevice = GetVirtualVolumeDeviceObject (drive);
+ if (!ListDevice)
+ continue;
+
+ ListExtension = (PEXTENSION) ListDevice->DeviceExtension;
+ if (IsVolumeAccessibleByCurrentUser (ListExtension))
+ {
+ list->ulMountedDrives |= (1 << ListExtension->nDosDriveNo);
+ wcscpy (list->wszVolume[ListExtension->nDosDriveNo], ListExtension->wszVolume);
+ list->diskLength[ListExtension->nDosDriveNo] = ListExtension->DiskLength;
+ list->ea[ListExtension->nDosDriveNo] = ListExtension->cryptoInfo->ea;
+ if (ListExtension->cryptoInfo->hiddenVolume)
+ list->volumeType[ListExtension->nDosDriveNo] = PROP_VOL_TYPE_HIDDEN; // Hidden volume
+ else if (ListExtension->cryptoInfo->bHiddenVolProtectionAction)
+ list->volumeType[ListExtension->nDosDriveNo] = PROP_VOL_TYPE_OUTER_VOL_WRITE_PREVENTED; // Normal/outer volume (hidden volume protected AND write already prevented)
+ else if (ListExtension->cryptoInfo->bProtectHiddenVolume)
+ list->volumeType[ListExtension->nDosDriveNo] = PROP_VOL_TYPE_OUTER; // Normal/outer volume (hidden volume protected)
+ else
+ list->volumeType[ListExtension->nDosDriveNo] = PROP_VOL_TYPE_NORMAL; // Normal volume
+ }
+ }
+
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = sizeof (MOUNT_LIST_STRUCT);
+ }
+ break;
+
+ case TC_IOCTL_LEGACY_GET_MOUNTED_VOLUMES:
+ if (ValidateIOBufferSize (Irp, sizeof (uint32), ValidateOutput))
+ {
+ // Prevent the user from downgrading to versions lower than 5.0 by faking mounted volumes.
+ // The user could render the system unbootable by downgrading when boot encryption
+ // is active or being set up.
+
+ memset (Irp->AssociatedIrp.SystemBuffer, 0, irpSp->Parameters.DeviceIoControl.OutputBufferLength);
+ *(uint32 *) Irp->AssociatedIrp.SystemBuffer = 0xffffFFFF;
+
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = irpSp->Parameters.DeviceIoControl.OutputBufferLength;
+ }
+ break;
+
+ case TC_IOCTL_GET_VOLUME_PROPERTIES:
+ if (ValidateIOBufferSize (Irp, sizeof (VOLUME_PROPERTIES_STRUCT), ValidateInputOutput))
+ {
+ VOLUME_PROPERTIES_STRUCT *prop = (VOLUME_PROPERTIES_STRUCT *) Irp->AssociatedIrp.SystemBuffer;
+ PDEVICE_OBJECT ListDevice = GetVirtualVolumeDeviceObject (prop->driveNo);
+
+ Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+ Irp->IoStatus.Information = 0;
+
+ if (ListDevice)
+ {
+ PEXTENSION ListExtension = (PEXTENSION) ListDevice->DeviceExtension;
+ if (IsVolumeAccessibleByCurrentUser (ListExtension))
+ {
+ prop->uniqueId = ListExtension->UniqueVolumeId;
+ wcscpy (prop->wszVolume, ListExtension->wszVolume);
+ prop->diskLength = ListExtension->DiskLength;
+ prop->ea = ListExtension->cryptoInfo->ea;
+ prop->mode = ListExtension->cryptoInfo->mode;
+ prop->pkcs5 = ListExtension->cryptoInfo->pkcs5;
+ prop->pkcs5Iterations = ListExtension->cryptoInfo->noIterations;
+#if 0
+ prop->volumeCreationTime = ListExtension->cryptoInfo->volume_creation_time;
+ prop->headerCreationTime = ListExtension->cryptoInfo->header_creation_time;
+#endif
+ prop->volumeHeaderFlags = ListExtension->cryptoInfo->HeaderFlags;
+ prop->readOnly = ListExtension->bReadOnly;
+ prop->removable = ListExtension->bRemovable;
+ prop->partitionInInactiveSysEncScope = ListExtension->PartitionInInactiveSysEncScope;
+ prop->hiddenVolume = ListExtension->cryptoInfo->hiddenVolume;
+
+ if (ListExtension->cryptoInfo->bProtectHiddenVolume)
+ prop->hiddenVolProtection = ListExtension->cryptoInfo->bHiddenVolProtectionAction ? HIDVOL_PROT_STATUS_ACTION_TAKEN : HIDVOL_PROT_STATUS_ACTIVE;
+ else
+ prop->hiddenVolProtection = HIDVOL_PROT_STATUS_NONE;
+
+ prop->totalBytesRead = ListExtension->Queue.TotalBytesRead;
+ prop->totalBytesWritten = ListExtension->Queue.TotalBytesWritten;
+
+ prop->volFormatVersion = ListExtension->cryptoInfo->LegacyVolume ? TC_VOLUME_FORMAT_VERSION_PRE_6_0 : TC_VOLUME_FORMAT_VERSION;
+
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = sizeof (VOLUME_PROPERTIES_STRUCT);
+ }
+ }
+ }
+ break;
+
+ case TC_IOCTL_GET_RESOLVED_SYMLINK:
+ if (ValidateIOBufferSize (Irp, sizeof (RESOLVE_SYMLINK_STRUCT), ValidateInputOutput))
+ {
+ RESOLVE_SYMLINK_STRUCT *resolve = (RESOLVE_SYMLINK_STRUCT *) Irp->AssociatedIrp.SystemBuffer;
+ {
+ NTSTATUS ntStatus;
+
+ EnsureNullTerminatedString (resolve->symLinkName, sizeof (resolve->symLinkName));
+
+ ntStatus = SymbolicLinkToTarget (resolve->symLinkName,
+ resolve->targetName,
+ sizeof (resolve->targetName));
+
+ Irp->IoStatus.Information = sizeof (RESOLVE_SYMLINK_STRUCT);
+ Irp->IoStatus.Status = ntStatus;
+ }
+ }
+ break;
+
+ case TC_IOCTL_GET_DRIVE_PARTITION_INFO:
+ if (ValidateIOBufferSize (Irp, sizeof (DISK_PARTITION_INFO_STRUCT), ValidateInputOutput))
+ {
+ DISK_PARTITION_INFO_STRUCT *info = (DISK_PARTITION_INFO_STRUCT *) Irp->AssociatedIrp.SystemBuffer;
+ {
+ PARTITION_INFORMATION_EX pi;
+ NTSTATUS ntStatus;
+
+ EnsureNullTerminatedString (info->deviceName, sizeof (info->deviceName));
+
+ ntStatus = TCDeviceIoControl (info->deviceName, IOCTL_DISK_GET_PARTITION_INFO_EX, NULL, 0, &pi, sizeof (pi));
+ if (NT_SUCCESS(ntStatus))
+ {
+ memset (&info->partInfo, 0, sizeof (info->partInfo));
+
+ info->partInfo.PartitionLength = pi.PartitionLength;
+ info->partInfo.PartitionNumber = pi.PartitionNumber;
+ info->partInfo.StartingOffset = pi.StartingOffset;
+
+ if (pi.PartitionStyle == PARTITION_STYLE_MBR)
+ {
+ info->partInfo.PartitionType = pi.Mbr.PartitionType;
+ info->partInfo.BootIndicator = pi.Mbr.BootIndicator;
+ }
+
+ info->IsGPT = pi.PartitionStyle == PARTITION_STYLE_GPT;
+ }
+ else
+ {
+ // Windows 2000 does not support IOCTL_DISK_GET_PARTITION_INFO_EX
+ ntStatus = TCDeviceIoControl (info->deviceName, IOCTL_DISK_GET_PARTITION_INFO, NULL, 0, &info->partInfo, sizeof (info->partInfo));
+ info->IsGPT = FALSE;
+ }
+
+ if (!NT_SUCCESS (ntStatus))
+ {
+ GET_LENGTH_INFORMATION lengthInfo;
+ ntStatus = TCDeviceIoControl (info->deviceName, IOCTL_DISK_GET_LENGTH_INFO, NULL, 0, &lengthInfo, sizeof (lengthInfo));
+
+ if (NT_SUCCESS (ntStatus))
+ {
+ memset (&info->partInfo, 0, sizeof (info->partInfo));
+ info->partInfo.PartitionLength = lengthInfo.Length;
+ }
+ }
+
+ info->IsDynamic = FALSE;
+
+ if (NT_SUCCESS (ntStatus) && OsMajorVersion >= 6)
+ {
+# define IOCTL_VOLUME_IS_DYNAMIC CTL_CODE(IOCTL_VOLUME_BASE, 18, METHOD_BUFFERED, FILE_ANY_ACCESS)
+ if (!NT_SUCCESS (TCDeviceIoControl (info->deviceName, IOCTL_VOLUME_IS_DYNAMIC, NULL, 0, &info->IsDynamic, sizeof (info->IsDynamic))))
+ info->IsDynamic = FALSE;
+ }
+
+ Irp->IoStatus.Information = sizeof (DISK_PARTITION_INFO_STRUCT);
+ Irp->IoStatus.Status = ntStatus;
+ }
+ }
+ break;
+
+ case TC_IOCTL_GET_DRIVE_GEOMETRY:
+ if (ValidateIOBufferSize (Irp, sizeof (DISK_GEOMETRY_STRUCT), ValidateInputOutput))
+ {
+ DISK_GEOMETRY_STRUCT *g = (DISK_GEOMETRY_STRUCT *) Irp->AssociatedIrp.SystemBuffer;
+ {
+ NTSTATUS ntStatus;
+
+ EnsureNullTerminatedString (g->deviceName, sizeof (g->deviceName));
+
+ ntStatus = TCDeviceIoControl (g->deviceName,
+ IOCTL_DISK_GET_DRIVE_GEOMETRY,
+ NULL, 0, &g->diskGeometry, sizeof (g->diskGeometry));
+
+ Irp->IoStatus.Information = sizeof (DISK_GEOMETRY_STRUCT);
+ Irp->IoStatus.Status = ntStatus;
+ }
+ }
+ break;
+
+ case TC_IOCTL_PROBE_REAL_DRIVE_SIZE:
+ if (ValidateIOBufferSize (Irp, sizeof (ProbeRealDriveSizeRequest), ValidateInputOutput))
+ {
+ ProbeRealDriveSizeRequest *request = (ProbeRealDriveSizeRequest *) Irp->AssociatedIrp.SystemBuffer;
+ NTSTATUS status;
+ UNICODE_STRING name;
+ PFILE_OBJECT fileObject;
+ PDEVICE_OBJECT deviceObject;
+
+ EnsureNullTerminatedString (request->DeviceName, sizeof (request->DeviceName));
+
+ RtlInitUnicodeString (&name, request->DeviceName);
+ status = IoGetDeviceObjectPointer (&name, FILE_READ_ATTRIBUTES, &fileObject, &deviceObject);
+ if (!NT_SUCCESS (status))
+ {
+ Irp->IoStatus.Information = 0;
+ Irp->IoStatus.Status = status;
+ break;
+ }
+
+ status = ProbeRealDriveSize (deviceObject, &request->RealDriveSize);
+ ObDereferenceObject (fileObject);
+
+ if (status == STATUS_TIMEOUT)
+ {
+ request->TimeOut = TRUE;
+ Irp->IoStatus.Information = sizeof (ProbeRealDriveSizeRequest);
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ else if (!NT_SUCCESS (status))
+ {
+ Irp->IoStatus.Information = 0;
+ Irp->IoStatus.Status = status;
+ }
+ else
+ {
+ request->TimeOut = FALSE;
+ Irp->IoStatus.Information = sizeof (ProbeRealDriveSizeRequest);
+ Irp->IoStatus.Status = status;
+ }
+ }
+ break;
+
+ case TC_IOCTL_MOUNT_VOLUME:
+ if (ValidateIOBufferSize (Irp, sizeof (MOUNT_STRUCT), ValidateInputOutput))
+ {
+ MOUNT_STRUCT *mount = (MOUNT_STRUCT *) Irp->AssociatedIrp.SystemBuffer;
+
+ if (mount->VolumePassword.Length > MAX_PASSWORD || mount->ProtectedHidVolPassword.Length > MAX_PASSWORD)
+ {
+ Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+ Irp->IoStatus.Information = 0;
+ break;
+ }
+
+ EnsureNullTerminatedString (mount->wszVolume, sizeof (mount->wszVolume));
+
+ Irp->IoStatus.Information = sizeof (MOUNT_STRUCT);
+ Irp->IoStatus.Status = MountDevice (DeviceObject, mount);
+
+ burn (&mount->VolumePassword, sizeof (mount->VolumePassword));
+ burn (&mount->ProtectedHidVolPassword, sizeof (mount->ProtectedHidVolPassword));
+ }
+ break;
+
+ case TC_IOCTL_DISMOUNT_VOLUME:
+ if (ValidateIOBufferSize (Irp, sizeof (UNMOUNT_STRUCT), ValidateInputOutput))
+ {
+ UNMOUNT_STRUCT *unmount = (UNMOUNT_STRUCT *) Irp->AssociatedIrp.SystemBuffer;
+ PDEVICE_OBJECT ListDevice = GetVirtualVolumeDeviceObject (unmount->nDosDriveNo);
+
+ unmount->nReturnCode = ERR_DRIVE_NOT_FOUND;
+
+ if (ListDevice)
+ {
+ PEXTENSION ListExtension = (PEXTENSION) ListDevice->DeviceExtension;
+
+ if (IsVolumeAccessibleByCurrentUser (ListExtension))
+ unmount->nReturnCode = UnmountDevice (unmount, ListDevice, unmount->ignoreOpenFiles);
+ }
+
+ Irp->IoStatus.Information = sizeof (UNMOUNT_STRUCT);
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ break;
+
+ case TC_IOCTL_DISMOUNT_ALL_VOLUMES:
+ if (ValidateIOBufferSize (Irp, sizeof (UNMOUNT_STRUCT), ValidateInputOutput))
+ {
+ UNMOUNT_STRUCT *unmount = (UNMOUNT_STRUCT *) Irp->AssociatedIrp.SystemBuffer;
+
+ unmount->nReturnCode = UnmountAllDevices (unmount, unmount->ignoreOpenFiles);
+
+ Irp->IoStatus.Information = sizeof (UNMOUNT_STRUCT);
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ break;
+
+ case TC_IOCTL_BOOT_ENCRYPTION_SETUP:
+ Irp->IoStatus.Status = StartBootEncryptionSetup (DeviceObject, Irp, irpSp);
+ Irp->IoStatus.Information = 0;
+ break;
+
+ case TC_IOCTL_ABORT_BOOT_ENCRYPTION_SETUP:
+ Irp->IoStatus.Status = AbortBootEncryptionSetup();
+ Irp->IoStatus.Information = 0;
+ break;
+
+ case TC_IOCTL_GET_BOOT_ENCRYPTION_STATUS:
+ GetBootEncryptionStatus (Irp, irpSp);
+ break;
+
+ case TC_IOCTL_GET_BOOT_ENCRYPTION_SETUP_RESULT:
+ Irp->IoStatus.Information = 0;
+ Irp->IoStatus.Status = GetSetupResult();
+ break;
+
+ case TC_IOCTL_GET_BOOT_DRIVE_VOLUME_PROPERTIES:
+ GetBootDriveVolumeProperties (Irp, irpSp);
+ break;
+
+ case TC_IOCTL_GET_BOOT_LOADER_VERSION:
+ GetBootLoaderVersion (Irp, irpSp);
+ break;
+
+ case TC_IOCTL_REOPEN_BOOT_VOLUME_HEADER:
+ ReopenBootVolumeHeader (Irp, irpSp);
+ break;
+
+ case TC_IOCTL_GET_BOOT_ENCRYPTION_ALGORITHM_NAME:
+ GetBootEncryptionAlgorithmName (Irp, irpSp);
+ break;
+
+ case TC_IOCTL_IS_HIDDEN_SYSTEM_RUNNING:
+ if (ValidateIOBufferSize (Irp, sizeof (int), ValidateOutput))
+ {
+ *(int *) Irp->AssociatedIrp.SystemBuffer = IsHiddenSystemRunning() ? 1 : 0;
+ Irp->IoStatus.Information = sizeof (int);
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ break;
+
+ case TC_IOCTL_START_DECOY_SYSTEM_WIPE:
+ Irp->IoStatus.Status = StartDecoySystemWipe (DeviceObject, Irp, irpSp);
+ Irp->IoStatus.Information = 0;
+ break;
+
+ case TC_IOCTL_ABORT_DECOY_SYSTEM_WIPE:
+ Irp->IoStatus.Status = AbortDecoySystemWipe();
+ Irp->IoStatus.Information = 0;
+ break;
+
+ case TC_IOCTL_GET_DECOY_SYSTEM_WIPE_RESULT:
+ Irp->IoStatus.Status = GetDecoySystemWipeResult();
+ Irp->IoStatus.Information = 0;
+ break;
+
+ case TC_IOCTL_GET_DECOY_SYSTEM_WIPE_STATUS:
+ GetDecoySystemWipeStatus (Irp, irpSp);
+ break;
+
+ case TC_IOCTL_WRITE_BOOT_DRIVE_SECTOR:
+ Irp->IoStatus.Status = WriteBootDriveSector (Irp, irpSp);
+ Irp->IoStatus.Information = 0;
+ break;
+
+ case TC_IOCTL_GET_WARNING_FLAGS:
+ if (ValidateIOBufferSize (Irp, sizeof (GetWarningFlagsRequest), ValidateOutput))
+ {
+ GetWarningFlagsRequest *flags = (GetWarningFlagsRequest *) Irp->AssociatedIrp.SystemBuffer;
+
+ flags->PagingFileCreationPrevented = PagingFileCreationPrevented;
+ PagingFileCreationPrevented = FALSE;
+ flags->SystemFavoriteVolumeDirty = SystemFavoriteVolumeDirty;
+ SystemFavoriteVolumeDirty = FALSE;
+
+ Irp->IoStatus.Information = sizeof (GetWarningFlagsRequest);
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ break;
+
+ case TC_IOCTL_SET_SYSTEM_FAVORITE_VOLUME_DIRTY:
+ if (UserCanAccessDriveDevice())
+ {
+ SystemFavoriteVolumeDirty = TRUE;
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ }
+ else
+ Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
+
+ Irp->IoStatus.Information = 0;
+ break;
+
+ case TC_IOCTL_REREAD_DRIVER_CONFIG:
+ Irp->IoStatus.Status = ReadRegistryConfigFlags (FALSE);
+ Irp->IoStatus.Information = 0;
+ break;
+
+ case TC_IOCTL_GET_SYSTEM_DRIVE_DUMP_CONFIG:
+ if (ValidateIOBufferSize (Irp, sizeof (GetSystemDriveDumpConfigRequest), ValidateOutput))
+ {
+ GetSystemDriveDumpConfigRequest *request = (GetSystemDriveDumpConfigRequest *) Irp->AssociatedIrp.SystemBuffer;
+
+ request->BootDriveFilterExtension = GetBootDriveFilterExtension();
+ if (IsBootDriveMounted() && request->BootDriveFilterExtension)
+ {
+ request->HwEncryptionEnabled = IsHwEncryptionEnabled();
+ Irp->IoStatus.Status = STATUS_SUCCESS;
+ Irp->IoStatus.Information = sizeof (*request);
+ }
+ else
+ {
+ Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+ Irp->IoStatus.Information = 0;
+ }
+ }
+ break;
+
+ default:
+ return TCCompleteIrp (Irp, STATUS_INVALID_DEVICE_REQUEST, 0);
+ }
+
+
+#ifdef DEBUG
+ if (!NT_SUCCESS (Irp->IoStatus.Status))
+ {
+ switch (irpSp->Parameters.DeviceIoControl.IoControlCode)
+ {
+ case TC_IOCTL_GET_MOUNTED_VOLUMES:
+ case TC_IOCTL_GET_PASSWORD_CACHE_STATUS:
+ case TC_IOCTL_GET_PORTABLE_MODE_STATUS:
+ case TC_IOCTL_SET_PORTABLE_MODE_STATUS:
+ case TC_IOCTL_OPEN_TEST:
+ case TC_IOCTL_GET_RESOLVED_SYMLINK:
+ case TC_IOCTL_GET_DRIVE_PARTITION_INFO:
+ case TC_IOCTL_GET_BOOT_DRIVE_VOLUME_PROPERTIES:
+ case TC_IOCTL_GET_BOOT_ENCRYPTION_STATUS:
+ case TC_IOCTL_IS_HIDDEN_SYSTEM_RUNNING:
+ break;
+
+ default:
+ Dump ("IOCTL error 0x%08x\n", Irp->IoStatus.Status);
+ }
+ }
+#endif
+
+ return TCCompleteIrp (Irp, Irp->IoStatus.Status, Irp->IoStatus.Information);
+}
+
+
+NTSTATUS TCStartThread (PKSTART_ROUTINE threadProc, PVOID threadArg, PKTHREAD *kThread)
+{
+ return TCStartThreadInProcess (threadProc, threadArg, kThread, NULL);
+}
+
+
+NTSTATUS TCStartThreadInProcess (PKSTART_ROUTINE threadProc, PVOID threadArg, PKTHREAD *kThread, PEPROCESS process)
+{
+ NTSTATUS status;
+ HANDLE threadHandle;
+ HANDLE processHandle = NULL;
+ OBJECT_ATTRIBUTES threadObjAttributes;
+
+ if (process)
+ {
+ status = ObOpenObjectByPointer (process, OBJ_KERNEL_HANDLE, NULL, 0, NULL, KernelMode, &processHandle);
+ if (!NT_SUCCESS (status))
+ return status;
+ }
+
+ InitializeObjectAttributes (&threadObjAttributes, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
+
+ status = PsCreateSystemThread (&threadHandle, THREAD_ALL_ACCESS, &threadObjAttributes, processHandle, NULL, threadProc, threadArg);
+ if (!NT_SUCCESS (status))
+ return status;
+
+ status = ObReferenceObjectByHandle (threadHandle, THREAD_ALL_ACCESS, NULL, KernelMode, (PVOID *) kThread, NULL);
+ if (!NT_SUCCESS (status))
+ {
+ ZwClose (threadHandle);
+ *kThread = NULL;
+ return status;
+ }
+
+ if (processHandle)
+ ZwClose (processHandle);
+
+ ZwClose (threadHandle);
+ return STATUS_SUCCESS;
+}
+
+
+void TCStopThread (PKTHREAD kThread, PKEVENT wakeUpEvent)
+{
+ if (wakeUpEvent)
+ KeSetEvent (wakeUpEvent, 0, FALSE);
+
+ KeWaitForSingleObject (kThread, Executive, KernelMode, FALSE, NULL);
+ ObDereferenceObject (kThread);
+}
+
+
+NTSTATUS TCStartVolumeThread (PDEVICE_OBJECT DeviceObject, PEXTENSION Extension, MOUNT_STRUCT * mount)
+{
+ PTHREAD_BLOCK pThreadBlock = TCalloc (sizeof (THREAD_BLOCK));
+ HANDLE hThread;
+ NTSTATUS ntStatus;
+ OBJECT_ATTRIBUTES threadObjAttributes;
+ SECURITY_QUALITY_OF_SERVICE qos;
+
+ Dump ("Starting thread...\n");
+
+ if (pThreadBlock == NULL)
+ {
+ return STATUS_INSUFFICIENT_RESOURCES;
+ }
+ else
+ {
+ pThreadBlock->DeviceObject = DeviceObject;
+ pThreadBlock->mount = mount;
+ }
+
+ qos.Length = sizeof (qos);
+ qos.ContextTrackingMode = SECURITY_STATIC_TRACKING;
+ qos.EffectiveOnly = TRUE;
+ qos.ImpersonationLevel = SecurityImpersonation;
+
+ ntStatus = SeCreateClientSecurity (PsGetCurrentThread(), &qos, FALSE, &Extension->SecurityClientContext);
+ if (!NT_SUCCESS (ntStatus))
+ goto ret;
+
+ Extension->SecurityClientContextValid = TRUE;
+
+ Extension->bThreadShouldQuit = FALSE;
+
+ InitializeObjectAttributes (&threadObjAttributes, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
+
+ ntStatus = PsCreateSystemThread (&hThread,
+ THREAD_ALL_ACCESS,
+ &threadObjAttributes,
+ NULL,
+ NULL,
+ VolumeThreadProc,
+ pThreadBlock);
+
+ if (!NT_SUCCESS (ntStatus))
+ {
+ Dump ("PsCreateSystemThread Failed END\n");
+ goto ret;
+ }
+
+ ntStatus = ObReferenceObjectByHandle (hThread,
+ THREAD_ALL_ACCESS,
+ NULL,
+ KernelMode,
+ &Extension->peThread,
+ NULL);
+
+ ZwClose (hThread);
+
+ if (!NT_SUCCESS (ntStatus))
+ goto ret;
+
+ Dump ("Waiting for thread to initialize...\n");
+
+ KeWaitForSingleObject (&Extension->keCreateEvent,
+ Executive,
+ KernelMode,
+ FALSE,
+ NULL);
+
+ Dump ("Waiting completed! Thread returns 0x%08x\n", pThreadBlock->ntCreateStatus);
+ ntStatus = pThreadBlock->ntCreateStatus;
+
+ret:
+ TCfree (pThreadBlock);
+ return ntStatus;
+}
+
+void TCStopVolumeThread (PDEVICE_OBJECT DeviceObject, PEXTENSION Extension)
+{
+ NTSTATUS ntStatus;
+
+ if (DeviceObject); /* Remove compiler warning */
+
+ Dump ("Signalling thread to quit...\n");
+
+ Extension->bThreadShouldQuit = TRUE;
+
+ KeReleaseSemaphore (&Extension->RequestSemaphore,
+ 0,
+ 1,
+ TRUE);
+
+ ntStatus = KeWaitForSingleObject (Extension->peThread,
+ Executive,
+ KernelMode,
+ FALSE,
+ NULL);
+
+ ASSERT (NT_SUCCESS (ntStatus));
+
+ ObDereferenceObject (Extension->peThread);
+ Extension->peThread = NULL;
+
+ Dump ("Thread exited\n");
+}
+
+
+// Suspend current thread for a number of milliseconds
+void TCSleep (int milliSeconds)
+{
+ PKTIMER timer = (PKTIMER) TCalloc (sizeof (KTIMER));
+ LARGE_INTEGER duetime;
+
+ if (!timer)
+ return;
+
+ duetime.QuadPart = (__int64) milliSeconds * -10000;
+ KeInitializeTimerEx(timer, NotificationTimer);
+ KeSetTimerEx(timer, duetime, 0, NULL);
+
+ KeWaitForSingleObject (timer, Executive, KernelMode, FALSE, NULL);
+
+ TCfree (timer);
+}
+
+
+/* VolumeThreadProc does all the work of processing IRP's, and dispatching them
+ to either the ReadWrite function or the DeviceControl function */
+VOID VolumeThreadProc (PVOID Context)
+{
+ PTHREAD_BLOCK pThreadBlock = (PTHREAD_BLOCK) Context;
+ PDEVICE_OBJECT DeviceObject = pThreadBlock->DeviceObject;
+ PEXTENSION Extension = (PEXTENSION) DeviceObject->DeviceExtension;
+ BOOL bDevice;
+
+ /* Set thread priority to lowest realtime level. */
+ KeSetPriorityThread (KeGetCurrentThread (), LOW_REALTIME_PRIORITY);
+
+ Dump ("Mount THREAD OPENING VOLUME BEGIN\n");
+
+ if (memcmp (pThreadBlock->mount->wszVolume, WIDE ("\\Device"), 14) != 0)
+ {
+ wcscpy (pThreadBlock->wszMountVolume, WIDE ("\\??\\"));
+ wcsncat (pThreadBlock->wszMountVolume, pThreadBlock->mount->wszVolume,
+ sizeof (pThreadBlock->wszMountVolume) / 2 - 5);
+ bDevice = FALSE;
+ }
+ else
+ {
+ pThreadBlock->wszMountVolume[0] = 0;
+ wcsncat (pThreadBlock->wszMountVolume, pThreadBlock->mount->wszVolume,
+ sizeof (pThreadBlock->wszMountVolume) / 2 - 1);
+ bDevice = TRUE;
+ }
+
+ Dump ("Mount THREAD request for File %ls DriveNumber %d Device = %d\n",
+ pThreadBlock->wszMountVolume, pThreadBlock->mount->nDosDriveNo, bDevice);
+
+ pThreadBlock->ntCreateStatus = TCOpenVolume (DeviceObject,
+ Extension,
+ pThreadBlock->mount,
+ pThreadBlock->wszMountVolume,
+ bDevice);
+
+ if (!NT_SUCCESS (pThreadBlock->ntCreateStatus) || pThreadBlock->mount->nReturnCode != 0)
+ {
+ KeSetEvent (&Extension->keCreateEvent, 0, FALSE);
+ PsTerminateSystemThread (STATUS_SUCCESS);
+ }
+
+ // Start IO queue
+ Extension->Queue.IsFilterDevice = FALSE;
+ Extension->Queue.DeviceObject = DeviceObject;
+ Extension->Queue.CryptoInfo = Extension->cryptoInfo;
+ Extension->Queue.HostFileHandle = Extension->hDeviceFile;
+ Extension->Queue.VirtualDeviceLength = Extension->DiskLength;
+ Extension->Queue.MaxReadAheadOffset.QuadPart = Extension->HostLength;
+
+ if (Extension->SecurityClientContextValid)
+ Extension->Queue.SecurityClientContext = &Extension->SecurityClientContext;
+ else
+ Extension->Queue.SecurityClientContext = NULL;
+
+ pThreadBlock->ntCreateStatus = EncryptedIoQueueStart (&Extension->Queue);
+
+ if (!NT_SUCCESS (pThreadBlock->ntCreateStatus))
+ {
+ TCCloseVolume (DeviceObject, Extension);
+
+ pThreadBlock->mount->nReturnCode = ERR_OS_ERROR;
+ KeSetEvent (&Extension->keCreateEvent, 0, FALSE);
+ PsTerminateSystemThread (STATUS_SUCCESS);
+ }
+
+ KeSetEvent (&Extension->keCreateEvent, 0, FALSE);
+ /* From this point on pThreadBlock cannot be used as it will have been released! */
+ pThreadBlock = NULL;
+
+ for (;;)
+ {
+ /* Wait for a request from the dispatch routines. */
+ KeWaitForSingleObject ((PVOID) & Extension->RequestSemaphore, Executive, KernelMode, FALSE, NULL);
+
+ for (;;)
+ {
+ PIO_STACK_LOCATION irpSp;
+ PLIST_ENTRY request;
+ PIRP irp;
+
+ request = ExInterlockedRemoveHeadList (&Extension->ListEntry, &Extension->ListSpinLock);
+ if (request == NULL)
+ break;
+
+ irp = CONTAINING_RECORD (request, IRP, Tail.Overlay.ListEntry);
+ irpSp = IoGetCurrentIrpStackLocation (irp);
+
+ ASSERT (irpSp->MajorFunction == IRP_MJ_DEVICE_CONTROL);
+
+ ProcessVolumeDeviceControlIrp (DeviceObject, Extension, irp);
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, irp);
+ }
+
+ if (Extension->bThreadShouldQuit)
+ {
+ Dump ("Closing volume\n");
+ EncryptedIoQueueStop (&Extension->Queue);
+
+ TCCloseVolume (DeviceObject, Extension);
+ PsTerminateSystemThread (STATUS_SUCCESS);
+ }
+ }
+}
+
+void TCGetNTNameFromNumber (LPWSTR ntname, int nDriveNo)
+{
+ WCHAR tmp[3] =
+ {0, ':', 0};
+ int j = nDriveNo + (WCHAR) 'A';
+
+ tmp[0] = (short) j;
+ wcscpy (ntname, (LPWSTR) NT_MOUNT_PREFIX);
+ wcsncat (ntname, tmp, 1);
+}
+
+void TCGetDosNameFromNumber (LPWSTR dosname, int nDriveNo)
+{
+ WCHAR tmp[3] =
+ {0, ':', 0};
+ int j = nDriveNo + (WCHAR) 'A';
+
+ tmp[0] = (short) j;
+ wcscpy (dosname, (LPWSTR) DOS_MOUNT_PREFIX);
+ wcscat (dosname, tmp);
+}
+
+#ifdef _DEBUG
+LPWSTR TCTranslateCode (ULONG ulCode)
+{
+ switch (ulCode)
+ {
+#define TC_CASE_RET_NAME(CODE) case CODE : return L###CODE
+
+ TC_CASE_RET_NAME (TC_IOCTL_ABORT_BOOT_ENCRYPTION_SETUP);
+ TC_CASE_RET_NAME (TC_IOCTL_ABORT_DECOY_SYSTEM_WIPE);
+ TC_CASE_RET_NAME (TC_IOCTL_BOOT_ENCRYPTION_SETUP);
+ TC_CASE_RET_NAME (TC_IOCTL_DISMOUNT_ALL_VOLUMES);
+ TC_CASE_RET_NAME (TC_IOCTL_DISMOUNT_VOLUME);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_BOOT_DRIVE_VOLUME_PROPERTIES);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_BOOT_ENCRYPTION_ALGORITHM_NAME);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_BOOT_ENCRYPTION_SETUP_RESULT);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_BOOT_ENCRYPTION_STATUS);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_BOOT_LOADER_VERSION);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_DECOY_SYSTEM_WIPE_RESULT);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_DECOY_SYSTEM_WIPE_STATUS);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_DEVICE_REFCOUNT);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_DRIVE_GEOMETRY);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_DRIVE_PARTITION_INFO);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_DRIVER_VERSION);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_MOUNTED_VOLUMES);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_PASSWORD_CACHE_STATUS);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_SYSTEM_DRIVE_CONFIG);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_PORTABLE_MODE_STATUS);
+ TC_CASE_RET_NAME (TC_IOCTL_SET_PORTABLE_MODE_STATUS);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_RESOLVED_SYMLINK);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_SYSTEM_DRIVE_DUMP_CONFIG);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_VOLUME_PROPERTIES);
+ TC_CASE_RET_NAME (TC_IOCTL_GET_WARNING_FLAGS);
+ TC_CASE_RET_NAME (TC_IOCTL_DISK_IS_WRITABLE);
+ TC_CASE_RET_NAME (TC_IOCTL_IS_ANY_VOLUME_MOUNTED);
+ TC_CASE_RET_NAME (TC_IOCTL_IS_DRIVER_UNLOAD_DISABLED);
+ TC_CASE_RET_NAME (TC_IOCTL_IS_HIDDEN_SYSTEM_RUNNING);
+ TC_CASE_RET_NAME (TC_IOCTL_MOUNT_VOLUME);
+ TC_CASE_RET_NAME (TC_IOCTL_OPEN_TEST);
+ TC_CASE_RET_NAME (TC_IOCTL_PROBE_REAL_DRIVE_SIZE);
+ TC_CASE_RET_NAME (TC_IOCTL_REOPEN_BOOT_VOLUME_HEADER);
+ TC_CASE_RET_NAME (TC_IOCTL_REREAD_DRIVER_CONFIG);
+ TC_CASE_RET_NAME (TC_IOCTL_SET_SYSTEM_FAVORITE_VOLUME_DIRTY);
+ TC_CASE_RET_NAME (TC_IOCTL_START_DECOY_SYSTEM_WIPE);
+ TC_CASE_RET_NAME (TC_IOCTL_WIPE_PASSWORD_CACHE);
+ TC_CASE_RET_NAME (TC_IOCTL_WRITE_BOOT_DRIVE_SECTOR);
+
+ TC_CASE_RET_NAME (IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS);
+
+#undef TC_CASE_RET_NAME
+ }
+
+ if (ulCode == IOCTL_DISK_GET_DRIVE_GEOMETRY)
+ return (LPWSTR) _T ("IOCTL_DISK_GET_DRIVE_GEOMETRY");
+ else if (ulCode == IOCTL_DISK_GET_DRIVE_GEOMETRY_EX)
+ return (LPWSTR) _T ("IOCTL_DISK_GET_DRIVE_GEOMETRY_EX");
+ else if (ulCode == IOCTL_MOUNTDEV_QUERY_DEVICE_NAME)
+ return (LPWSTR) _T ("IOCTL_MOUNTDEV_QUERY_DEVICE_NAME");
+ else if (ulCode == IOCTL_MOUNTDEV_QUERY_SUGGESTED_LINK_NAME)
+ return (LPWSTR) _T ("IOCTL_MOUNTDEV_QUERY_SUGGESTED_LINK_NAME");
+ else if (ulCode == IOCTL_MOUNTDEV_QUERY_UNIQUE_ID)
+ return (LPWSTR) _T ("IOCTL_MOUNTDEV_QUERY_UNIQUE_ID");
+ else if (ulCode == IOCTL_VOLUME_ONLINE)
+ return (LPWSTR) _T ("IOCTL_VOLUME_ONLINE");
+ else if (ulCode == IOCTL_MOUNTDEV_LINK_CREATED)
+ return (LPWSTR) _T ("IOCTL_MOUNTDEV_LINK_CREATED");
+ else if (ulCode == IOCTL_MOUNTDEV_LINK_DELETED)
+ return (LPWSTR) _T ("IOCTL_MOUNTDEV_LINK_DELETED");
+ else if (ulCode == IOCTL_MOUNTMGR_QUERY_POINTS)
+ return (LPWSTR) _T ("IOCTL_MOUNTMGR_QUERY_POINTS");
+ else if (ulCode == IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_CREATED)
+ return (LPWSTR) _T ("IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_CREATED");
+ else if (ulCode == IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_DELETED)
+ return (LPWSTR) _T ("IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_DELETED");
+ else if (ulCode == IOCTL_DISK_GET_LENGTH_INFO)
+ return (LPWSTR) _T ("IOCTL_DISK_GET_LENGTH_INFO");
+ else if (ulCode == IOCTL_STORAGE_GET_DEVICE_NUMBER)
+ return (LPWSTR) _T ("IOCTL_STORAGE_GET_DEVICE_NUMBER");
+ else if (ulCode == IOCTL_DISK_GET_PARTITION_INFO)
+ return (LPWSTR) _T ("IOCTL_DISK_GET_PARTITION_INFO");
+ else if (ulCode == IOCTL_DISK_GET_PARTITION_INFO_EX)
+ return (LPWSTR) _T ("IOCTL_DISK_GET_PARTITION_INFO_EX");
+ else if (ulCode == IOCTL_DISK_SET_PARTITION_INFO)
+ return (LPWSTR) _T ("IOCTL_DISK_SET_PARTITION_INFO");
+ else if (ulCode == IOCTL_DISK_GET_DRIVE_LAYOUT)
+ return (LPWSTR) _T ("IOCTL_DISK_GET_DRIVE_LAYOUT");
+ else if (ulCode == IOCTL_DISK_SET_DRIVE_LAYOUT_EX)
+ return (LPWSTR) _T ("IOCTL_DISK_SET_DRIVE_LAYOUT_EX");
+ else if (ulCode == IOCTL_DISK_VERIFY)
+ return (LPWSTR) _T ("IOCTL_DISK_VERIFY");
+ else if (ulCode == IOCTL_DISK_FORMAT_TRACKS)
+ return (LPWSTR) _T ("IOCTL_DISK_FORMAT_TRACKS");
+ else if (ulCode == IOCTL_DISK_REASSIGN_BLOCKS)
+ return (LPWSTR) _T ("IOCTL_DISK_REASSIGN_BLOCKS");
+ else if (ulCode == IOCTL_DISK_PERFORMANCE)
+ return (LPWSTR) _T ("IOCTL_DISK_PERFORMANCE");
+ else if (ulCode == IOCTL_DISK_IS_WRITABLE)
+ return (LPWSTR) _T ("IOCTL_DISK_IS_WRITABLE");
+ else if (ulCode == IOCTL_DISK_LOGGING)
+ return (LPWSTR) _T ("IOCTL_DISK_LOGGING");
+ else if (ulCode == IOCTL_DISK_FORMAT_TRACKS_EX)
+ return (LPWSTR) _T ("IOCTL_DISK_FORMAT_TRACKS_EX");
+ else if (ulCode == IOCTL_DISK_HISTOGRAM_STRUCTURE)
+ return (LPWSTR) _T ("IOCTL_DISK_HISTOGRAM_STRUCTURE");
+ else if (ulCode == IOCTL_DISK_HISTOGRAM_DATA)
+ return (LPWSTR) _T ("IOCTL_DISK_HISTOGRAM_DATA");
+ else if (ulCode == IOCTL_DISK_HISTOGRAM_RESET)
+ return (LPWSTR) _T ("IOCTL_DISK_HISTOGRAM_RESET");
+ else if (ulCode == IOCTL_DISK_REQUEST_STRUCTURE)
+ return (LPWSTR) _T ("IOCTL_DISK_REQUEST_STRUCTURE");
+ else if (ulCode == IOCTL_DISK_REQUEST_DATA)
+ return (LPWSTR) _T ("IOCTL_DISK_REQUEST_DATA");
+ else if (ulCode == IOCTL_DISK_CONTROLLER_NUMBER)
+ return (LPWSTR) _T ("IOCTL_DISK_CONTROLLER_NUMBER");
+ else if (ulCode == SMART_GET_VERSION)
+ return (LPWSTR) _T ("SMART_GET_VERSION");
+ else if (ulCode == SMART_SEND_DRIVE_COMMAND)
+ return (LPWSTR) _T ("SMART_SEND_DRIVE_COMMAND");
+ else if (ulCode == SMART_RCV_DRIVE_DATA)
+ return (LPWSTR) _T ("SMART_RCV_DRIVE_DATA");
+ else if (ulCode == IOCTL_DISK_INTERNAL_SET_VERIFY)
+ return (LPWSTR) _T ("IOCTL_DISK_INTERNAL_SET_VERIFY");
+ else if (ulCode == IOCTL_DISK_INTERNAL_CLEAR_VERIFY)
+ return (LPWSTR) _T ("IOCTL_DISK_INTERNAL_CLEAR_VERIFY");
+ else if (ulCode == IOCTL_DISK_CHECK_VERIFY)
+ return (LPWSTR) _T ("IOCTL_DISK_CHECK_VERIFY");
+ else if (ulCode == IOCTL_DISK_MEDIA_REMOVAL)
+ return (LPWSTR) _T ("IOCTL_DISK_MEDIA_REMOVAL");
+ else if (ulCode == IOCTL_DISK_EJECT_MEDIA)
+ return (LPWSTR) _T ("IOCTL_DISK_EJECT_MEDIA");
+ else if (ulCode == IOCTL_DISK_LOAD_MEDIA)
+ return (LPWSTR) _T ("IOCTL_DISK_LOAD_MEDIA");
+ else if (ulCode == IOCTL_DISK_RESERVE)
+ return (LPWSTR) _T ("IOCTL_DISK_RESERVE");
+ else if (ulCode == IOCTL_DISK_RELEASE)
+ return (LPWSTR) _T ("IOCTL_DISK_RELEASE");
+ else if (ulCode == IOCTL_DISK_FIND_NEW_DEVICES)
+ return (LPWSTR) _T ("IOCTL_DISK_FIND_NEW_DEVICES");
+ else if (ulCode == IOCTL_DISK_GET_MEDIA_TYPES)
+ return (LPWSTR) _T ("IOCTL_DISK_GET_MEDIA_TYPES");
+ else if (ulCode == IOCTL_STORAGE_SET_HOTPLUG_INFO)
+ return (LPWSTR) _T ("IOCTL_STORAGE_SET_HOTPLUG_INFO");
+ else if (ulCode == IRP_MJ_READ)
+ return (LPWSTR) _T ("IRP_MJ_READ");
+ else if (ulCode == IRP_MJ_WRITE)
+ return (LPWSTR) _T ("IRP_MJ_WRITE");
+ else if (ulCode == IRP_MJ_CREATE)
+ return (LPWSTR) _T ("IRP_MJ_CREATE");
+ else if (ulCode == IRP_MJ_CLOSE)
+ return (LPWSTR) _T ("IRP_MJ_CLOSE");
+ else if (ulCode == IRP_MJ_CLEANUP)
+ return (LPWSTR) _T ("IRP_MJ_CLEANUP");
+ else if (ulCode == IRP_MJ_FLUSH_BUFFERS)
+ return (LPWSTR) _T ("IRP_MJ_FLUSH_BUFFERS");
+ else if (ulCode == IRP_MJ_SHUTDOWN)
+ return (LPWSTR) _T ("IRP_MJ_SHUTDOWN");
+ else if (ulCode == IRP_MJ_DEVICE_CONTROL)
+ return (LPWSTR) _T ("IRP_MJ_DEVICE_CONTROL");
+ else
+ {
+ return (LPWSTR) _T ("IOCTL");
+ }
+}
+
+#endif
+
+void TCDeleteDeviceObject (PDEVICE_OBJECT DeviceObject, PEXTENSION Extension)
+{
+ UNICODE_STRING Win32NameString;
+ NTSTATUS ntStatus;
+
+ Dump ("TCDeleteDeviceObject BEGIN\n");
+
+ if (Extension->bRootDevice)
+ {
+ RtlInitUnicodeString (&Win32NameString, (LPWSTR) DOS_ROOT_PREFIX);
+ ntStatus = IoDeleteSymbolicLink (&Win32NameString);
+ if (!NT_SUCCESS (ntStatus))
+ Dump ("IoDeleteSymbolicLink failed ntStatus = 0x%08x\n", ntStatus);
+
+ RootDeviceObject = NULL;
+ }
+ else
+ {
+ if (Extension->peThread != NULL)
+ TCStopVolumeThread (DeviceObject, Extension);
+
+ if (Extension->UserSid)
+ TCfree (Extension->UserSid);
+
+ if (Extension->SecurityClientContextValid)
+ {
+ if (OsMajorVersion == 5 && OsMinorVersion == 0)
+ {
+ ObDereferenceObject (Extension->SecurityClientContext.ClientToken);
+ }
+ else
+ {
+ // Windows 2000 does not support PsDereferenceImpersonationToken() used by SeDeleteClientSecurity().
+ // TODO: Use only SeDeleteClientSecurity() once support for Windows 2000 is dropped.
+
+ VOID (*PsDereferenceImpersonationTokenD) (PACCESS_TOKEN ImpersonationToken);
+ UNICODE_STRING name;
+ RtlInitUnicodeString (&name, L"PsDereferenceImpersonationToken");
+
+ PsDereferenceImpersonationTokenD = MmGetSystemRoutineAddress (&name);
+ if (!PsDereferenceImpersonationTokenD)
+ TC_BUG_CHECK (STATUS_NOT_IMPLEMENTED);
+
+# define PsDereferencePrimaryToken
+# define PsDereferenceImpersonationToken PsDereferenceImpersonationTokenD
+
+ SeDeleteClientSecurity (&Extension->SecurityClientContext);
+
+# undef PsDereferencePrimaryToken
+# undef PsDereferenceImpersonationToken
+ }
+ }
+
+ VirtualVolumeDeviceObjects[Extension->nDosDriveNo] = NULL;
+ }
+
+ IoDeleteDevice (DeviceObject);
+
+ Dump ("TCDeleteDeviceObject END\n");
+}
+
+
+VOID TCUnloadDriver (PDRIVER_OBJECT DriverObject)
+{
+ Dump ("TCUnloadDriver BEGIN\n");
+
+ OnShutdownPending();
+
+ if (IsBootDriveMounted())
+ TC_BUG_CHECK (STATUS_INVALID_DEVICE_STATE);
+
+ EncryptionThreadPoolStop();
+ TCDeleteDeviceObject (RootDeviceObject, (PEXTENSION) RootDeviceObject->DeviceExtension);
+
+ Dump ("TCUnloadDriver END\n");
+}
+
+
+void OnShutdownPending ()
+{
+ UNMOUNT_STRUCT unmount;
+ memset (&unmount, 0, sizeof (unmount));
+ unmount.ignoreOpenFiles = TRUE;
+
+ while (SendDeviceIoControlRequest (RootDeviceObject, TC_IOCTL_DISMOUNT_ALL_VOLUMES, &unmount, sizeof (unmount), &unmount, sizeof (unmount)) == STATUS_INSUFFICIENT_RESOURCES || unmount.HiddenVolumeProtectionTriggered)
+ unmount.HiddenVolumeProtectionTriggered = FALSE;
+
+ while (SendDeviceIoControlRequest (RootDeviceObject, TC_IOCTL_WIPE_PASSWORD_CACHE, NULL, 0, NULL, 0) == STATUS_INSUFFICIENT_RESOURCES);
+}
+
+
+NTSTATUS TCDeviceIoControl (PWSTR deviceName, ULONG IoControlCode, void *InputBuffer, ULONG InputBufferSize, void *OutputBuffer, ULONG OutputBufferSize)
+{
+ IO_STATUS_BLOCK ioStatusBlock;
+ NTSTATUS ntStatus;
+ PIRP irp;
+ PFILE_OBJECT fileObject;
+ PDEVICE_OBJECT deviceObject;
+ KEVENT event;
+ UNICODE_STRING name;
+
+ RtlInitUnicodeString(&name, deviceName);
+ ntStatus = IoGetDeviceObjectPointer (&name, FILE_READ_ATTRIBUTES, &fileObject, &deviceObject);
+
+ if (!NT_SUCCESS (ntStatus))
+ return ntStatus;
+
+ KeInitializeEvent(&event, NotificationEvent, FALSE);
+
+ irp = IoBuildDeviceIoControlRequest (IoControlCode,
+ deviceObject,
+ InputBuffer, InputBufferSize,
+ OutputBuffer, OutputBufferSize,
+ FALSE,
+ &event,
+ &ioStatusBlock);
+
+ if (irp == NULL)
+ {
+ Dump ("IRP allocation failed\n");
+ ntStatus = STATUS_INSUFFICIENT_RESOURCES;
+ goto ret;
+ }
+
+ IoGetNextIrpStackLocation (irp)->FileObject = fileObject;
+
+ ntStatus = IoCallDriver (deviceObject, irp);
+ if (ntStatus == STATUS_PENDING)
+ {
+ KeWaitForSingleObject (&event, Executive, KernelMode, FALSE, NULL);
+ ntStatus = ioStatusBlock.Status;
+ }
+
+ret:
+ ObDereferenceObject (fileObject);
+ return ntStatus;
+}
+
+
+typedef struct
+{
+ PDEVICE_OBJECT deviceObject; ULONG ioControlCode; void *inputBuffer; int inputBufferSize; void *outputBuffer; int outputBufferSize;
+ NTSTATUS Status;
+ KEVENT WorkItemCompletedEvent;
+} SendDeviceIoControlRequestWorkItemArgs;
+
+
+static VOID SendDeviceIoControlRequestWorkItemRoutine (PDEVICE_OBJECT rootDeviceObject, SendDeviceIoControlRequestWorkItemArgs *arg)
+{
+ arg->Status = SendDeviceIoControlRequest (arg->deviceObject, arg->ioControlCode, arg->inputBuffer, arg->inputBufferSize, arg->outputBuffer, arg->outputBufferSize);
+ KeSetEvent (&arg->WorkItemCompletedEvent, IO_NO_INCREMENT, FALSE);
+}
+
+
+NTSTATUS SendDeviceIoControlRequest (PDEVICE_OBJECT deviceObject, ULONG ioControlCode, void *inputBuffer, int inputBufferSize, void *outputBuffer, int outputBufferSize)
+{
+ IO_STATUS_BLOCK ioStatusBlock;
+ NTSTATUS status;
+ PIRP irp;
+ KEVENT event;
+
+ if (KeGetCurrentIrql() > APC_LEVEL)
+ {
+ SendDeviceIoControlRequestWorkItemArgs args;
+
+ PIO_WORKITEM workItem = IoAllocateWorkItem (RootDeviceObject);
+ if (!workItem)
+ return STATUS_INSUFFICIENT_RESOURCES;
+
+ args.deviceObject = deviceObject;
+ args.ioControlCode = ioControlCode;
+ args.inputBuffer = inputBuffer;
+ args.inputBufferSize = inputBufferSize;
+ args.outputBuffer = outputBuffer;
+ args.outputBufferSize = outputBufferSize;
+
+ KeInitializeEvent (&args.WorkItemCompletedEvent, SynchronizationEvent, FALSE);
+ IoQueueWorkItem (workItem, SendDeviceIoControlRequestWorkItemRoutine, DelayedWorkQueue, &args);
+
+ KeWaitForSingleObject (&args.WorkItemCompletedEvent, Executive, KernelMode, FALSE, NULL);
+ IoFreeWorkItem (workItem);
+
+ return args.Status;
+ }
+
+ KeInitializeEvent (&event, NotificationEvent, FALSE);
+
+ irp = IoBuildDeviceIoControlRequest (ioControlCode, deviceObject, inputBuffer, inputBufferSize,
+ outputBuffer, outputBufferSize, FALSE, &event, &ioStatusBlock);
+
+ if (!irp)
+ return STATUS_INSUFFICIENT_RESOURCES;
+
+ ObReferenceObject (deviceObject);
+
+ status = IoCallDriver (deviceObject, irp);
+ if (status == STATUS_PENDING)
+ {
+ KeWaitForSingleObject (&event, Executive, KernelMode, FALSE, NULL);
+ status = ioStatusBlock.Status;
+ }
+
+ ObDereferenceObject (deviceObject);
+ return status;
+}
+
+
+NTSTATUS ProbeRealDriveSize (PDEVICE_OBJECT driveDeviceObject, LARGE_INTEGER *driveSize)
+{
+ NTSTATUS status;
+ LARGE_INTEGER sysLength;
+ LARGE_INTEGER offset;
+ byte *sectorBuffer;
+ ULONGLONG startTime;
+
+ if (!UserCanAccessDriveDevice())
+ return STATUS_ACCESS_DENIED;
+
+ sectorBuffer = TCalloc (TC_SECTOR_SIZE_BIOS);
+ if (!sectorBuffer)
+ return STATUS_INSUFFICIENT_RESOURCES;
+
+ status = SendDeviceIoControlRequest (driveDeviceObject, IOCTL_DISK_GET_LENGTH_INFO,
+ NULL, 0, &sysLength, sizeof (sysLength));
+
+ if (!NT_SUCCESS (status))
+ {
+ Dump ("Failed to get drive size - error %x\n", status);
+ TCfree (sectorBuffer);
+ return status;
+ }
+
+ startTime = KeQueryInterruptTime ();
+ for (offset.QuadPart = sysLength.QuadPart; ; offset.QuadPart += TC_SECTOR_SIZE_BIOS)
+ {
+ status = TCReadDevice (driveDeviceObject, sectorBuffer, offset, TC_SECTOR_SIZE_BIOS);
+
+ if (NT_SUCCESS (status))
+ status = TCWriteDevice (driveDeviceObject, sectorBuffer, offset, TC_SECTOR_SIZE_BIOS);
+
+ if (!NT_SUCCESS (status))
+ {
+ driveSize->QuadPart = offset.QuadPart;
+ Dump ("Real drive size = %I64d bytes (%I64d hidden)\n", driveSize->QuadPart, driveSize->QuadPart - sysLength.QuadPart);
+ TCfree (sectorBuffer);
+ return STATUS_SUCCESS;
+ }
+
+ if (KeQueryInterruptTime() - startTime > 3ULL * 60 * 1000 * 1000 * 10)
+ {
+ // Abort if probing for more than 3 minutes
+ driveSize->QuadPart = sysLength.QuadPart;
+ TCfree (sectorBuffer);
+ return STATUS_TIMEOUT;
+ }
+ }
+}
+
+
+NTSTATUS TCOpenFsVolume (PEXTENSION Extension, PHANDLE volumeHandle, PFILE_OBJECT * fileObject)
+{
+ NTSTATUS ntStatus;
+ OBJECT_ATTRIBUTES objectAttributes;
+ UNICODE_STRING fullFileName;
+ IO_STATUS_BLOCK ioStatus;
+ WCHAR volumeName[TC_MAX_PATH];
+
+ TCGetNTNameFromNumber (volumeName, Extension->nDosDriveNo);
+ RtlInitUnicodeString (&fullFileName, volumeName);
+ InitializeObjectAttributes (&objectAttributes, &fullFileName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
+
+ ntStatus = ZwCreateFile (volumeHandle,
+ SYNCHRONIZE | GENERIC_READ,
+ &objectAttributes,
+ &ioStatus,
+ NULL,
+ FILE_ATTRIBUTE_NORMAL,
+ FILE_SHARE_READ | FILE_SHARE_WRITE,
+ FILE_OPEN,
+ FILE_SYNCHRONOUS_IO_NONALERT,
+ NULL,
+ 0);
+
+ Dump ("Volume %ls open NTSTATUS 0x%08x\n", volumeName, ntStatus);
+
+ if (!NT_SUCCESS (ntStatus))
+ return ntStatus;
+
+ ntStatus = ObReferenceObjectByHandle (*volumeHandle,
+ FILE_READ_DATA,
+ NULL,
+ KernelMode,
+ fileObject,
+ NULL);
+
+ if (!NT_SUCCESS (ntStatus))
+ ZwClose (*volumeHandle);
+
+ return ntStatus;
+}
+
+
+void TCCloseFsVolume (HANDLE volumeHandle, PFILE_OBJECT fileObject)
+{
+ ObDereferenceObject (fileObject);
+ ZwClose (volumeHandle);
+}
+
+
+static NTSTATUS TCReadWriteDevice (BOOL write, PDEVICE_OBJECT deviceObject, PVOID buffer, LARGE_INTEGER offset, ULONG length)
+{
+ NTSTATUS status;
+ IO_STATUS_BLOCK ioStatusBlock;
+ PIRP irp;
+ KEVENT completionEvent;
+
+ ASSERT (KeGetCurrentIrql() <= APC_LEVEL);
+
+ KeInitializeEvent (&completionEvent, NotificationEvent, FALSE);
+ irp = IoBuildSynchronousFsdRequest (write ? IRP_MJ_WRITE : IRP_MJ_READ, deviceObject, buffer, length, &offset, &completionEvent, &ioStatusBlock);
+ if (!irp)
+ return STATUS_INSUFFICIENT_RESOURCES;
+
+ ObReferenceObject (deviceObject);
+ status = IoCallDriver (deviceObject, irp);
+
+ if (status == STATUS_PENDING)
+ {
+ status = KeWaitForSingleObject (&completionEvent, Executive, KernelMode, FALSE, NULL);
+ if (NT_SUCCESS (status))
+ status = ioStatusBlock.Status;
+ }
+
+ ObDereferenceObject (deviceObject);
+ return status;
+}
+
+
+NTSTATUS TCReadDevice (PDEVICE_OBJECT deviceObject, PVOID buffer, LARGE_INTEGER offset, ULONG length)
+{
+ return TCReadWriteDevice (FALSE, deviceObject, buffer, offset, length);
+}
+
+
+NTSTATUS TCWriteDevice (PDEVICE_OBJECT deviceObject, PVOID buffer, LARGE_INTEGER offset, ULONG length)
+{
+ return TCReadWriteDevice (TRUE, deviceObject, buffer, offset, length);
+}
+
+
+NTSTATUS TCFsctlCall (PFILE_OBJECT fileObject, LONG IoControlCode,
+ void *InputBuffer, int InputBufferSize, void *OutputBuffer, int OutputBufferSize)
+{
+ IO_STATUS_BLOCK ioStatusBlock;
+ NTSTATUS ntStatus;
+ PIRP irp;
+ KEVENT event;
+ PIO_STACK_LOCATION stack;
+ PDEVICE_OBJECT deviceObject = IoGetRelatedDeviceObject (fileObject);
+
+ KeInitializeEvent(&event, NotificationEvent, FALSE);
+
+ irp = IoBuildDeviceIoControlRequest (IoControlCode,
+ deviceObject,
+ InputBuffer, InputBufferSize,
+ OutputBuffer, OutputBufferSize,
+ FALSE,
+ &event,
+ &ioStatusBlock);
+
+ if (irp == NULL)
+ return STATUS_INSUFFICIENT_RESOURCES;
+
+ stack = IoGetNextIrpStackLocation(irp);
+
+ stack->MajorFunction = IRP_MJ_FILE_SYSTEM_CONTROL;
+ stack->MinorFunction = IRP_MN_USER_FS_REQUEST;
+ stack->FileObject = fileObject;
+
+ ntStatus = IoCallDriver (deviceObject, irp);
+ if (ntStatus == STATUS_PENDING)
+ {
+ KeWaitForSingleObject (&event, Executive, KernelMode, FALSE, NULL);
+ ntStatus = ioStatusBlock.Status;
+ }
+
+ return ntStatus;
+}
+
+
+NTSTATUS CreateDriveLink (int nDosDriveNo)
+{
+ WCHAR dev[128], link[128];
+ UNICODE_STRING deviceName, symLink;
+ NTSTATUS ntStatus;
+
+ TCGetNTNameFromNumber (dev, nDosDriveNo);
+ TCGetDosNameFromNumber (link, nDosDriveNo);
+
+ RtlInitUnicodeString (&deviceName, dev);
+ RtlInitUnicodeString (&symLink, link);
+
+ ntStatus = IoCreateSymbolicLink (&symLink, &deviceName);
+ Dump ("IoCreateSymbolicLink returned %X\n", ntStatus);
+ return ntStatus;
+}
+
+
+NTSTATUS RemoveDriveLink (int nDosDriveNo)
+{
+ WCHAR link[256];
+ UNICODE_STRING symLink;
+ NTSTATUS ntStatus;
+
+ TCGetDosNameFromNumber (link, nDosDriveNo);
+ RtlInitUnicodeString (&symLink, link);
+
+ ntStatus = IoDeleteSymbolicLink (&symLink);
+ Dump ("IoDeleteSymbolicLink returned %X\n", ntStatus);
+ return ntStatus;
+}
+
+
+NTSTATUS MountManagerMount (MOUNT_STRUCT *mount)
+{
+ NTSTATUS ntStatus;
+ WCHAR arrVolume[256];
+ char buf[200];
+ PMOUNTMGR_TARGET_NAME in = (PMOUNTMGR_TARGET_NAME) buf;
+ PMOUNTMGR_CREATE_POINT_INPUT point = (PMOUNTMGR_CREATE_POINT_INPUT) buf;
+ UNICODE_STRING symName, devName;
+
+ TCGetNTNameFromNumber (arrVolume, mount->nDosDriveNo);
+ in->DeviceNameLength = (USHORT) wcslen (arrVolume) * 2;
+ wcscpy(in->DeviceName, arrVolume);
+
+ ntStatus = TCDeviceIoControl (MOUNTMGR_DEVICE_NAME, IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION,
+ in, (ULONG) (sizeof (in->DeviceNameLength) + wcslen (arrVolume) * 2), 0, 0);
+
+ memset (buf, 0, sizeof buf);
+ TCGetDosNameFromNumber ((PWSTR) &point[1], mount->nDosDriveNo);
+
+ point->SymbolicLinkNameOffset = sizeof (MOUNTMGR_CREATE_POINT_INPUT);
+ point->SymbolicLinkNameLength = (USHORT) wcslen ((PWSTR) &point[1]) * 2;
+
+ RtlInitUnicodeString(&symName, (PWSTR) (buf + point->SymbolicLinkNameOffset));
+
+ point->DeviceNameOffset = point->SymbolicLinkNameOffset + point->SymbolicLinkNameLength;
+ TCGetNTNameFromNumber ((PWSTR) (buf + point->DeviceNameOffset), mount->nDosDriveNo);
+ point->DeviceNameLength = (USHORT) wcslen ((PWSTR) (buf + point->DeviceNameOffset)) * 2;
+
+ RtlInitUnicodeString(&devName, (PWSTR) (buf + point->DeviceNameOffset));
+
+ ntStatus = TCDeviceIoControl (MOUNTMGR_DEVICE_NAME, IOCTL_MOUNTMGR_CREATE_POINT, point,
+ point->DeviceNameOffset + point->DeviceNameLength, 0, 0);
+
+ return ntStatus;
+}
+
+
+NTSTATUS MountManagerUnmount (int nDosDriveNo)
+{
+ NTSTATUS ntStatus;
+ char buf[256], out[300];
+ PMOUNTMGR_MOUNT_POINT in = (PMOUNTMGR_MOUNT_POINT) buf;
+
+ memset (buf, 0, sizeof buf);
+
+ TCGetDosNameFromNumber ((PWSTR) &in[1], nDosDriveNo);
+
+ // Only symbolic link can be deleted with IOCTL_MOUNTMGR_DELETE_POINTS. If any other entry is specified, the mount manager will ignore subsequent IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION for the same volume ID.
+ in->SymbolicLinkNameOffset = sizeof (MOUNTMGR_MOUNT_POINT);
+ in->SymbolicLinkNameLength = (USHORT) wcslen ((PWCHAR) &in[1]) * 2;
+
+ ntStatus = TCDeviceIoControl (MOUNTMGR_DEVICE_NAME, IOCTL_MOUNTMGR_DELETE_POINTS,
+ in, sizeof(MOUNTMGR_MOUNT_POINT) + in->SymbolicLinkNameLength, out, sizeof out);
+
+ Dump ("IOCTL_MOUNTMGR_DELETE_POINTS returned 0x%08x\n", ntStatus);
+
+ return ntStatus;
+}
+
+
+NTSTATUS MountDevice (PDEVICE_OBJECT DeviceObject, MOUNT_STRUCT *mount)
+{
+ PDEVICE_OBJECT NewDeviceObject;
+ NTSTATUS ntStatus;
+
+ // Make sure the user is asking for a reasonable nDosDriveNo
+ if (mount->nDosDriveNo >= 0 && mount->nDosDriveNo <= 25 && IsDriveLetterAvailable (mount->nDosDriveNo))
+ {
+ Dump ("Mount request looks valid\n");
+ }
+ else
+ {
+ Dump ("WARNING: MOUNT DRIVE LETTER INVALID\n");
+ mount->nReturnCode = ERR_DRIVE_NOT_FOUND;
+ return ERR_DRIVE_NOT_FOUND;
+ }
+
+ if (!SelfTestsPassed)
+ {
+ mount->nReturnCode = ERR_SELF_TESTS_FAILED;
+ return ERR_SELF_TESTS_FAILED;
+ }
+
+ ntStatus = TCCreateDeviceObject (DeviceObject->DriverObject, &NewDeviceObject, mount);
+
+ if (!NT_SUCCESS (ntStatus))
+ {
+ Dump ("Mount CREATE DEVICE ERROR, ntStatus = 0x%08x\n", ntStatus);
+ return ntStatus;
+ }
+ else
+ {
+ PEXTENSION NewExtension = (PEXTENSION) NewDeviceObject->DeviceExtension;
+ SECURITY_SUBJECT_CONTEXT subContext;
+ PACCESS_TOKEN accessToken;
+
+ SeCaptureSubjectContext (&subContext);
+ accessToken = SeQuerySubjectContextToken (&subContext);
+
+ if (!accessToken)
+ {
+ ntStatus = STATUS_INVALID_PARAMETER;
+ }
+ else
+ {
+ PTOKEN_USER tokenUser;
+
+ ntStatus = SeQueryInformationToken (accessToken, TokenUser, &tokenUser);
+ if (NT_SUCCESS (ntStatus))
+ {
+ ULONG sidLength = RtlLengthSid (tokenUser->User.Sid);
+
+ NewExtension->UserSid = TCalloc (sidLength);
+ if (!NewExtension->UserSid)
+ ntStatus = STATUS_INSUFFICIENT_RESOURCES;
+ else
+ ntStatus = RtlCopySid (sidLength, NewExtension->UserSid, tokenUser->User.Sid);
+
+ ExFreePool (tokenUser); // Documented in newer versions of WDK
+ }
+ }
+
+ SeReleaseSubjectContext (&subContext);
+
+ if (NT_SUCCESS (ntStatus))
+ ntStatus = TCStartVolumeThread (NewDeviceObject, NewExtension, mount);
+
+ if (!NT_SUCCESS (ntStatus))
+ {
+ Dump ("Mount FAILURE NT ERROR, ntStatus = 0x%08x\n", ntStatus);
+ TCDeleteDeviceObject (NewDeviceObject, NewExtension);
+ return ntStatus;
+ }
+ else
+ {
+ if (mount->nReturnCode == 0)
+ {
+ HANDLE volumeHandle;
+ PFILE_OBJECT volumeFileObject;
+
+ Dump ("Mount SUCCESS TC code = 0x%08x READ-ONLY = %d\n", mount->nReturnCode, NewExtension->bReadOnly);
+
+ if (NewExtension->bReadOnly)
+ NewDeviceObject->Characteristics |= FILE_READ_ONLY_DEVICE;
+
+ NewDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
+
+ NewExtension->UniqueVolumeId = LastUniqueVolumeId++;
+
+ if (mount->bMountManager)
+ MountManagerMount (mount);
+
+ NewExtension->bMountManager = mount->bMountManager;
+
+ // We create symbolic link even if mount manager is notified of
+ // arriving volume as it apparently sometimes fails to create the link
+ CreateDriveLink (mount->nDosDriveNo);
+
+ mount->FilesystemDirty = FALSE;
+
+ if (NT_SUCCESS (TCOpenFsVolume (NewExtension, &volumeHandle, &volumeFileObject)))
+ {
+ __try
+ {
+ ULONG fsStatus;
+
+ if (NT_SUCCESS (TCFsctlCall (volumeFileObject, FSCTL_IS_VOLUME_DIRTY, NULL, 0, &fsStatus, sizeof (fsStatus)))
+ && (fsStatus & VOLUME_IS_DIRTY))
+ {
+ mount->FilesystemDirty = TRUE;
+ }
+ }
+ __except (EXCEPTION_EXECUTE_HANDLER)
+ {
+ mount->FilesystemDirty = TRUE;
+ }
+
+
+ TCCloseFsVolume (volumeHandle, volumeFileObject);
+ }
+ }
+ else
+ {
+ Dump ("Mount FAILURE TC code = 0x%08x\n", mount->nReturnCode);
+ TCDeleteDeviceObject (NewDeviceObject, NewExtension);
+ }
+
+ return STATUS_SUCCESS;
+ }
+ }
+}
+
+NTSTATUS UnmountDevice (UNMOUNT_STRUCT *unmountRequest, PDEVICE_OBJECT deviceObject, BOOL ignoreOpenFiles)
+{
+ PEXTENSION extension = deviceObject->DeviceExtension;
+ NTSTATUS ntStatus;
+ HANDLE volumeHandle;
+ PFILE_OBJECT volumeFileObject;
+
+ Dump ("UnmountDevice %d\n", extension->nDosDriveNo);
+
+ ntStatus = TCOpenFsVolume (extension, &volumeHandle, &volumeFileObject);
+
+ if (NT_SUCCESS (ntStatus))
+ {
+ int dismountRetry;
+
+ // Dismounting a writable NTFS filesystem prevents the driver from being unloaded on Windows 7
+ if (IsOSAtLeast (WIN_7) && !extension->bReadOnly)
+ {
+ NTFS_VOLUME_DATA_BUFFER ntfsData;
+
+ if (NT_SUCCESS (TCFsctlCall (volumeFileObject, FSCTL_GET_NTFS_VOLUME_DATA, NULL, 0, &ntfsData, sizeof (ntfsData))))
+ DriverUnloadDisabled = TRUE;
+ }
+
+ // Lock volume
+ ntStatus = TCFsctlCall (volumeFileObject, FSCTL_LOCK_VOLUME, NULL, 0, NULL, 0);
+ Dump ("FSCTL_LOCK_VOLUME returned %X\n", ntStatus);
+
+ if (!NT_SUCCESS (ntStatus) && !ignoreOpenFiles)
+ {
+ TCCloseFsVolume (volumeHandle, volumeFileObject);
+ return ERR_FILES_OPEN;
+ }
+
+ // Dismount volume
+ for (dismountRetry = 0; dismountRetry < 200; ++dismountRetry)
+ {
+ ntStatus = TCFsctlCall (volumeFileObject, FSCTL_DISMOUNT_VOLUME, NULL, 0, NULL, 0);
+ Dump ("FSCTL_DISMOUNT_VOLUME returned %X\n", ntStatus);
+
+ if (NT_SUCCESS (ntStatus) || ntStatus == STATUS_VOLUME_DISMOUNTED)
+ break;
+
+ if (!ignoreOpenFiles)
+ {
+ TCCloseFsVolume (volumeHandle, volumeFileObject);
+ return ERR_FILES_OPEN;
+ }
+
+ TCSleep (100);
+ }
+ }
+ else
+ {
+ // Volume cannot be opened => force dismount if allowed
+ if (!ignoreOpenFiles)
+ return ERR_FILES_OPEN;
+ else
+ volumeHandle = NULL;
+ }
+
+ if (extension->bMountManager)
+ MountManagerUnmount (extension->nDosDriveNo);
+
+ // We always remove symbolic link as mount manager might fail to do so
+ RemoveDriveLink (extension->nDosDriveNo);
+
+ extension->bShuttingDown = TRUE;
+
+ ntStatus = IoAcquireRemoveLock (&extension->Queue.RemoveLock, NULL);
+ ASSERT (NT_SUCCESS (ntStatus));
+ IoReleaseRemoveLockAndWait (&extension->Queue.RemoveLock, NULL);
+
+ if (volumeHandle != NULL)
+ TCCloseFsVolume (volumeHandle, volumeFileObject);
+
+ if (unmountRequest)
+ {
+ PCRYPTO_INFO cryptoInfo = ((PEXTENSION) deviceObject->DeviceExtension)->cryptoInfo;
+ unmountRequest->HiddenVolumeProtectionTriggered = (cryptoInfo->bProtectHiddenVolume && cryptoInfo->bHiddenVolProtectionAction);
+ }
+
+ TCDeleteDeviceObject (deviceObject, (PEXTENSION) deviceObject->DeviceExtension);
+ return 0;
+}
+
+
+static PDEVICE_OBJECT FindVolumeWithHighestUniqueId (int maxUniqueId)
+{
+ PDEVICE_OBJECT highestIdDevice = NULL;
+ int highestId = -1;
+ int drive;
+
+ for (drive = MIN_MOUNTED_VOLUME_DRIVE_NUMBER; drive <= MAX_MOUNTED_VOLUME_DRIVE_NUMBER; ++drive)
+ {
+ PDEVICE_OBJECT device = GetVirtualVolumeDeviceObject (drive);
+ if (device)
+ {
+ PEXTENSION extension = (PEXTENSION) device->DeviceExtension;
+ if (extension->UniqueVolumeId > highestId && extension->UniqueVolumeId <= maxUniqueId)
+ {
+ highestId = extension->UniqueVolumeId;
+ highestIdDevice = device;
+ }
+ }
+ }
+
+ return highestIdDevice;
+}
+
+
+NTSTATUS UnmountAllDevices (UNMOUNT_STRUCT *unmountRequest, BOOL ignoreOpenFiles)
+{
+ NTSTATUS status = 0;
+ PDEVICE_OBJECT ListDevice;
+ int maxUniqueId = LastUniqueVolumeId;
+
+ Dump ("Unmounting all volumes\n");
+
+ if (unmountRequest)
+ unmountRequest->HiddenVolumeProtectionTriggered = FALSE;
+
+ // Dismount volumes in the reverse order they were mounted to properly dismount nested volumes
+ while ((ListDevice = FindVolumeWithHighestUniqueId (maxUniqueId)) != NULL)
+ {
+ PEXTENSION ListExtension = (PEXTENSION) ListDevice->DeviceExtension;
+ maxUniqueId = ListExtension->UniqueVolumeId - 1;
+
+ if (IsVolumeAccessibleByCurrentUser (ListExtension))
+ {
+ NTSTATUS ntStatus;
+
+ if (unmountRequest)
+ unmountRequest->nDosDriveNo = ListExtension->nDosDriveNo;
+
+ ntStatus = UnmountDevice (unmountRequest, ListDevice, ignoreOpenFiles);
+ status = ntStatus == 0 ? status : ntStatus;
+
+ if (unmountRequest && unmountRequest->HiddenVolumeProtectionTriggered)
+ break;
+ }
+ }
+
+ return status;
+}
+
+// Resolves symbolic link name to its target name
+NTSTATUS SymbolicLinkToTarget (PWSTR symlinkName, PWSTR targetName, USHORT maxTargetNameLength)
+{
+ NTSTATUS ntStatus;
+ OBJECT_ATTRIBUTES objectAttributes;
+ UNICODE_STRING fullFileName;
+ HANDLE handle;
+
+ RtlInitUnicodeString (&fullFileName, symlinkName);
+ InitializeObjectAttributes (&objectAttributes, &fullFileName, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);
+
+ ntStatus = ZwOpenSymbolicLinkObject (&handle, GENERIC_READ, &objectAttributes);
+
+ if (NT_SUCCESS (ntStatus))
+ {
+ UNICODE_STRING target;
+ target.Buffer = targetName;
+ target.Length = 0;
+ target.MaximumLength = maxTargetNameLength;
+ memset (targetName, 0, maxTargetNameLength);
+
+ ntStatus = ZwQuerySymbolicLinkObject (handle, &target, NULL);
+
+ ZwClose (handle);
+ }
+
+ return ntStatus;
+}
+
+
+// Checks if two regions overlap (borders are parts of regions)
+BOOL RegionsOverlap (unsigned __int64 start1, unsigned __int64 end1, unsigned __int64 start2, unsigned __int64 end2)
+{
+ return (start1 < start2) ? (end1 >= start2) : (start1 <= end2);
+}
+
+
+void GetIntersection (uint64 start1, uint32 length1, uint64 start2, uint64 end2, uint64 *intersectStart, uint32 *intersectLength)
+{
+ uint64 end1 = start1 + length1 - 1;
+ uint64 intersectEnd = (end1 <= end2) ? end1 : end2;
+
+ *intersectStart = (start1 >= start2) ? start1 : start2;
+ *intersectLength = (uint32) ((*intersectStart > intersectEnd) ? 0 : intersectEnd + 1 - *intersectStart);
+
+ if (*intersectLength == 0)
+ *intersectStart = start1;
+}
+
+
+BOOL IsAccessibleByUser (PUNICODE_STRING objectFileName, BOOL readOnly)
+{
+ OBJECT_ATTRIBUTES fileObjAttributes;
+ IO_STATUS_BLOCK ioStatusBlock;
+ HANDLE fileHandle;
+ NTSTATUS status;
+
+ ASSERT (!IoIsSystemThread (PsGetCurrentThread()));
+
+ InitializeObjectAttributes (&fileObjAttributes, objectFileName, OBJ_CASE_INSENSITIVE | OBJ_FORCE_ACCESS_CHECK | OBJ_KERNEL_HANDLE, NULL, NULL);
+
+ status = ZwCreateFile (&fileHandle,
+ readOnly ? GENERIC_READ : GENERIC_READ | GENERIC_WRITE,
+ &fileObjAttributes,
+ &ioStatusBlock,
+ NULL,
+ FILE_ATTRIBUTE_NORMAL,
+ FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+ FILE_OPEN,
+ FILE_SYNCHRONOUS_IO_NONALERT,
+ NULL,
+ 0);
+
+ if (NT_SUCCESS (status))
+ {
+ ZwClose (fileHandle);
+ return TRUE;
+ }
+
+ return FALSE;
+}
+
+
+BOOL UserCanAccessDriveDevice ()
+{
+ UNICODE_STRING name;
+ RtlInitUnicodeString (&name, L"\\Device\\MountPointManager");
+
+ return IsAccessibleByUser (&name, FALSE);
+}
+
+
+BOOL IsDriveLetterAvailable (int nDosDriveNo)
+{
+ OBJECT_ATTRIBUTES objectAttributes;
+ UNICODE_STRING objectName;
+ WCHAR link[128];
+ HANDLE handle;
+
+ TCGetDosNameFromNumber (link, nDosDriveNo);
+ RtlInitUnicodeString (&objectName, link);
+ InitializeObjectAttributes (&objectAttributes, &objectName, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);
+
+ if (NT_SUCCESS (ZwOpenSymbolicLinkObject (&handle, GENERIC_READ, &objectAttributes)))
+ {
+ ZwClose (handle);
+ return FALSE;
+ }
+
+ return TRUE;
+}
+
+
+NTSTATUS TCCompleteIrp (PIRP irp, NTSTATUS status, ULONG_PTR information)
+{
+ irp->IoStatus.Status = status;
+ irp->IoStatus.Information = information;
+ IoCompleteRequest (irp, IO_NO_INCREMENT);
+ return status;
+}
+
+
+NTSTATUS TCCompleteDiskIrp (PIRP irp, NTSTATUS status, ULONG_PTR information)
+{
+ irp->IoStatus.Status = status;
+ irp->IoStatus.Information = information;
+ IoCompleteRequest (irp, NT_SUCCESS (status) ? IO_DISK_INCREMENT : IO_NO_INCREMENT);
+ return status;
+}
+
+
+size_t GetCpuCount ()
+{
+ KAFFINITY activeCpuMap = KeQueryActiveProcessors();
+ size_t mapSize = sizeof (activeCpuMap) * 8;
+ size_t cpuCount = 0;
+
+ while (mapSize--)
+ {
+ if (activeCpuMap & 1)
+ ++cpuCount;
+
+ activeCpuMap >>= 1;
+ }
+
+ if (cpuCount == 0)
+ return 1;
+
+ return cpuCount;
+}
+
+
+void EnsureNullTerminatedString (wchar_t *str, size_t maxSizeInBytes)
+{
+ ASSERT ((maxSizeInBytes & 1) == 0);
+ str[maxSizeInBytes / sizeof (wchar_t) - 1] = 0;
+}
+
+
+void *AllocateMemoryWithTimeout (size_t size, int retryDelay, int timeout)
+{
+ LARGE_INTEGER waitInterval;
+ waitInterval.QuadPart = retryDelay * -10000;
+
+ ASSERT (KeGetCurrentIrql() <= APC_LEVEL);
+ ASSERT (retryDelay > 0 && retryDelay <= timeout);
+
+ while (TRUE)
+ {
+ void *memory = TCalloc (size);
+ if (memory)
+ return memory;
+
+ timeout -= retryDelay;
+ if (timeout <= 0)
+ break;
+
+ KeDelayExecutionThread (KernelMode, FALSE, &waitInterval);
+ }
+
+ return NULL;
+}
+
+
+NTSTATUS TCReadRegistryKey (PUNICODE_STRING keyPath, wchar_t *keyValueName, PKEY_VALUE_PARTIAL_INFORMATION *keyData)
+{
+ OBJECT_ATTRIBUTES regObjAttribs;
+ HANDLE regKeyHandle;
+ NTSTATUS status;
+ UNICODE_STRING valName;
+ ULONG size = 0;
+ ULONG resultSize;
+
+ InitializeObjectAttributes (&regObjAttribs, keyPath, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);
+ status = ZwOpenKey (&regKeyHandle, KEY_READ, &regObjAttribs);
+ if (!NT_SUCCESS (status))
+ return status;
+
+ RtlInitUnicodeString (&valName, keyValueName);
+ status = ZwQueryValueKey (regKeyHandle, &valName, KeyValuePartialInformation, NULL, 0, &size);
+
+ if (!NT_SUCCESS (status) && status != STATUS_BUFFER_OVERFLOW && status != STATUS_BUFFER_TOO_SMALL)
+ {
+ ZwClose (regKeyHandle);
+ return status;
+ }
+
+ if (size == 0)
+ {
+ ZwClose (regKeyHandle);
+ return STATUS_NO_DATA_DETECTED;
+ }
+
+ *keyData = (PKEY_VALUE_PARTIAL_INFORMATION) TCalloc (size);
+ if (!*keyData)
+ {
+ ZwClose (regKeyHandle);
+ return STATUS_INSUFFICIENT_RESOURCES;
+ }
+
+ status = ZwQueryValueKey (regKeyHandle, &valName, KeyValuePartialInformation, *keyData, size, &resultSize);
+
+ ZwClose (regKeyHandle);
+ return status;
+}
+
+
+NTSTATUS TCWriteRegistryKey (PUNICODE_STRING keyPath, wchar_t *keyValueName, ULONG keyValueType, void *valueData, ULONG valueSize)
+{
+ OBJECT_ATTRIBUTES regObjAttribs;
+ HANDLE regKeyHandle;
+ NTSTATUS status;
+ UNICODE_STRING valName;
+
+ InitializeObjectAttributes (&regObjAttribs, keyPath, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);
+ status = ZwOpenKey (&regKeyHandle, KEY_READ | KEY_WRITE, &regObjAttribs);
+ if (!NT_SUCCESS (status))
+ return status;
+
+ RtlInitUnicodeString (&valName, keyValueName);
+
+ status = ZwSetValueKey (regKeyHandle, &valName, 0, keyValueType, valueData, valueSize);
+
+ ZwClose (regKeyHandle);
+ return status;
+}
+
+
+BOOL IsVolumeClassFilterRegistered ()
+{
+ UNICODE_STRING name;
+ NTSTATUS status;
+ BOOL registered = FALSE;
+
+ PKEY_VALUE_PARTIAL_INFORMATION data;
+
+ RtlInitUnicodeString (&name, L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Class\\{71A27CDD-812A-11D0-BEC7-08002BE2092F}");
+ status = TCReadRegistryKey (&name, L"UpperFilters", &data);
+
+ if (NT_SUCCESS (status))
+ {
+ if (data->Type == REG_MULTI_SZ && data->DataLength >= 9 * sizeof (wchar_t))
+ {
+ // Search for the string "truecrypt"
+ ULONG i;
+ for (i = 0; i <= data->DataLength - 9 * sizeof (wchar_t); ++i)
+ {
+ if (memcmp (data->Data + i, L"truecrypt", 9 * sizeof (wchar_t)) == 0)
+ {
+ Dump ("Volume class filter active\n");
+ registered = TRUE;
+ break;
+ }
+ }
+ }
+
+ TCfree (data);
+ }
+
+ return registered;
+}
+
+
+NTSTATUS ReadRegistryConfigFlags (BOOL driverEntry)
+{
+ PKEY_VALUE_PARTIAL_INFORMATION data;
+ UNICODE_STRING name;
+ NTSTATUS status;
+ uint32 flags = 0;
+
+ RtlInitUnicodeString (&name, L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\\truecrypt");
+ status = TCReadRegistryKey (&name, TC_DRIVER_CONFIG_REG_VALUE_NAME, &data);
+
+ if (NT_SUCCESS (status))
+ {
+ if (data->Type == REG_DWORD)
+ {
+ flags = *(uint32 *) data->Data;
+ Dump ("Configuration flags = 0x%x\n", flags);
+
+ if (driverEntry)
+ {
+ if (flags & (TC_DRIVER_CONFIG_CACHE_BOOT_PASSWORD | TC_DRIVER_CONFIG_CACHE_BOOT_PASSWORD_FOR_SYS_FAVORITES))
+ CacheBootPassword = TRUE;
+
+ if (flags & TC_DRIVER_CONFIG_DISABLE_NONADMIN_SYS_FAVORITES_ACCESS)
+ NonAdminSystemFavoritesAccessDisabled = TRUE;
+ }
+
+ EnableHwEncryption ((flags & TC_DRIVER_CONFIG_DISABLE_HARDWARE_ENCRYPTION) ? FALSE : TRUE);
+ }
+ else
+ status = STATUS_INVALID_PARAMETER;
+
+ TCfree (data);
+ }
+
+ if (driverEntry && NT_SUCCESS (TCReadRegistryKey (&name, TC_ENCRYPTION_FREE_CPU_COUNT_REG_VALUE_NAME, &data)))
+ {
+ if (data->Type == REG_DWORD)
+ EncryptionThreadPoolFreeCpuCountLimit = *(uint32 *) data->Data;
+
+ TCfree (data);
+ }
+
+ return status;
+}
+
+
+NTSTATUS WriteRegistryConfigFlags (uint32 flags)
+{
+ UNICODE_STRING name;
+ RtlInitUnicodeString (&name, L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\\truecrypt");
+
+ return TCWriteRegistryKey (&name, TC_DRIVER_CONFIG_REG_VALUE_NAME, REG_DWORD, &flags, sizeof (flags));
+}
+
+
+NTSTATUS GetDeviceSectorSize (PDEVICE_OBJECT deviceObject, ULONG *bytesPerSector)
+{
+ NTSTATUS status;
+ DISK_GEOMETRY geometry;
+
+ status = SendDeviceIoControlRequest (deviceObject, IOCTL_DISK_GET_DRIVE_GEOMETRY, NULL, 0, &geometry, sizeof (geometry));
+
+ if (!NT_SUCCESS (status))
+ return status;
+
+ *bytesPerSector = geometry.BytesPerSector;
+ return STATUS_SUCCESS;
+}
+
+
+NTSTATUS ZeroUnreadableSectors (PDEVICE_OBJECT deviceObject, LARGE_INTEGER startOffset, ULONG size, uint64 *zeroedSectorCount)
+{
+ NTSTATUS status;
+ ULONG sectorSize;
+ ULONG sectorCount;
+ byte *sectorBuffer = NULL;
+
+ *zeroedSectorCount = 0;
+
+ status = GetDeviceSectorSize (deviceObject, &sectorSize);
+ if (!NT_SUCCESS (status))
+ return status;
+
+ sectorBuffer = TCalloc (sectorSize);
+ if (!sectorBuffer)
+ return STATUS_INSUFFICIENT_RESOURCES;
+
+ for (sectorCount = size / sectorSize; sectorCount > 0; --sectorCount, startOffset.QuadPart += sectorSize)
+ {
+ status = TCReadDevice (deviceObject, sectorBuffer, startOffset, sectorSize);
+ if (!NT_SUCCESS (status))
+ {
+ Dump ("Zeroing sector at %I64d\n", startOffset.QuadPart);
+ memset (sectorBuffer, 0, sectorSize);
+
+ status = TCWriteDevice (deviceObject, sectorBuffer, startOffset, sectorSize);
+ if (!NT_SUCCESS (status))
+ goto err;
+
+ ++(*zeroedSectorCount);
+ }
+ }
+
+ status = STATUS_SUCCESS;
+
+err:
+ if (sectorBuffer)
+ TCfree (sectorBuffer);
+
+ return status;
+}
+
+
+NTSTATUS ReadDeviceSkipUnreadableSectors (PDEVICE_OBJECT deviceObject, byte *buffer, LARGE_INTEGER startOffset, ULONG size, uint64 *badSectorCount)
+{
+ NTSTATUS status;
+ ULONG sectorSize;
+ ULONG sectorCount;
+
+ *badSectorCount = 0;
+
+ status = GetDeviceSectorSize (deviceObject, &sectorSize);
+ if (!NT_SUCCESS (status))
+ return status;
+
+ for (sectorCount = size / sectorSize; sectorCount > 0; --sectorCount, startOffset.QuadPart += sectorSize, buffer += sectorSize)
+ {
+ status = TCReadDevice (deviceObject, buffer, startOffset, sectorSize);
+ if (!NT_SUCCESS (status))
+ {
+ Dump ("Skipping bad sector at %I64d\n", startOffset.QuadPart);
+ memset (buffer, 0, sectorSize);
+ ++(*badSectorCount);
+ }
+ }
+
+ return STATUS_SUCCESS;
+}
+
+
+BOOL IsVolumeAccessibleByCurrentUser (PEXTENSION volumeDeviceExtension)
+{
+ SECURITY_SUBJECT_CONTEXT subContext;
+ PACCESS_TOKEN accessToken;
+ PTOKEN_USER tokenUser;
+ BOOL result = FALSE;
+
+ if (IoIsSystemThread (PsGetCurrentThread())
+ || UserCanAccessDriveDevice()
+ || !volumeDeviceExtension->UserSid
+ || (volumeDeviceExtension->SystemFavorite && !NonAdminSystemFavoritesAccessDisabled))
+ {
+ return TRUE;
+ }
+
+ SeCaptureSubjectContext (&subContext);
+ accessToken = SeQuerySubjectContextToken (&subContext);
+
+ if (!accessToken)
+ goto ret;
+
+ if (SeTokenIsAdmin (accessToken))
+ {
+ result = TRUE;
+ goto ret;
+ }
+
+ if (!NT_SUCCESS (SeQueryInformationToken (accessToken, TokenUser, &tokenUser)))
+ goto ret;
+
+ result = RtlEqualSid (volumeDeviceExtension->UserSid, tokenUser->User.Sid);
+ ExFreePool (tokenUser); // Documented in newer versions of WDK
+
+ret:
+ SeReleaseSubjectContext (&subContext);
+ return result;
+}
+
+
+void GetElapsedTimeInit (LARGE_INTEGER *lastPerfCounter)
+{
+ *lastPerfCounter = KeQueryPerformanceCounter (NULL);
+}
+
+
+// Returns elapsed time in microseconds since last call
+int64 GetElapsedTime (LARGE_INTEGER *lastPerfCounter)
+{
+ LARGE_INTEGER freq;
+ LARGE_INTEGER counter = KeQueryPerformanceCounter (&freq);
+
+ int64 elapsed = (counter.QuadPart - lastPerfCounter->QuadPart) * 1000000LL / freq.QuadPart;
+ *lastPerfCounter = counter;
+
+ return elapsed;
+}
+
+
+BOOL IsOSAtLeast (OSVersionEnum reqMinOS)
+{
+ /* When updating this function, update IsOSVersionAtLeast() in Dlgcode.c too. */
+
+ ULONG major = 0, minor = 0;
+
+ ASSERT (OsMajorVersion != 0);
+
+ switch (reqMinOS)
+ {
+ case WIN_2000: major = 5; minor = 0; break;
+ case WIN_XP: major = 5; minor = 1; break;
+ case WIN_SERVER_2003: major = 5; minor = 2; break;
+ case WIN_VISTA: major = 6; minor = 0; break;
+ case WIN_7: major = 6; minor = 1; break;
+
+ default:
+ TC_THROW_FATAL_EXCEPTION;
+ break;
+ }
+
+ return ((OsMajorVersion << 16 | OsMinorVersion << 8)
+ >= (major << 16 | minor << 8));
+}
diff --git a/src/Driver/Ntdriver.h b/src/Driver/Ntdriver.h
new file mode 100644
index 00000000..66903b6c
--- /dev/null
+++ b/src/Driver/Ntdriver.h
@@ -0,0 +1,174 @@
+/*
+ Legal Notice: Some portions of the source code contained in this file were
+ derived from the source code of Encryption for the Masses 2.02a, which is
+ Copyright (c) 1998-2000 Paul Le Roux and which is governed by the 'License
+ Agreement for Encryption for the Masses'. Modifications and additions to
+ the original source code (contained in this file) and all other portions
+ of this file are Copyright (c) 2003-2011 TrueCrypt Developers Association
+ and are governed by the TrueCrypt License 3.0 the full text of which is
+ contained in the file License.txt included in TrueCrypt binary and source
+ code distribution packages. */
+
+#ifndef TC_HEADER_NTDRIVER
+#define TC_HEADER_NTDRIVER
+
+#include "Common.h"
+#include "EncryptedIoQueue.h"
+
+/* This structure is used to start new threads */
+typedef struct _THREAD_BLOCK_
+{
+ PDEVICE_OBJECT DeviceObject;
+ NTSTATUS ntCreateStatus;
+ WCHAR wszMountVolume[TC_MAX_PATH + 8];
+ MOUNT_STRUCT *mount;
+} THREAD_BLOCK, *PTHREAD_BLOCK;
+
+
+/* This structure is allocated for non-root devices! WARNING: bRootDevice
+ must be the first member of the structure! */
+typedef struct EXTENSION
+{
+ BOOL bRootDevice; /* Is this the root device ? which the user-mode apps talk to */
+ BOOL IsVolumeDevice;
+ BOOL IsDriveFilterDevice;
+ BOOL IsVolumeFilterDevice;
+
+ int UniqueVolumeId;
+ int nDosDriveNo; /* Drive number this extension is mounted against */
+
+ BOOL bShuttingDown; /* Is the driver shutting down ? */
+ BOOL bThreadShouldQuit; /* Instruct per device worker thread to quit */
+ PETHREAD peThread; /* Thread handle */
+ KEVENT keCreateEvent; /* Device creation event */
+ KSPIN_LOCK ListSpinLock; /* IRP spinlock */
+ LIST_ENTRY ListEntry; /* IRP listentry */
+ KSEMAPHORE RequestSemaphore; /* IRP list request Semaphore */
+
+ HANDLE hDeviceFile; /* Device handle for this device */
+ PFILE_OBJECT pfoDeviceFile; /* Device fileobject for this device */
+ PDEVICE_OBJECT pFsdDevice; /* lower level device handle */
+
+ CRYPTO_INFO *cryptoInfo; /* Cryptographic and other information for this device */
+
+ __int64 HostLength;
+ __int64 DiskLength; /* The length of the disk referred to by this device */
+ __int64 NumberOfCylinders; /* Partition info */
+ ULONG TracksPerCylinder; /* Partition info */
+ ULONG SectorsPerTrack; /* Partition info */
+ ULONG BytesPerSector; /* Partition info */
+ UCHAR PartitionType; /* Partition info */
+
+ uint32 HostBytesPerSector;
+
+ KEVENT keVolumeEvent; /* Event structure used when setting up a device */
+
+ EncryptedIoQueue Queue;
+
+ BOOL bReadOnly; /* Is this device read-only ? */
+ BOOL bRemovable; /* Is this device removable media ? */
+ BOOL PartitionInInactiveSysEncScope;
+ BOOL bRawDevice; /* Is this a raw-partition or raw-floppy device ? */
+ BOOL bMountManager; /* Mount manager knows about volume */
+ BOOL SystemFavorite;
+
+ WCHAR wszVolume[TC_MAX_PATH]; /* DONT change this size without also changing MOUNT_LIST_STRUCT! */
+
+ LARGE_INTEGER fileCreationTime;
+ LARGE_INTEGER fileLastAccessTime;
+ LARGE_INTEGER fileLastWriteTime;
+ LARGE_INTEGER fileLastChangeTime;
+ BOOL bTimeStampValid;
+
+ PSID UserSid;
+ BOOL SecurityClientContextValid;
+ SECURITY_CLIENT_CONTEXT SecurityClientContext;
+
+} EXTENSION, *PEXTENSION;
+
+
+typedef enum
+{
+ ValidateInput,
+ ValidateOutput,
+ ValidateInputOutput
+} ValidateIOBufferSizeType;
+
+
+extern PDRIVER_OBJECT TCDriverObject;
+extern PDEVICE_OBJECT RootDeviceObject;
+extern BOOL DriverShuttingDown;
+extern ULONG OsMajorVersion;
+extern ULONG OsMinorVersion;
+extern BOOL VolumeClassFilterRegistered;
+extern BOOL CacheBootPassword;
+
+/* Helper macro returning x seconds in units of 100 nanoseconds */
+#define WAIT_SECONDS(x) ((x)*10000000)
+
+NTSTATUS DriverEntry (PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath);
+NTSTATUS DriverAddDevice (PDRIVER_OBJECT driverObject, PDEVICE_OBJECT pdo);
+void DumpMemory (void *memory, int size);
+BOOL IsAccessibleByUser (PUNICODE_STRING objectFileName, BOOL readOnly);
+NTSTATUS ProcessMainDeviceControlIrp (PDEVICE_OBJECT DeviceObject, PEXTENSION Extension, PIRP Irp);
+NTSTATUS ProcessVolumeDeviceControlIrp (PDEVICE_OBJECT DeviceObject, PEXTENSION Extension, PIRP Irp);
+NTSTATUS SendDeviceIoControlRequest (PDEVICE_OBJECT deviceObject, ULONG ioControlCode, void *inputBuffer, int inputBufferSize, void *outputBuffer, int outputBufferSize);
+NTSTATUS TCDispatchQueueIRP (PDEVICE_OBJECT DeviceObject, PIRP Irp);
+NTSTATUS TCCreateRootDeviceObject (PDRIVER_OBJECT DriverObject);
+NTSTATUS TCCreateDeviceObject (PDRIVER_OBJECT DriverObject, PDEVICE_OBJECT * ppDeviceObject, MOUNT_STRUCT * mount);
+NTSTATUS TCReadDevice (PDEVICE_OBJECT deviceObject, PVOID buffer, LARGE_INTEGER offset, ULONG length);
+NTSTATUS TCWriteDevice (PDEVICE_OBJECT deviceObject, PVOID buffer, LARGE_INTEGER offset, ULONG length);
+NTSTATUS TCStartThread (PKSTART_ROUTINE threadProc, PVOID threadArg, PKTHREAD *kThread);
+NTSTATUS TCStartThreadInProcess (PKSTART_ROUTINE threadProc, PVOID threadArg, PKTHREAD *kThread, PEPROCESS process);
+NTSTATUS TCStartVolumeThread (PDEVICE_OBJECT DeviceObject, PEXTENSION Extension, MOUNT_STRUCT * mount);
+void TCStopThread (PKTHREAD kThread, PKEVENT wakeUpEvent);
+void TCStopVolumeThread (PDEVICE_OBJECT DeviceObject, PEXTENSION Extension);
+VOID VolumeThreadProc (PVOID Context);
+void TCSleep (int milliSeconds);
+void TCGetNTNameFromNumber (LPWSTR ntname, int nDriveNo);
+void TCGetDosNameFromNumber (LPWSTR dosname, int nDriveNo);
+LPWSTR TCTranslateCode (ULONG ulCode);
+void TCDeleteDeviceObject (PDEVICE_OBJECT DeviceObject, PEXTENSION Extension);
+VOID TCUnloadDriver (PDRIVER_OBJECT DriverObject);
+void OnShutdownPending ();
+NTSTATUS TCDeviceIoControl (PWSTR deviceName, ULONG IoControlCode, void *InputBuffer, ULONG InputBufferSize, void *OutputBuffer, ULONG OutputBufferSize);
+NTSTATUS TCOpenFsVolume (PEXTENSION Extension, PHANDLE volumeHandle, PFILE_OBJECT * fileObject);
+void TCCloseFsVolume (HANDLE volumeHandle, PFILE_OBJECT fileObject);
+NTSTATUS TCFsctlCall (PFILE_OBJECT fileObject, LONG IoControlCode, void *InputBuffer, int InputBufferSize, void *OutputBuffer, int OutputBufferSize);
+NTSTATUS CreateDriveLink (int nDosDriveNo);
+NTSTATUS RemoveDriveLink (int nDosDriveNo);
+NTSTATUS MountManagerMount (MOUNT_STRUCT *mount);
+NTSTATUS MountManagerUnmount (int nDosDriveNo);
+NTSTATUS MountDevice (PDEVICE_OBJECT deviceObject, MOUNT_STRUCT *mount);
+NTSTATUS UnmountDevice (UNMOUNT_STRUCT *unmountRequest, PDEVICE_OBJECT deviceObject, BOOL ignoreOpenFiles);
+NTSTATUS UnmountAllDevices (UNMOUNT_STRUCT *unmountRequest, BOOL ignoreOpenFiles);
+NTSTATUS SymbolicLinkToTarget (PWSTR symlinkName, PWSTR targetName, USHORT maxTargetNameLength);
+BOOL RootDeviceControlMutexAcquireNoWait ();
+void RootDeviceControlMutexRelease ();
+BOOL RegionsOverlap (unsigned __int64 start1, unsigned __int64 end1, unsigned __int64 start2, unsigned __int64 end2);
+void GetIntersection (uint64 start1, uint32 length1, uint64 start2, uint64 end2, uint64 *intersectStart, uint32 *intersectLength);
+NTSTATUS TCCompleteIrp (PIRP irp, NTSTATUS status, ULONG_PTR information);
+NTSTATUS TCCompleteDiskIrp (PIRP irp, NTSTATUS status, ULONG_PTR information);
+NTSTATUS ProbeRealDriveSize (PDEVICE_OBJECT driveDeviceObject, LARGE_INTEGER *driveSize);
+BOOL UserCanAccessDriveDevice ();
+size_t GetCpuCount ();
+void EnsureNullTerminatedString (wchar_t *str, size_t maxSizeInBytes);
+void *AllocateMemoryWithTimeout (size_t size, int retryDelay, int timeout);
+BOOL IsDriveLetterAvailable (int nDosDriveNo);
+NTSTATUS TCReadRegistryKey (PUNICODE_STRING keyPath, wchar_t *keyValueName, PKEY_VALUE_PARTIAL_INFORMATION *keyData);
+NTSTATUS TCWriteRegistryKey (PUNICODE_STRING keyPath, wchar_t *keyValueName, ULONG keyValueType, void *valueData, ULONG valueSize);
+BOOL IsVolumeClassFilterRegistered ();
+NTSTATUS ReadRegistryConfigFlags (BOOL driverEntry);
+NTSTATUS WriteRegistryConfigFlags (uint32 flags);
+BOOL ValidateIOBufferSize (PIRP irp, size_t requiredBufferSize, ValidateIOBufferSizeType type);
+NTSTATUS GetDeviceSectorSize (PDEVICE_OBJECT deviceObject, ULONG *bytesPerSector);
+NTSTATUS ZeroUnreadableSectors (PDEVICE_OBJECT deviceObject, LARGE_INTEGER startOffset, ULONG size, uint64 *zeroedSectorCount);
+NTSTATUS ReadDeviceSkipUnreadableSectors (PDEVICE_OBJECT deviceObject, byte *buffer, LARGE_INTEGER startOffset, ULONG size, uint64 *badSectorCount);
+BOOL IsVolumeAccessibleByCurrentUser (PEXTENSION volumeDeviceExtension);
+void GetElapsedTimeInit (LARGE_INTEGER *lastPerfCounter);
+int64 GetElapsedTime (LARGE_INTEGER *lastPerfCounter);
+BOOL IsOSAtLeast (OSVersionEnum reqMinOS);
+
+#define TC_BUG_CHECK(status) KeBugCheckEx (SECURITY_SYSTEM, __LINE__, (ULONG_PTR) status, 0, 'TC')
+
+#endif // TC_HEADER_NTDRIVER
diff --git a/src/Driver/Ntvol.c b/src/Driver/Ntvol.c
new file mode 100644
index 00000000..caaf9428
--- /dev/null
+++ b/src/Driver/Ntvol.c
@@ -0,0 +1,862 @@
+/*
+ Legal Notice: Some portions of the source code contained in this file were
+ derived from the source code of Encryption for the Masses 2.02a, which is
+ Copyright (c) 1998-2000 Paul Le Roux and which is governed by the 'License
+ Agreement for Encryption for the Masses'. Modifications and additions to
+ the original source code (contained in this file) and all other portions
+ of this file are Copyright (c) 2003-2010 TrueCrypt Developers Association
+ and are governed by the TrueCrypt License 3.0 the full text of which is
+ contained in the file License.txt included in TrueCrypt binary and source
+ code distribution packages. */
+
+#include "TCdefs.h"
+#include <wchar.h>
+#include "Crypto.h"
+#include "Volumes.h"
+
+#include "Apidrvr.h"
+#include "DriveFilter.h"
+#include "Ntdriver.h"
+#include "Ntvol.h"
+#include "VolumeFilter.h"
+
+#include "Boot/Windows/BootCommon.h"
+
+#include "Cache.h"
+
+#if 0 && _DEBUG
+#define EXTRA_INFO 1
+#endif
+
+#pragma warning( disable : 4127 )
+
+volatile BOOL ProbingHostDeviceForWrite = FALSE;
+
+
+NTSTATUS TCOpenVolume (PDEVICE_OBJECT DeviceObject,
+ PEXTENSION Extension,
+ MOUNT_STRUCT *mount,
+ PWSTR pwszMountVolume,
+ BOOL bRawDevice)
+{
+ FILE_STANDARD_INFORMATION FileStandardInfo;
+ FILE_BASIC_INFORMATION FileBasicInfo;
+ OBJECT_ATTRIBUTES oaFileAttributes;
+ UNICODE_STRING FullFileName;
+ IO_STATUS_BLOCK IoStatusBlock;
+ PCRYPTO_INFO cryptoInfoPtr = NULL;
+ PCRYPTO_INFO tmpCryptoInfo = NULL;
+ LARGE_INTEGER lDiskLength;
+ __int64 partitionStartingOffset = 0;
+ int volumeType;
+ char *readBuffer = 0;
+ NTSTATUS ntStatus = 0;
+ BOOL forceAccessCheck = (!bRawDevice && !(OsMajorVersion == 5 &&OsMinorVersion == 0)); // Windows 2000 does not support OBJ_FORCE_ACCESS_CHECK attribute
+ BOOL disableBuffering = TRUE;
+ BOOL exclusiveAccess = mount->bExclusiveAccess;
+
+ Extension->pfoDeviceFile = NULL;
+ Extension->hDeviceFile = NULL;
+ Extension->bTimeStampValid = FALSE;
+
+ RtlInitUnicodeString (&FullFileName, pwszMountVolume);
+ InitializeObjectAttributes (&oaFileAttributes, &FullFileName, OBJ_CASE_INSENSITIVE | (forceAccessCheck ? OBJ_FORCE_ACCESS_CHECK : 0) | OBJ_KERNEL_HANDLE, NULL, NULL);
+ KeInitializeEvent (&Extension->keVolumeEvent, NotificationEvent, FALSE);
+
+ if (Extension->SecurityClientContextValid)
+ {
+ ntStatus = SeImpersonateClientEx (&Extension->SecurityClientContext, NULL);
+ if (!NT_SUCCESS (ntStatus))
+ goto error;
+ }
+
+ mount->VolumeMountedReadOnlyAfterDeviceWriteProtected = FALSE;
+
+ // If we are opening a device, query its size first
+ if (bRawDevice)
+ {
+ PARTITION_INFORMATION pi;
+ PARTITION_INFORMATION_EX pix;
+ LARGE_INTEGER diskLengthInfo;
+ DISK_GEOMETRY dg;
+
+ ntStatus = IoGetDeviceObjectPointer (&FullFileName,
+ FILE_READ_DATA | FILE_READ_ATTRIBUTES,
+ &Extension->pfoDeviceFile,
+ &Extension->pFsdDevice);
+
+ if (!NT_SUCCESS (ntStatus))
+ goto error;
+
+ ntStatus = TCSendHostDeviceIoControlRequest (DeviceObject, Extension, IOCTL_DISK_GET_DRIVE_GEOMETRY, (char *) &dg, sizeof (dg));
+ if (!NT_SUCCESS (ntStatus))
+ goto error;
+
+ lDiskLength.QuadPart = dg.Cylinders.QuadPart * dg.SectorsPerTrack * dg.TracksPerCylinder * dg.BytesPerSector;
+ Extension->HostBytesPerSector = dg.BytesPerSector;
+
+ // Drive geometry is used only when IOCTL_DISK_GET_PARTITION_INFO fails
+ if (NT_SUCCESS (TCSendHostDeviceIoControlRequest (DeviceObject, Extension, IOCTL_DISK_GET_PARTITION_INFO_EX, (char *) &pix, sizeof (pix))))
+ {
+ lDiskLength.QuadPart = pix.PartitionLength.QuadPart;
+ partitionStartingOffset = pix.StartingOffset.QuadPart;
+ }
+ // Windows 2000 does not support IOCTL_DISK_GET_PARTITION_INFO_EX
+ else if (NT_SUCCESS (TCSendHostDeviceIoControlRequest (DeviceObject, Extension, IOCTL_DISK_GET_PARTITION_INFO, (char *) &pi, sizeof (pi))))
+ {
+ lDiskLength.QuadPart = pi.PartitionLength.QuadPart;
+ partitionStartingOffset = pi.StartingOffset.QuadPart;
+ }
+ else if (NT_SUCCESS (TCSendHostDeviceIoControlRequest (DeviceObject, Extension, IOCTL_DISK_GET_LENGTH_INFO, &diskLengthInfo, sizeof (diskLengthInfo))))
+ {
+ lDiskLength = diskLengthInfo;
+ }
+
+ ProbingHostDeviceForWrite = TRUE;
+
+ if (!mount->bMountReadOnly
+ && TCSendHostDeviceIoControlRequest (DeviceObject, Extension,
+ IsHiddenSystemRunning() ? TC_IOCTL_DISK_IS_WRITABLE : IOCTL_DISK_IS_WRITABLE, NULL, 0) == STATUS_MEDIA_WRITE_PROTECTED)
+ {
+ mount->bMountReadOnly = TRUE;
+ DeviceObject->Characteristics |= FILE_READ_ONLY_DEVICE;
+ mount->VolumeMountedReadOnlyAfterDeviceWriteProtected = TRUE;
+ }
+
+ ProbingHostDeviceForWrite = FALSE;
+
+ // Some Windows tools (e.g. diskmgmt, diskpart, vssadmin) fail or experience timeouts when there is a raw device
+ // open for exclusive access. Therefore, exclusive access is used only for file-hosted volumes.
+ // Applications requiring a consistent device image need to acquire exclusive write access first. This is prevented
+ // when a device-hosted volume is mounted.
+
+ exclusiveAccess = FALSE;
+ }
+ else
+ {
+ // Limit the maximum required buffer size
+ if (mount->BytesPerSector > 128 * BYTES_PER_KB)
+ {
+ ntStatus = STATUS_INVALID_PARAMETER;
+ goto error;
+ }
+
+ Extension->HostBytesPerSector = mount->BytesPerSector;
+
+ if (Extension->HostBytesPerSector != TC_SECTOR_SIZE_FILE_HOSTED_VOLUME)
+ disableBuffering = FALSE;
+ }
+
+ // Open the volume hosting file/device
+ if (!mount->bMountReadOnly)
+ {
+ ntStatus = ZwCreateFile (&Extension->hDeviceFile,
+ GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE,
+ &oaFileAttributes,
+ &IoStatusBlock,
+ NULL,
+ FILE_ATTRIBUTE_NORMAL |
+ FILE_ATTRIBUTE_SYSTEM,
+ exclusiveAccess ? 0 : FILE_SHARE_READ | FILE_SHARE_WRITE,
+ FILE_OPEN,
+ FILE_RANDOM_ACCESS |
+ FILE_WRITE_THROUGH |
+ (disableBuffering ? FILE_NO_INTERMEDIATE_BUFFERING : 0) |
+ FILE_SYNCHRONOUS_IO_NONALERT,
+ NULL,
+ 0);
+ }
+
+ /* 26-4-99 NT for some partitions returns this code, it is really a access denied */
+ if (ntStatus == 0xc000001b)
+ ntStatus = STATUS_ACCESS_DENIED;
+
+ mount->VolumeMountedReadOnlyAfterAccessDenied = FALSE;
+
+ if (mount->bMountReadOnly || ntStatus == STATUS_ACCESS_DENIED)
+ {
+ ntStatus = ZwCreateFile (&Extension->hDeviceFile,
+ GENERIC_READ | SYNCHRONIZE,
+ &oaFileAttributes,
+ &IoStatusBlock,
+ NULL,
+ FILE_ATTRIBUTE_NORMAL |
+ FILE_ATTRIBUTE_SYSTEM,
+ exclusiveAccess ? FILE_SHARE_READ : FILE_SHARE_READ | FILE_SHARE_WRITE,
+ FILE_OPEN,
+ FILE_RANDOM_ACCESS |
+ FILE_WRITE_THROUGH |
+ (disableBuffering ? FILE_NO_INTERMEDIATE_BUFFERING : 0) |
+ FILE_SYNCHRONOUS_IO_NONALERT,
+ NULL,
+ 0);
+
+ if (NT_SUCCESS (ntStatus) && !mount->bMountReadOnly)
+ mount->VolumeMountedReadOnlyAfterAccessDenied = TRUE;
+
+ Extension->bReadOnly = TRUE;
+ DeviceObject->Characteristics |= FILE_READ_ONLY_DEVICE;
+ }
+ else
+ Extension->bReadOnly = FALSE;
+
+ /* 26-4-99 NT for some partitions returns this code, it is really a
+ access denied */
+ if (ntStatus == 0xc000001b)
+ {
+ /* Partitions which return this code can still be opened with
+ FILE_SHARE_READ but this causes NT problems elsewhere in
+ particular if you do FILE_SHARE_READ NT will die later if
+ anyone even tries to open the partition (or file for that
+ matter...) */
+ ntStatus = STATUS_SHARING_VIOLATION;
+ }
+
+ if (!NT_SUCCESS (ntStatus))
+ {
+ goto error;
+ }
+
+ // If we have opened a file, query its size now
+ if (bRawDevice == FALSE)
+ {
+ ntStatus = ZwQueryInformationFile (Extension->hDeviceFile,
+ &IoStatusBlock,
+ &FileBasicInfo,
+ sizeof (FileBasicInfo),
+ FileBasicInformation);
+
+ if (NT_SUCCESS (ntStatus))
+ {
+ if (mount->bPreserveTimestamp)
+ {
+ Extension->fileCreationTime = FileBasicInfo.CreationTime;
+ Extension->fileLastAccessTime = FileBasicInfo.LastAccessTime;
+ Extension->fileLastWriteTime = FileBasicInfo.LastWriteTime;
+ Extension->fileLastChangeTime = FileBasicInfo.ChangeTime;
+ Extension->bTimeStampValid = TRUE;
+ }
+
+ ntStatus = ZwQueryInformationFile (Extension->hDeviceFile,
+ &IoStatusBlock,
+ &FileStandardInfo,
+ sizeof (FileStandardInfo),
+ FileStandardInformation);
+ }
+
+ if (!NT_SUCCESS (ntStatus))
+ {
+ Dump ("ZwQueryInformationFile failed while opening file: NTSTATUS 0x%08x\n",
+ ntStatus);
+ goto error;
+ }
+
+ lDiskLength.QuadPart = FileStandardInfo.EndOfFile.QuadPart;
+
+ if (FileBasicInfo.FileAttributes & FILE_ATTRIBUTE_COMPRESSED)
+ {
+ Dump ("File \"%ls\" is marked as compressed - not supported!\n", pwszMountVolume);
+ mount->nReturnCode = ERR_COMPRESSION_NOT_SUPPORTED;
+ ntStatus = STATUS_SUCCESS;
+ goto error;
+ }
+
+ ntStatus = ObReferenceObjectByHandle (Extension->hDeviceFile,
+ FILE_ALL_ACCESS,
+ *IoFileObjectType,
+ KernelMode,
+ &Extension->pfoDeviceFile,
+ 0);
+
+ if (!NT_SUCCESS (ntStatus))
+ {
+ goto error;
+ }
+
+ /* Get the FSD device for the file (probably either NTFS or FAT) */
+ Extension->pFsdDevice = IoGetRelatedDeviceObject (Extension->pfoDeviceFile);
+ }
+ else
+ {
+ // Try to gain "raw" access to the partition in case there is a live filesystem on it (otherwise,
+ // the NTFS driver guards hidden sectors and prevents mounting using a backup header e.g. after the user
+ // accidentally quick-formats a dismounted partition-hosted TrueCrypt volume as NTFS).
+
+ PFILE_OBJECT pfoTmpDeviceFile = NULL;
+
+ if (NT_SUCCESS (ObReferenceObjectByHandle (Extension->hDeviceFile, FILE_ALL_ACCESS, *IoFileObjectType, KernelMode, &pfoTmpDeviceFile, NULL))
+ && pfoTmpDeviceFile != NULL)
+ {
+ TCFsctlCall (pfoTmpDeviceFile, FSCTL_ALLOW_EXTENDED_DASD_IO, NULL, 0, NULL, 0);
+ ObDereferenceObject (pfoTmpDeviceFile);
+ }
+ }
+
+ // Check volume size
+ if (lDiskLength.QuadPart < TC_MIN_VOLUME_SIZE_LEGACY || lDiskLength.QuadPart > TC_MAX_VOLUME_SIZE)
+ {
+ mount->nReturnCode = ERR_VOL_SIZE_WRONG;
+ ntStatus = STATUS_SUCCESS;
+ goto error;
+ }
+
+ Extension->DiskLength = lDiskLength.QuadPart;
+ Extension->HostLength = lDiskLength.QuadPart;
+
+ readBuffer = TCalloc (max (max (TC_VOLUME_HEADER_EFFECTIVE_SIZE, PAGE_SIZE), Extension->HostBytesPerSector));
+ if (readBuffer == NULL)
+ {
+ ntStatus = STATUS_INSUFFICIENT_RESOURCES;
+ goto error;
+ }
+
+ // Go through all volume types (e.g., normal, hidden)
+ for (volumeType = TC_VOLUME_TYPE_NORMAL;
+ volumeType < TC_VOLUME_TYPE_COUNT;
+ volumeType++)
+ {
+ Dump ("Trying to open volume type %d\n", volumeType);
+
+ if (mount->bPartitionInInactiveSysEncScope
+ && volumeType == TC_VOLUME_TYPE_HIDDEN_LEGACY)
+ continue;
+
+ /* Read the volume header */
+
+ if (!mount->bPartitionInInactiveSysEncScope
+ || (mount->bPartitionInInactiveSysEncScope && volumeType == TC_VOLUME_TYPE_HIDDEN))
+ {
+ // Header of a volume that is not within the scope of system encryption, or
+ // header of a system hidden volume (containing a hidden OS)
+
+ LARGE_INTEGER headerOffset;
+
+ if (mount->UseBackupHeader && lDiskLength.QuadPart <= TC_TOTAL_VOLUME_HEADERS_SIZE)
+ continue;
+
+ switch (volumeType)
+ {
+ case TC_VOLUME_TYPE_NORMAL:
+ headerOffset.QuadPart = mount->UseBackupHeader ? lDiskLength.QuadPart - TC_VOLUME_HEADER_GROUP_SIZE : TC_VOLUME_HEADER_OFFSET;
+ break;
+
+ case TC_VOLUME_TYPE_HIDDEN:
+ if (lDiskLength.QuadPart <= TC_VOLUME_HEADER_GROUP_SIZE)
+ continue;
+
+ headerOffset.QuadPart = mount->UseBackupHeader ? lDiskLength.QuadPart - TC_HIDDEN_VOLUME_HEADER_OFFSET : TC_HIDDEN_VOLUME_HEADER_OFFSET;
+ break;
+
+ case TC_VOLUME_TYPE_HIDDEN_LEGACY:
+ if (mount->UseBackupHeader)
+ continue;
+
+ if (bRawDevice && Extension->HostBytesPerSector != TC_SECTOR_SIZE_LEGACY)
+ continue;
+
+ headerOffset.QuadPart = lDiskLength.QuadPart - TC_HIDDEN_VOLUME_HEADER_OFFSET_LEGACY;
+ break;
+ }
+
+ Dump ("Reading volume header at %I64d\n", headerOffset.QuadPart);
+
+ ntStatus = ZwReadFile (Extension->hDeviceFile,
+ NULL,
+ NULL,
+ NULL,
+ &IoStatusBlock,
+ readBuffer,
+ bRawDevice ? max (TC_VOLUME_HEADER_EFFECTIVE_SIZE, Extension->HostBytesPerSector) : TC_VOLUME_HEADER_EFFECTIVE_SIZE,
+ &headerOffset,
+ NULL);
+ }
+ else
+ {
+ // Header of a partition that is within the scope of system encryption
+
+ WCHAR parentDrivePath [47+1] = {0};
+ HANDLE hParentDeviceFile = NULL;
+ UNICODE_STRING FullParentPath;
+ OBJECT_ATTRIBUTES oaParentFileAttributes;
+ LARGE_INTEGER parentKeyDataOffset;
+
+ _snwprintf (parentDrivePath,
+ sizeof (parentDrivePath) / sizeof (WCHAR) - 1,
+ WIDE ("\\Device\\Harddisk%d\\Partition0"),
+ mount->nPartitionInInactiveSysEncScopeDriveNo);
+
+ Dump ("Mounting partition within scope of system encryption (reading key data from: %ls)\n", parentDrivePath);
+
+ RtlInitUnicodeString (&FullParentPath, parentDrivePath);
+ InitializeObjectAttributes (&oaParentFileAttributes, &FullParentPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
+
+ ntStatus = ZwCreateFile (&hParentDeviceFile,
+ GENERIC_READ | SYNCHRONIZE,
+ &oaParentFileAttributes,
+ &IoStatusBlock,
+ NULL,
+ FILE_ATTRIBUTE_NORMAL |
+ FILE_ATTRIBUTE_SYSTEM,
+ FILE_SHARE_READ | FILE_SHARE_WRITE,
+ FILE_OPEN,
+ FILE_RANDOM_ACCESS |
+ FILE_WRITE_THROUGH |
+ FILE_NO_INTERMEDIATE_BUFFERING |
+ FILE_SYNCHRONOUS_IO_NONALERT,
+ NULL,
+ 0);
+
+ if (!NT_SUCCESS (ntStatus))
+ {
+ if (hParentDeviceFile != NULL)
+ ZwClose (hParentDeviceFile);
+
+ Dump ("Cannot open %ls\n", parentDrivePath);
+
+ goto error;
+ }
+
+ parentKeyDataOffset.QuadPart = TC_BOOT_VOLUME_HEADER_SECTOR_OFFSET;
+
+ ntStatus = ZwReadFile (hParentDeviceFile,
+ NULL,
+ NULL,
+ NULL,
+ &IoStatusBlock,
+ readBuffer,
+ max (TC_VOLUME_HEADER_EFFECTIVE_SIZE, Extension->HostBytesPerSector),
+ &parentKeyDataOffset,
+ NULL);
+
+ if (hParentDeviceFile != NULL)
+ ZwClose (hParentDeviceFile);
+ }
+
+ if (!NT_SUCCESS (ntStatus) && ntStatus != STATUS_END_OF_FILE)
+ {
+ Dump ("Read failed: NTSTATUS 0x%08x\n", ntStatus);
+ goto error;
+ }
+
+ if (ntStatus == STATUS_END_OF_FILE || IoStatusBlock.Information < TC_VOLUME_HEADER_EFFECTIVE_SIZE)
+ {
+ Dump ("Read didn't read enough data\n");
+
+ // If FSCTL_ALLOW_EXTENDED_DASD_IO failed and there is a live filesystem on the partition, then the
+ // filesystem driver may report EOF when we are reading hidden sectors (when the filesystem is
+ // shorter than the partition). This can happen for example after the user quick-formats a dismounted
+ // partition-hosted TrueCrypt volume and then tries to mount the volume using the embedded backup header.
+ memset (readBuffer, 0, TC_VOLUME_HEADER_EFFECTIVE_SIZE);
+ }
+
+ /* Attempt to recognize the volume (decrypt the header) */
+
+ ReadVolumeHeaderRecoveryMode = mount->RecoveryMode;
+
+ if ((volumeType == TC_VOLUME_TYPE_HIDDEN || volumeType == TC_VOLUME_TYPE_HIDDEN_LEGACY) && mount->bProtectHiddenVolume)
+ {
+ mount->nReturnCode = ReadVolumeHeaderWCache (
+ FALSE,
+ mount->bCache,
+ readBuffer,
+ &mount->ProtectedHidVolPassword,
+ &tmpCryptoInfo);
+ }
+ else
+ {
+ mount->nReturnCode = ReadVolumeHeaderWCache (
+ mount->bPartitionInInactiveSysEncScope && volumeType == TC_VOLUME_TYPE_NORMAL,
+ mount->bCache,
+ readBuffer,
+ &mount->VolumePassword,
+ &Extension->cryptoInfo);
+ }
+
+ ReadVolumeHeaderRecoveryMode = FALSE;
+
+ if (mount->nReturnCode == 0 || mount->nReturnCode == ERR_CIPHER_INIT_WEAK_KEY)
+ {
+ /* Volume header successfully decrypted */
+
+ Dump ("Volume header decrypted\n");
+ Dump ("Required program version = %x\n", (int) Extension->cryptoInfo->RequiredProgramVersion);
+ Dump ("Legacy volume = %d\n", (int) Extension->cryptoInfo->LegacyVolume);
+
+ if (IsHiddenSystemRunning() && !Extension->cryptoInfo->hiddenVolume)
+ {
+ Extension->bReadOnly = mount->bMountReadOnly = TRUE;
+ HiddenSysLeakProtectionCount++;
+ }
+
+ Extension->cryptoInfo->bProtectHiddenVolume = FALSE;
+ Extension->cryptoInfo->bHiddenVolProtectionAction = FALSE;
+
+ Extension->cryptoInfo->bPartitionInInactiveSysEncScope = mount->bPartitionInInactiveSysEncScope;
+
+ if (volumeType == TC_VOLUME_TYPE_NORMAL)
+ {
+ if (mount->bPartitionInInactiveSysEncScope)
+ {
+ if (Extension->cryptoInfo->EncryptedAreaStart.Value > (unsigned __int64) partitionStartingOffset
+ || Extension->cryptoInfo->EncryptedAreaStart.Value + Extension->cryptoInfo->VolumeSize.Value <= (unsigned __int64) partitionStartingOffset)
+ {
+ // The partition is not within the key scope of system encryption
+ mount->nReturnCode = ERR_PASSWORD_WRONG;
+ ntStatus = STATUS_SUCCESS;
+ goto error;
+ }
+
+ if (Extension->cryptoInfo->EncryptedAreaLength.Value != Extension->cryptoInfo->VolumeSize.Value)
+ {
+ // Partial encryption is not supported for volumes mounted as regular
+ mount->nReturnCode = ERR_ENCRYPTION_NOT_COMPLETED;
+ ntStatus = STATUS_SUCCESS;
+ goto error;
+ }
+ }
+ else if (Extension->cryptoInfo->HeaderFlags & TC_HEADER_FLAG_NONSYS_INPLACE_ENC)
+ {
+ if (Extension->cryptoInfo->EncryptedAreaLength.Value != Extension->cryptoInfo->VolumeSize.Value)
+ {
+ // Non-system in-place encryption process has not been completed on this volume
+ mount->nReturnCode = ERR_NONSYS_INPLACE_ENC_INCOMPLETE;
+ ntStatus = STATUS_SUCCESS;
+ goto error;
+ }
+ }
+ }
+
+ Extension->cryptoInfo->FirstDataUnitNo.Value = 0;
+
+ if (Extension->cryptoInfo->hiddenVolume && IsHiddenSystemRunning())
+ {
+ // Prevent mount of a hidden system partition if the system hosted on it is currently running
+ if (memcmp (Extension->cryptoInfo->master_keydata, GetSystemDriveCryptoInfo()->master_keydata, EAGetKeySize (Extension->cryptoInfo->ea)) == 0)
+ {
+ mount->nReturnCode = ERR_VOL_ALREADY_MOUNTED;
+ ntStatus = STATUS_SUCCESS;
+ goto error;
+ }
+ }
+
+ switch (volumeType)
+ {
+ case TC_VOLUME_TYPE_NORMAL:
+
+ Extension->cryptoInfo->hiddenVolume = FALSE;
+
+ if (mount->bPartitionInInactiveSysEncScope)
+ {
+ Extension->cryptoInfo->volDataAreaOffset = 0;
+ Extension->DiskLength = lDiskLength.QuadPart;
+ Extension->cryptoInfo->FirstDataUnitNo.Value = partitionStartingOffset / ENCRYPTION_DATA_UNIT_SIZE;
+ }
+ else if (Extension->cryptoInfo->LegacyVolume)
+ {
+ Extension->cryptoInfo->volDataAreaOffset = TC_VOLUME_HEADER_SIZE_LEGACY;
+ Extension->DiskLength = lDiskLength.QuadPart - TC_VOLUME_HEADER_SIZE_LEGACY;
+ }
+ else
+ {
+ Extension->cryptoInfo->volDataAreaOffset = Extension->cryptoInfo->EncryptedAreaStart.Value;
+ Extension->DiskLength = Extension->cryptoInfo->VolumeSize.Value;
+ }
+
+ break;
+
+ case TC_VOLUME_TYPE_HIDDEN:
+ case TC_VOLUME_TYPE_HIDDEN_LEGACY:
+
+ cryptoInfoPtr = mount->bProtectHiddenVolume ? tmpCryptoInfo : Extension->cryptoInfo;
+
+ if (volumeType == TC_VOLUME_TYPE_HIDDEN_LEGACY)
+ Extension->cryptoInfo->hiddenVolumeOffset = lDiskLength.QuadPart - cryptoInfoPtr->hiddenVolumeSize - TC_HIDDEN_VOLUME_HEADER_OFFSET_LEGACY;
+ else
+ Extension->cryptoInfo->hiddenVolumeOffset = cryptoInfoPtr->EncryptedAreaStart.Value;
+
+ Dump ("Hidden volume offset = %I64d\n", Extension->cryptoInfo->hiddenVolumeOffset);
+ Dump ("Hidden volume size = %I64d\n", cryptoInfoPtr->hiddenVolumeSize);
+ Dump ("Hidden volume end = %I64d\n", Extension->cryptoInfo->hiddenVolumeOffset + cryptoInfoPtr->hiddenVolumeSize - 1);
+
+ // Validate the offset
+ if (Extension->cryptoInfo->hiddenVolumeOffset % ENCRYPTION_DATA_UNIT_SIZE != 0)
+ {
+ mount->nReturnCode = ERR_VOL_SIZE_WRONG;
+ ntStatus = STATUS_SUCCESS;
+ goto error;
+ }
+
+ // If we are supposed to actually mount the hidden volume (not just to protect it)
+ if (!mount->bProtectHiddenVolume)
+ {
+ Extension->DiskLength = cryptoInfoPtr->hiddenVolumeSize;
+ Extension->cryptoInfo->hiddenVolume = TRUE;
+ Extension->cryptoInfo->volDataAreaOffset = Extension->cryptoInfo->hiddenVolumeOffset;
+ }
+ else
+ {
+ // Hidden volume protection
+ Extension->cryptoInfo->hiddenVolume = FALSE;
+ Extension->cryptoInfo->bProtectHiddenVolume = TRUE;
+
+ Extension->cryptoInfo->hiddenVolumeProtectedSize = tmpCryptoInfo->hiddenVolumeSize;
+
+ if (volumeType == TC_VOLUME_TYPE_HIDDEN_LEGACY)
+ Extension->cryptoInfo->hiddenVolumeProtectedSize += TC_VOLUME_HEADER_SIZE_LEGACY;
+
+ Dump ("Hidden volume protection active: %I64d-%I64d (%I64d)\n", Extension->cryptoInfo->hiddenVolumeOffset, Extension->cryptoInfo->hiddenVolumeProtectedSize + Extension->cryptoInfo->hiddenVolumeOffset - 1, Extension->cryptoInfo->hiddenVolumeProtectedSize);
+ }
+
+ break;
+ }
+
+ Dump ("Volume data offset = %I64d\n", Extension->cryptoInfo->volDataAreaOffset);
+ Dump ("Volume data size = %I64d\n", Extension->DiskLength);
+ Dump ("Volume data end = %I64d\n", Extension->cryptoInfo->volDataAreaOffset + Extension->DiskLength - 1);
+
+ if (Extension->DiskLength == 0)
+ {
+ Dump ("Incorrect volume size\n");
+ continue;
+ }
+
+ // If this is a hidden volume, make sure we are supposed to actually
+ // mount it (i.e. not just to protect it)
+ if (volumeType == TC_VOLUME_TYPE_NORMAL || !mount->bProtectHiddenVolume)
+ {
+ // Validate sector size
+ if (bRawDevice && Extension->cryptoInfo->SectorSize != Extension->HostBytesPerSector)
+ {
+ mount->nReturnCode = ERR_PARAMETER_INCORRECT;
+ ntStatus = STATUS_SUCCESS;
+ goto error;
+ }
+
+ // Calculate virtual volume geometry
+ Extension->TracksPerCylinder = 1;
+ Extension->SectorsPerTrack = 1;
+ Extension->BytesPerSector = Extension->cryptoInfo->SectorSize;
+ Extension->NumberOfCylinders = Extension->DiskLength / Extension->BytesPerSector;
+ Extension->PartitionType = 0;
+
+ Extension->bRawDevice = bRawDevice;
+
+ memset (Extension->wszVolume, 0, sizeof (Extension->wszVolume));
+ if (wcsstr (pwszMountVolume, WIDE ("\\??\\UNC\\")) == pwszMountVolume)
+ {
+ /* UNC path */
+ _snwprintf (Extension->wszVolume,
+ sizeof (Extension->wszVolume) / sizeof (WCHAR) - 1,
+ WIDE ("\\??\\\\%s"),
+ pwszMountVolume + 7);
+ }
+ else
+ {
+ wcsncpy (Extension->wszVolume, pwszMountVolume, sizeof (Extension->wszVolume) / sizeof (WCHAR) - 1);
+ }
+ }
+
+ // If we are to protect a hidden volume we cannot exit yet, for we must also
+ // decrypt the hidden volume header.
+ if (!(volumeType == TC_VOLUME_TYPE_NORMAL && mount->bProtectHiddenVolume))
+ {
+ TCfree (readBuffer);
+
+ if (tmpCryptoInfo != NULL)
+ {
+ crypto_close (tmpCryptoInfo);
+ tmpCryptoInfo = NULL;
+ }
+
+ return STATUS_SUCCESS;
+ }
+ }
+ else if ((mount->bProtectHiddenVolume && volumeType == TC_VOLUME_TYPE_NORMAL)
+ || mount->nReturnCode != ERR_PASSWORD_WRONG)
+ {
+ /* If we are not supposed to protect a hidden volume, the only error that is
+ tolerated is ERR_PASSWORD_WRONG (to allow mounting a possible hidden volume).
+
+ If we _are_ supposed to protect a hidden volume, we do not tolerate any error
+ (both volume headers must be successfully decrypted). */
+
+ break;
+ }
+ }
+
+ /* Failed due to some non-OS reason so we drop through and return NT
+ SUCCESS then nReturnCode is checked later in user-mode */
+
+ if (mount->nReturnCode == ERR_OUTOFMEMORY)
+ ntStatus = STATUS_INSUFFICIENT_RESOURCES;
+ else
+ ntStatus = STATUS_SUCCESS;
+
+error:
+ if (mount->nReturnCode == ERR_SUCCESS)
+ mount->nReturnCode = ERR_PASSWORD_WRONG;
+
+ if (tmpCryptoInfo != NULL)
+ {
+ crypto_close (tmpCryptoInfo);
+ tmpCryptoInfo = NULL;
+ }
+
+ if (Extension->cryptoInfo)
+ {
+ crypto_close (Extension->cryptoInfo);
+ Extension->cryptoInfo = NULL;
+ }
+
+ if (Extension->bTimeStampValid)
+ {
+ RestoreTimeStamp (Extension);
+ }
+
+ /* Close the hDeviceFile */
+ if (Extension->hDeviceFile != NULL)
+ ZwClose (Extension->hDeviceFile);
+
+ /* The cryptoInfo pointer is deallocated if the readheader routines
+ fail so there is no need to deallocate here */
+
+ /* Dereference the user-mode file object */
+ if (Extension->pfoDeviceFile != NULL)
+ ObDereferenceObject (Extension->pfoDeviceFile);
+
+ /* Free the tmp IO buffers */
+ if (readBuffer != NULL)
+ TCfree (readBuffer);
+
+ return ntStatus;
+}
+
+void TCCloseVolume (PDEVICE_OBJECT DeviceObject, PEXTENSION Extension)
+{
+ if (DeviceObject); /* Remove compiler warning */
+
+ if (Extension->hDeviceFile != NULL)
+ {
+ if (Extension->bRawDevice == FALSE
+ && Extension->bTimeStampValid)
+ {
+ RestoreTimeStamp (Extension);
+ }
+ ZwClose (Extension->hDeviceFile);
+ }
+ ObDereferenceObject (Extension->pfoDeviceFile);
+ crypto_close (Extension->cryptoInfo);
+}
+
+
+NTSTATUS TCSendHostDeviceIoControlRequest (PDEVICE_OBJECT DeviceObject,
+ PEXTENSION Extension,
+ ULONG IoControlCode,
+ void *OutputBuffer,
+ ULONG OutputBufferSize)
+{
+ IO_STATUS_BLOCK IoStatusBlock;
+ NTSTATUS ntStatus;
+ PIRP Irp;
+
+ if (DeviceObject); /* Remove compiler warning */
+
+ KeClearEvent (&Extension->keVolumeEvent);
+
+ Irp = IoBuildDeviceIoControlRequest (IoControlCode,
+ Extension->pFsdDevice,
+ NULL, 0,
+ OutputBuffer, OutputBufferSize,
+ FALSE,
+ &Extension->keVolumeEvent,
+ &IoStatusBlock);
+
+ if (Irp == NULL)
+ {
+ Dump ("IRP allocation failed\n");
+ return STATUS_INSUFFICIENT_RESOURCES;
+ }
+
+ // Disk device may be used by filesystem driver which needs file object
+ IoGetNextIrpStackLocation (Irp) -> FileObject = Extension->pfoDeviceFile;
+
+ ntStatus = IoCallDriver (Extension->pFsdDevice, Irp);
+ if (ntStatus == STATUS_PENDING)
+ {
+ KeWaitForSingleObject (&Extension->keVolumeEvent, Executive, KernelMode, FALSE, NULL);
+ ntStatus = IoStatusBlock.Status;
+ }
+
+ return ntStatus;
+}
+
+NTSTATUS COMPLETE_IRP (PDEVICE_OBJECT DeviceObject,
+ PIRP Irp,
+ NTSTATUS IrpStatus,
+ ULONG_PTR IrpInformation)
+{
+ Irp->IoStatus.Status = IrpStatus;
+ Irp->IoStatus.Information = IrpInformation;
+
+ if (DeviceObject); /* Remove compiler warning */
+
+#if EXTRA_INFO
+ if (!NT_SUCCESS (IrpStatus))
+ {
+ PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (Irp);
+ Dump ("COMPLETE_IRP FAILING IRP %ls Flags 0x%08x vpb 0x%08x NTSTATUS 0x%08x\n", TCTranslateCode (irpSp->MajorFunction),
+ (ULONG) DeviceObject->Flags, (ULONG) DeviceObject->Vpb->Flags, IrpStatus);
+ }
+ else
+ {
+ PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (Irp);
+ Dump ("COMPLETE_IRP SUCCESS IRP %ls Flags 0x%08x vpb 0x%08x NTSTATUS 0x%08x\n", TCTranslateCode (irpSp->MajorFunction),
+ (ULONG) DeviceObject->Flags, (ULONG) DeviceObject->Vpb->Flags, IrpStatus);
+ }
+#endif
+ IoCompleteRequest (Irp, IO_NO_INCREMENT);
+ return IrpStatus;
+}
+
+
+static void RestoreTimeStamp (PEXTENSION Extension)
+{
+ NTSTATUS ntStatus;
+ FILE_BASIC_INFORMATION FileBasicInfo;
+ IO_STATUS_BLOCK IoStatusBlock;
+
+ if (Extension->hDeviceFile != NULL
+ && Extension->bRawDevice == FALSE
+ && Extension->bReadOnly == FALSE
+ && Extension->bTimeStampValid)
+ {
+ ntStatus = ZwQueryInformationFile (Extension->hDeviceFile,
+ &IoStatusBlock,
+ &FileBasicInfo,
+ sizeof (FileBasicInfo),
+ FileBasicInformation);
+
+ if (!NT_SUCCESS (ntStatus))
+ {
+ Dump ("ZwQueryInformationFile failed in RestoreTimeStamp: NTSTATUS 0x%08x\n",
+ ntStatus);
+ }
+ else
+ {
+ FileBasicInfo.CreationTime = Extension->fileCreationTime;
+ FileBasicInfo.LastAccessTime = Extension->fileLastAccessTime;
+ FileBasicInfo.LastWriteTime = Extension->fileLastWriteTime;
+ FileBasicInfo.ChangeTime = Extension->fileLastChangeTime;
+
+ ntStatus = ZwSetInformationFile(
+ Extension->hDeviceFile,
+ &IoStatusBlock,
+ &FileBasicInfo,
+ sizeof (FileBasicInfo),
+ FileBasicInformation);
+
+ if (!NT_SUCCESS (ntStatus))
+ Dump ("ZwSetInformationFile failed in RestoreTimeStamp: NTSTATUS 0x%08x\n",ntStatus);
+ }
+ }
+}
diff --git a/src/Driver/Ntvol.h b/src/Driver/Ntvol.h
new file mode 100644
index 00000000..a6e9ff9e
--- /dev/null
+++ b/src/Driver/Ntvol.h
@@ -0,0 +1,19 @@
+/*
+ Legal Notice: Some portions of the source code contained in this file were
+ derived from the source code of Encryption for the Masses 2.02a, which is
+ Copyright (c) 1998-2000 Paul Le Roux and which is governed by the 'License
+ Agreement for Encryption for the Masses'. Modifications and additions to
+ the original source code (contained in this file) and all other portions
+ of this file are Copyright (c) 2003-2008 TrueCrypt Developers Association
+ and are governed by the TrueCrypt License 3.0 the full text of which is
+ contained in the file License.txt included in TrueCrypt binary and source
+ code distribution packages. */
+
+extern volatile BOOL ProbingHostDeviceForWrite;
+
+NTSTATUS TCOpenVolume ( PDEVICE_OBJECT DeviceObject , PEXTENSION Extension , MOUNT_STRUCT *mount , PWSTR pwszMountVolume , BOOL bRawDevice );
+void TCCloseVolume ( PDEVICE_OBJECT DeviceObject , PEXTENSION Extension );
+NTSTATUS TCCompletion ( PDEVICE_OBJECT DeviceObject , PIRP Irp , PVOID pUserBuffer );
+static NTSTATUS TCSendHostDeviceIoControlRequest ( PDEVICE_OBJECT DeviceObject , PEXTENSION Extension , ULONG IoControlCode , void *OutputBuffer , ULONG OutputBufferSize );
+NTSTATUS COMPLETE_IRP ( PDEVICE_OBJECT DeviceObject , PIRP Irp , NTSTATUS IrpStatus , ULONG_PTR IrpInformation );
+static void RestoreTimeStamp ( PEXTENSION Extension );
diff --git a/src/Driver/Resource.h b/src/Driver/Resource.h
new file mode 100644
index 00000000..effd8044
--- /dev/null
+++ b/src/Driver/Resource.h
@@ -0,0 +1,16 @@
+//{{NO_DEPENDENCIES}}
+// Microsoft Visual C++ generated include file.
+// Used by Driver.rc
+//
+
+// Next default values for new objects
+//
+#ifdef APSTUDIO_INVOKED
+#ifndef APSTUDIO_READONLY_SYMBOLS
+#define _APS_NO_MFC 1
+#define _APS_NEXT_RESOURCE_VALUE 101
+#define _APS_NEXT_COMMAND_VALUE 40001
+#define _APS_NEXT_CONTROL_VALUE 1001
+#define _APS_NEXT_SYMED_VALUE 101
+#endif
+#endif
diff --git a/src/Driver/Sources b/src/Driver/Sources
new file mode 100644
index 00000000..0cf6ff7f
--- /dev/null
+++ b/src/Driver/Sources
@@ -0,0 +1,21 @@
+TARGETNAME=truecrypt
+TARGETTYPE=DRIVER
+
+USER_C_FLAGS=$(USER_C_FLAGS) -D_UNICODE
+LINKER_FLAGS=$(LINKER_FLAGS) -map
+
+INCLUDES = ../Common;../Crypto
+
+SOURCES = \
+ DriveFilter.c \
+ DumpFilter.c \
+ EncryptedIoQueue.c \
+ Ntdriver.c \
+ Ntvol.c \
+ VolumeFilter.c \
+ Driver.rc
+
+TARGETLIBS = \
+ $(SDK_LIB_PATH)/uuid.lib \
+ ../Common/obj$(BUILD_ALT_DIR)/*/Common.lib \
+ ../Crypto/obj$(BUILD_ALT_DIR)/*/Crypto.lib
diff --git a/src/Driver/VolumeFilter.c b/src/Driver/VolumeFilter.c
new file mode 100644
index 00000000..fb9ccc9e
--- /dev/null
+++ b/src/Driver/VolumeFilter.c
@@ -0,0 +1,290 @@
+/*
+ Copyright (c) 2008-2011 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#include "TCdefs.h"
+#include "Ntdriver.h"
+#include "Ntvol.h"
+#include "DriveFilter.h"
+#include "VolumeFilter.h"
+
+typedef DriveFilterExtension VolumeFilterExtension;
+
+// Number of times the filter driver answered that an unencrypted volume
+// is read-only (or mounted an outer/normal TrueCrypt volume as read only)
+uint32 HiddenSysLeakProtectionCount = 0;
+
+
+NTSTATUS VolumeFilterAddDevice (PDRIVER_OBJECT driverObject, PDEVICE_OBJECT pdo)
+{
+ VolumeFilterExtension *Extension;
+ NTSTATUS status;
+ PDEVICE_OBJECT filterDeviceObject = NULL;
+ PDEVICE_OBJECT attachedDeviceObject;
+
+ Dump ("VolumeFilterAddDevice pdo=%p\n", pdo);
+
+ attachedDeviceObject = IoGetAttachedDeviceReference (pdo);
+ status = IoCreateDevice (driverObject, sizeof (VolumeFilterExtension), NULL, attachedDeviceObject->DeviceType, 0, FALSE, &filterDeviceObject);
+
+ ObDereferenceObject (attachedDeviceObject);
+
+ if (!NT_SUCCESS (status))
+ {
+ filterDeviceObject = NULL;
+ goto err;
+ }
+
+ Extension = (VolumeFilterExtension *) filterDeviceObject->DeviceExtension;
+ memset (Extension, 0, sizeof (VolumeFilterExtension));
+
+ Extension->LowerDeviceObject = IoAttachDeviceToDeviceStack (filterDeviceObject, pdo); // IoAttachDeviceToDeviceStackSafe() is not required in AddDevice routine and is also unavailable on Windows 2000 SP4
+ if (!Extension->LowerDeviceObject)
+ {
+ status = STATUS_DEVICE_REMOVED;
+ goto err;
+ }
+
+ Extension->IsVolumeFilterDevice = TRUE;
+ Extension->DeviceObject = filterDeviceObject;
+ Extension->Pdo = pdo;
+
+ IoInitializeRemoveLock (&Extension->Queue.RemoveLock, 'LRCT', 0, 0);
+
+ filterDeviceObject->Flags |= Extension->LowerDeviceObject->Flags & (DO_DIRECT_IO | DO_BUFFERED_IO | DO_POWER_PAGABLE);
+ filterDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
+
+ return status;
+
+err:
+ if (filterDeviceObject)
+ {
+ if (Extension->LowerDeviceObject)
+ IoDetachDevice (Extension->LowerDeviceObject);
+
+ IoDeleteDevice (filterDeviceObject);
+ }
+
+ return status;
+}
+
+
+static NTSTATUS PassIrp (PDEVICE_OBJECT deviceObject, PIRP irp)
+{
+ IoSkipCurrentIrpStackLocation (irp);
+ return IoCallDriver (deviceObject, irp);
+}
+
+
+static NTSTATUS PassFilteredIrp (PDEVICE_OBJECT deviceObject, PIRP irp, PIO_COMPLETION_ROUTINE completionRoutine, PVOID completionRoutineArg)
+{
+ IoCopyCurrentIrpStackLocationToNext (irp);
+
+ if (completionRoutine)
+ IoSetCompletionRoutine (irp, completionRoutine, completionRoutineArg, TRUE, TRUE, TRUE);
+
+ return IoCallDriver (deviceObject, irp);
+}
+
+
+static NTSTATUS OnDeviceUsageNotificationCompleted (PDEVICE_OBJECT filterDeviceObject, PIRP Irp, VolumeFilterExtension *Extension)
+{
+ if (Irp->PendingReturned)
+ IoMarkIrpPending (Irp);
+
+ if (!(Extension->LowerDeviceObject->Flags & DO_POWER_PAGABLE))
+ filterDeviceObject->Flags &= ~DO_POWER_PAGABLE;
+
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ return STATUS_CONTINUE_COMPLETION;
+}
+
+
+static NTSTATUS OnStartDeviceCompleted (PDEVICE_OBJECT filterDeviceObject, PIRP Irp, VolumeFilterExtension *Extension)
+{
+ if (Irp->PendingReturned)
+ IoMarkIrpPending (Irp);
+
+ if (Extension->LowerDeviceObject->Characteristics & FILE_REMOVABLE_MEDIA)
+ filterDeviceObject->Characteristics |= FILE_REMOVABLE_MEDIA;
+
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ return STATUS_CONTINUE_COMPLETION;
+}
+
+
+static NTSTATUS DispatchControl (PDEVICE_OBJECT DeviceObject, PIRP Irp, VolumeFilterExtension *Extension, PIO_STACK_LOCATION irpSp)
+{
+ NTSTATUS status = IoAcquireRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ if (!NT_SUCCESS (status))
+ return TCCompleteIrp (Irp, status, 0);
+
+ if (IsHiddenSystemRunning())
+ {
+ switch (irpSp->Parameters.DeviceIoControl.IoControlCode)
+ {
+ case IOCTL_DISK_IS_WRITABLE:
+ {
+ // All volumes except the system volume must be read-only
+
+ DriveFilterExtension *bootDriveExtension = GetBootDriveFilterExtension();
+ STORAGE_DEVICE_NUMBER storageDeviceNumber;
+
+ if (!bootDriveExtension->SystemStorageDeviceNumberValid)
+ TC_BUG_CHECK (STATUS_INVALID_PARAMETER);
+
+ status = SendDeviceIoControlRequest (Extension->LowerDeviceObject, IOCTL_STORAGE_GET_DEVICE_NUMBER, NULL, 0, &storageDeviceNumber, sizeof (storageDeviceNumber));
+
+ if (NT_SUCCESS (status) && bootDriveExtension->SystemStorageDeviceNumber == storageDeviceNumber.DeviceNumber)
+ {
+ PARTITION_INFORMATION_EX partition;
+ status = SendDeviceIoControlRequest (Extension->LowerDeviceObject, IOCTL_DISK_GET_PARTITION_INFO_EX, NULL, 0, &partition, sizeof (partition));
+
+ if (NT_SUCCESS (status) && partition.StartingOffset.QuadPart == bootDriveExtension->ConfiguredEncryptedAreaStart)
+ {
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ return TCCompleteDiskIrp (Irp, STATUS_SUCCESS, 0);
+ }
+ }
+
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+
+ ++HiddenSysLeakProtectionCount;
+ return TCCompleteDiskIrp (Irp, STATUS_MEDIA_WRITE_PROTECTED, 0);
+ }
+
+ case TC_IOCTL_DISK_IS_WRITABLE:
+ Dump ("TC_IOCTL_DISK_IS_WRITABLE pdo=%p\n", Extension->Pdo);
+
+ if (!ProbingHostDeviceForWrite)
+ break;
+
+ // Probe the real state of the device as the user is mounting a TrueCrypt volume.
+
+ // Volume filter may be attached to a merged drive+volume PDO. First test if TC_IOCTL_DISK_IS_WRITABLE works for the underlying device.
+ status = SendDeviceIoControlRequest (Extension->LowerDeviceObject, TC_IOCTL_DISK_IS_WRITABLE, NULL, 0, NULL, 0);
+
+ if (NT_SUCCESS (status) || status == STATUS_MEDIA_WRITE_PROTECTED)
+ {
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ return TCCompleteDiskIrp (Irp, status, 0);
+ }
+
+ status = SendDeviceIoControlRequest (Extension->LowerDeviceObject, IOCTL_DISK_IS_WRITABLE, NULL, 0, NULL, 0);
+
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ return TCCompleteDiskIrp (Irp, status, 0);
+
+ case IOCTL_STORAGE_MANAGE_DATA_SET_ATTRIBUTES:
+
+ // Filter IOCTL_STORAGE_MANAGE_DATA_SET_ATTRIBUTES to enable potential future use of hidden systems on drives that use the trim operation but not wear-leveling (if any appear in future). The documentation forbids users to create hidden volumes/systems on drives that use wear-leveling and consequently also on drives that use trim (as trim is used only by drives that use wear-leveling, as of 2010).
+
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ return TCCompleteDiskIrp (Irp, STATUS_SUCCESS, 0);
+ }
+ }
+
+ status = PassIrp (Extension->LowerDeviceObject, Irp);
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ return status;
+}
+
+
+static NTSTATUS DispatchPnp (PDEVICE_OBJECT DeviceObject, PIRP Irp, VolumeFilterExtension *Extension, PIO_STACK_LOCATION irpSp)
+{
+ NTSTATUS status;
+
+ status = IoAcquireRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ if (!NT_SUCCESS (status))
+ return TCCompleteIrp (Irp, status, 0);
+
+ switch (irpSp->MinorFunction)
+ {
+ case IRP_MN_START_DEVICE:
+ Dump ("IRP_MN_START_DEVICE volume pdo=%p\n", Extension->Pdo);
+ return PassFilteredIrp (Extension->LowerDeviceObject, Irp, OnStartDeviceCompleted, Extension);
+
+ case IRP_MN_DEVICE_USAGE_NOTIFICATION:
+ {
+ PDEVICE_OBJECT attachedDevice = IoGetAttachedDeviceReference (DeviceObject);
+
+ if (attachedDevice == DeviceObject || (attachedDevice->Flags & DO_POWER_PAGABLE))
+ DeviceObject->Flags |= DO_POWER_PAGABLE;
+
+ ObDereferenceObject (attachedDevice);
+ }
+
+ return PassFilteredIrp (Extension->LowerDeviceObject, Irp, OnDeviceUsageNotificationCompleted, Extension);
+
+
+ case IRP_MN_REMOVE_DEVICE:
+ Dump ("IRP_MN_REMOVE_DEVICE volume pdo=%p\n", Extension->Pdo);
+
+ IoReleaseRemoveLockAndWait (&Extension->Queue.RemoveLock, Irp);
+ status = PassIrp (Extension->LowerDeviceObject, Irp);
+
+ IoDetachDevice (Extension->LowerDeviceObject);
+
+ IoDeleteDevice (DeviceObject);
+ return status;
+
+ default:
+ status = PassIrp (Extension->LowerDeviceObject, Irp);
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ }
+
+ return status;
+}
+
+
+static NTSTATUS DispatchPower (PDEVICE_OBJECT DeviceObject, PIRP Irp, VolumeFilterExtension *Extension, PIO_STACK_LOCATION irpSp)
+{
+ NTSTATUS status;
+ PoStartNextPowerIrp (Irp);
+
+ status = IoAcquireRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ if (!NT_SUCCESS (status))
+ return TCCompleteIrp (Irp, status, 0);
+
+ IoSkipCurrentIrpStackLocation (Irp);
+ status = PoCallDriver (Extension->LowerDeviceObject, Irp);
+
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ return status;
+}
+
+
+NTSTATUS VolumeFilterDispatchIrp (PDEVICE_OBJECT DeviceObject, PIRP Irp)
+{
+ VolumeFilterExtension *Extension = (VolumeFilterExtension *) DeviceObject->DeviceExtension;
+ PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (Irp);
+ NTSTATUS status;
+
+ ASSERT (!Extension->bRootDevice && Extension->IsVolumeFilterDevice);
+
+ switch (irpSp->MajorFunction)
+ {
+ case IRP_MJ_DEVICE_CONTROL:
+ return DispatchControl (DeviceObject, Irp, Extension, irpSp);
+
+ case IRP_MJ_PNP:
+ return DispatchPnp (DeviceObject, Irp, Extension, irpSp);
+
+ case IRP_MJ_POWER:
+ return DispatchPower (DeviceObject, Irp, Extension, irpSp);
+
+ default:
+ status = IoAcquireRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ if (!NT_SUCCESS (status))
+ return TCCompleteIrp (Irp, status, 0);
+
+ status = PassIrp (Extension->LowerDeviceObject, Irp);
+
+ IoReleaseRemoveLock (&Extension->Queue.RemoveLock, Irp);
+ return status;
+ }
+}
diff --git a/src/Driver/VolumeFilter.h b/src/Driver/VolumeFilter.h
new file mode 100644
index 00000000..e5f38103
--- /dev/null
+++ b/src/Driver/VolumeFilter.h
@@ -0,0 +1,19 @@
+/*
+ Copyright (c) 2008 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_DRIVER_VOLUME_FILTER
+#define TC_HEADER_DRIVER_VOLUME_FILTER
+
+#include "TCdefs.h"
+
+extern uint32 HiddenSysLeakProtectionCount;
+
+NTSTATUS VolumeFilterAddDevice (PDRIVER_OBJECT driverObject, PDEVICE_OBJECT pdo);
+NTSTATUS VolumeFilterDispatchIrp (PDEVICE_OBJECT DeviceObject, PIRP Irp);
+
+#endif // TC_HEADER_DRIVER_VOLUME_FILTER