1 files changed, 201 insertions, 103 deletions
diff --git a/src/Main/TextUserInterface.cpp b/src/Main/TextUserInterface.cpp
index 4de2cb2d..0de76c6b 100644
--- a/src/Main/TextUserInterface.cpp
+++ b/src/Main/TextUserInterface.cpp
@@ -21,7 +21,9 @@
 #endif
 
 #include <wx/platinfo.h>
+#include "Common/Token.h"
 #include "Common/SecurityToken.h"
+#include "Common/EMVToken.h"
 #include "Core/RandomNumberGenerator.h"
 #include "Application.h"
 #include "TextUserInterface.h"
@@ -175,9 +177,13 @@ namespace VeraCrypt
 		wxString msg = _("Enter new PIM: ");
 		if (!message.empty())
 			msg = message + L": ";
+		SetTerminalEcho (false);
+		finally_do ({ TextUserInterface::SetTerminalEcho (true); });
 		while (pim < 0)
 		{
 			wstring pimStr = AskString (msg);
+			ShowString (L"\n");
+
 			if (pimStr.empty())
 				pim = 0;
 			else
@@ -238,7 +244,7 @@ namespace VeraCrypt
 		while (true)
 		{
 			wxString s = AskString (StringFormatter (L"{0} (y={1}/n={2}) [{3}]: ",
-				message, LangString["YES"], LangString["NO"], LangString[defaultYes ? "YES" : "NO"]));
+				message, LangString["UISTR_YES"], LangString["UISTR_NO"], LangString[defaultYes ? "UISTR_YES" : "UISTR_NO"]));
 
 			if (s.IsSameAs (L'n', false) || s.IsSameAs (L"no", false) || (!defaultYes && s.empty()))
 				return false;
@@ -271,7 +277,7 @@ namespace VeraCrypt
 		shared_ptr <Pkcs5Kdf> kdf;
 		if (CmdLine->ArgHash)
 		{
-			kdf = Pkcs5Kdf::GetAlgorithm (*CmdLine->ArgHash, false);
+			kdf = Pkcs5Kdf::GetAlgorithm (*CmdLine->ArgHash);
 		}
 
 		shared_ptr <Volume> normalVolume;
@@ -283,6 +289,9 @@ namespace VeraCrypt
 		normalVolumeMountOptions.Path = volumePath;
 		hiddenVolumeMountOptions.Path = volumePath;
 
+		normalVolumeMountOptions.EMVSupportEnabled = true;
+		hiddenVolumeMountOptions.EMVSupportEnabled = true;
+
 		VolumeType::Enum volumeType = VolumeType::Normal;
 
 		// Open both types of volumes
@@ -306,8 +315,8 @@ namespace VeraCrypt
 						options->Password,
 						options->Pim,
 						kdf,
-						false,
 						options->Keyfiles,
+                        options->EMVSupportEnabled,
 						options->Protection,
 						options->ProtectionPassword,
 						options->ProtectionPim,
@@ -331,8 +340,8 @@ namespace VeraCrypt
 								options->Password,
 								options->Pim,
 								kdf,
-								false,
 								options->Keyfiles,
+                                options->EMVSupportEnabled,
 								options->Protection,
 								options->ProtectionPassword,
 								options->ProtectionPim,
@@ -403,14 +412,14 @@ namespace VeraCrypt
 
 		// Re-encrypt volume header
 		SecureBuffer newHeaderBuffer (normalVolume->GetLayout()->GetHeaderSize());
-		Core->ReEncryptVolumeHeaderWithNewSalt (newHeaderBuffer, normalVolume->GetHeader(), normalVolumeMountOptions.Password, normalVolumeMountOptions.Pim, normalVolumeMountOptions.Keyfiles);
+		Core->ReEncryptVolumeHeaderWithNewSalt (newHeaderBuffer, normalVolume->GetHeader(), normalVolumeMountOptions.Password, normalVolumeMountOptions.Pim, normalVolumeMountOptions.Keyfiles, normalVolumeMountOptions.EMVSupportEnabled);
 
 		backupFile.Write (newHeaderBuffer);
 
 		if (hiddenVolume)
 		{
 			// Re-encrypt hidden volume header
-			Core->ReEncryptVolumeHeaderWithNewSalt (newHeaderBuffer, hiddenVolume->GetHeader(), hiddenVolumeMountOptions.Password, hiddenVolumeMountOptions.Pim, hiddenVolumeMountOptions.Keyfiles);
+			Core->ReEncryptVolumeHeaderWithNewSalt (newHeaderBuffer, hiddenVolume->GetHeader(), hiddenVolumeMountOptions.Password, hiddenVolumeMountOptions.Pim, hiddenVolumeMountOptions.Keyfiles, hiddenVolumeMountOptions.EMVSupportEnabled);
 		}
 		else
 		{
@@ -426,7 +435,7 @@ namespace VeraCrypt
 		ShowInfo ("VOL_HEADER_BACKED_UP");
 	}
 
-	void TextUserInterface::ChangePassword (shared_ptr <VolumePath> volumePath, shared_ptr <VolumePassword> password, int pim, shared_ptr <Hash> currentHash, bool truecryptMode, shared_ptr <KeyfileList> keyfiles, shared_ptr <VolumePassword> newPassword, int newPim, shared_ptr <KeyfileList> newKeyfiles, shared_ptr <Hash> newHash) const
+	void TextUserInterface::ChangePassword (shared_ptr <VolumePath> volumePath, shared_ptr <VolumePassword> password, int pim, shared_ptr <Hash> currentHash, shared_ptr <KeyfileList> keyfiles, shared_ptr <VolumePassword> newPassword, int newPim, shared_ptr <KeyfileList> newKeyfiles, shared_ptr <Hash> newHash) const
 	{
 		shared_ptr <Volume> volume;
 
@@ -448,7 +457,7 @@ namespace VeraCrypt
 		shared_ptr<Pkcs5Kdf> kdf;
 		if (currentHash)
 		{
-			kdf = Pkcs5Kdf::GetAlgorithm (*currentHash, truecryptMode);
+			kdf = Pkcs5Kdf::GetAlgorithm (*currentHash);
 		}
 
 		while (true)
@@ -464,7 +473,7 @@ namespace VeraCrypt
 			}
 
 			// current PIM
-			if (!truecryptMode && !Preferences.NonInteractive && (pim < 0))
+			if (!Preferences.NonInteractive && (pim < 0))
 			{
 				pim = AskPim (_("Enter current PIM"));
 			}
@@ -478,7 +487,7 @@ namespace VeraCrypt
 					try
 					{
 						keyfiles.reset (new KeyfileList);
-						volume = Core->OpenVolume (volumePath, Preferences.DefaultMountOptions.PreserveTimestamps, password, pim, kdf, truecryptMode, keyfiles);
+						volume = Core->OpenVolume (volumePath, Preferences.DefaultMountOptions.PreserveTimestamps, password, pim, kdf, keyfiles, true);
 					}
 					catch (PasswordException&)
 					{
@@ -488,7 +497,7 @@ namespace VeraCrypt
 				}
 
 				if (!volume.get())
-					volume = Core->OpenVolume (volumePath, Preferences.DefaultMountOptions.PreserveTimestamps, password, pim, kdf, truecryptMode, keyfiles);
+					volume = Core->OpenVolume (volumePath, Preferences.DefaultMountOptions.PreserveTimestamps, password, pim, kdf, keyfiles, true);
 			}
 			catch (PasswordException &e)
 			{
@@ -523,8 +532,8 @@ namespace VeraCrypt
 		RandomNumberGenerator::SetEnrichedByUserStatus (false);
 		UserEnrichRandomPool();
 
-		Core->ChangePassword (volume, newPassword, newPim, newKeyfiles,
-			newHash ? Pkcs5Kdf::GetAlgorithm (*newHash, false) : shared_ptr <Pkcs5Kdf>());
+		Core->ChangePassword (volume, newPassword, newPim, newKeyfiles, true,
+			newHash ? Pkcs5Kdf::GetAlgorithm (*newHash) : shared_ptr <Pkcs5Kdf>());
 
 		ShowInfo ("PASSWORD_CHANGED");
 	}
@@ -646,6 +655,41 @@ namespace VeraCrypt
 		}
 		else
 		{
+			uint64 AvailableDiskSpace = 0;
+			if (options->Path.IsDevice())
+			{
+				AvailableDiskSpace = maxVolumeSize;
+			}
+			else
+			{
+				wxLongLong diskSpace = 0;
+				wxString parentDir = wxFileName (wstring (options->Path)).GetPath();
+				if (parentDir.IsEmpty())
+				{
+					parentDir = wxT(".");
+				}
+				if (wxDirExists(parentDir) && wxGetDiskSpace (parentDir, nullptr, &diskSpace))
+				{
+					AvailableDiskSpace = (uint64) diskSpace.GetValue ();
+					if (maxVolumeSize > AvailableDiskSpace)
+						maxVolumeSize = AvailableDiskSpace;
+				}
+			}
+
+			if (options->Size == (uint64) (-1))
+			{
+				if (AvailableDiskSpace)
+				{
+					// caller requesting maximum size
+					// we use maxVolumeSize because it is guaranteed to be less of equal to AvailableDiskSpace
+					options->Size = maxVolumeSize;
+				}
+				else
+				{
+					throw_err (_("Failed to get available disk space on the selected target."));
+				}
+			}
+
 			options->Quick = false;
 
 			uint32 sectorSizeRem = options->Size % options->SectorSize;
@@ -657,43 +701,62 @@ namespace VeraCrypt
 				if (Preferences.NonInteractive)
 					throw MissingArgument (SRC_POS);
 
-				wstring sizeStr = AskString (options->Type == VolumeType::Hidden ? _("\nEnter hidden volume size (sizeK/size[M]/sizeG): ") : _("\nEnter volume size (sizeK/size[M]/sizeG): "));
 				uint64 multiplier = 1024 * 1024;
-
-				if (sizeStr.find (L"K") != string::npos)
-				{
-					multiplier = 1024;
-					sizeStr.resize (sizeStr.size() - 1);
-				}
-				else if (sizeStr.find (L"M") != string::npos)
+				wxString sizeStr = AskString (options->Type == VolumeType::Hidden ? _("\nEnter hidden volume size (sizeK/size[M]/sizeG/sizeT/max): ") : _("\nEnter volume size (sizeK/size[M]/sizeG.sizeT/max): "));
+				if (sizeStr.CmpNoCase(wxT("max")) == 0)
 				{
-					sizeStr.resize (sizeStr.size() - 1);
-				}
-				else if (sizeStr.find (L"G") != string::npos)
-				{
-					multiplier = 1024 * 1024 * 1024;
-					sizeStr.resize (sizeStr.size() - 1);
+					multiplier = 1;
+					if (AvailableDiskSpace)
+					{
+						// caller requesting maximum size
+						// we use maxVolumeSize because it is guaranteed to be less of equal to AvailableDiskSpace
+						options->Size = maxVolumeSize;
+					}
+					else
+					{
+						throw_err (_("Failed to get available disk space on the selected target."));
+					}
 				}
-				else if (sizeStr.find (L"T") != string::npos)
+				else
 				{
-					multiplier = (uint64) 1024 * 1024 * 1024 * 1024;
-					sizeStr.resize (sizeStr.size() - 1);
-				}
+					multiplier = 1024 * 1024;
+					size_t index = sizeStr.find_first_not_of (wxT("0123456789"));
+					if (index == 0)
+					{
+						continue;
+					}
+					else if (index != (size_t) wxNOT_FOUND)
+					{
+						wxString sizeSuffix = sizeStr.Mid(index);
+						if (sizeSuffix.CmpNoCase(wxT("K")) == 0 || sizeSuffix.CmpNoCase(wxT("KiB")) == 0)
+							multiplier = BYTES_PER_KB;
+						else if (sizeSuffix.CmpNoCase(wxT("M")) == 0 || sizeSuffix.CmpNoCase(wxT("MiB")) == 0)
+							multiplier = BYTES_PER_MB;
+						else if (sizeSuffix.CmpNoCase(wxT("G")) == 0 || sizeSuffix.CmpNoCase(wxT("GiB")) == 0)
+							multiplier = BYTES_PER_GB;
+						else if (sizeSuffix.CmpNoCase(wxT("T")) == 0 || sizeSuffix.CmpNoCase(wxT("TiB")) == 0)
+							multiplier = BYTES_PER_TB;
+						else
+							continue;
 
-				try
-				{
-					options->Size = StringConverter::ToUInt64 (sizeStr);
-					options->Size *= multiplier;
+						sizeStr = sizeStr.Left (index);
+					}
 
-					sectorSizeRem = options->Size % options->SectorSize;
-					if (sectorSizeRem != 0)
-						options->Size += options->SectorSize - sectorSizeRem;
-				}
-				catch (...)
-				{
-					options->Size = 0;
-					continue;
+					try
+					{
+						options->Size = StringConverter::ToUInt64 (wstring(sizeStr));
+					}
+					catch (...)
+					{
+						options->Size = 0;
+						continue;
+					}
 				}
+				options->Size *= multiplier;
+
+				sectorSizeRem = options->Size % options->SectorSize;
+				if (sectorSizeRem != 0)
+					options->Size += options->SectorSize - sectorSizeRem;
 
 				if (options->Size < minVolumeSize)
 				{
@@ -757,12 +820,13 @@ namespace VeraCrypt
 
 			shared_ptr <Hash> selectedHash = hashes[AskSelection (hashes.size(), 1) - 1];
 			RandomNumberGenerator::SetHash (selectedHash);
-			options->VolumeHeaderKdf = Pkcs5Kdf::GetAlgorithm (*selectedHash, false);
+			options->VolumeHeaderKdf = Pkcs5Kdf::GetAlgorithm (*selectedHash);
 
 		}
 
 		// Filesystem
 		options->FilesystemClusterSize = 0;
+		uint64 filesystemSize = layout->GetMaxDataSize (options->Size);
 
 		if (options->Filesystem == VolumeCreationOptions::FilesystemType::Unknown)
 		{
@@ -776,38 +840,52 @@ namespace VeraCrypt
 
 				vector <VolumeCreationOptions::FilesystemType::Enum> filesystems;
 
-				ShowInfo (L" 1) " + LangString["NONE"]); filesystems.push_back (VolumeCreationOptions::FilesystemType::None);
-				ShowInfo (L" 2) FAT"); filesystems.push_back (VolumeCreationOptions::FilesystemType::FAT);
-
+				ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, LangString["NONE"])); filesystems.push_back (VolumeCreationOptions::FilesystemType::None);
+				ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "FAT")); filesystems.push_back (VolumeCreationOptions::FilesystemType::FAT);
 #if defined (TC_LINUX)
-				ShowInfo (L" 3) Linux Ext2"); filesystems.push_back (VolumeCreationOptions::FilesystemType::Ext2);
-				ShowInfo (L" 4) Linux Ext3"); filesystems.push_back (VolumeCreationOptions::FilesystemType::Ext3);
-				ShowInfo (L" 5) Linux Ext4"); filesystems.push_back (VolumeCreationOptions::FilesystemType::Ext4);
-				ShowInfo (L" 6) NTFS");       filesystems.push_back (VolumeCreationOptions::FilesystemType::NTFS);
-				ShowInfo (L" 7) exFAT");      filesystems.push_back (VolumeCreationOptions::FilesystemType::exFAT);
+				ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "Linux Ext2")); filesystems.push_back (VolumeCreationOptions::FilesystemType::Ext2);
+				ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "Linux Ext3")); filesystems.push_back (VolumeCreationOptions::FilesystemType::Ext3);
+				ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "Linux Ext4")); filesystems.push_back (VolumeCreationOptions::FilesystemType::Ext4);
+				ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "NTFS"));       filesystems.push_back (VolumeCreationOptions::FilesystemType::NTFS);
+				if (VolumeCreationOptions::FilesystemType::IsFsFormatterPresent (VolumeCreationOptions::FilesystemType::exFAT))
+				{
+				        ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "exFAT"));      filesystems.push_back (VolumeCreationOptions::FilesystemType::exFAT);
+				}
+				if (VolumeCreationOptions::FilesystemType::IsFsFormatterPresent (VolumeCreationOptions::FilesystemType::Btrfs))
+		                {
+			                // minimum size to be able to format as Btrfs is 16777216 bytes
+			                if (filesystemSize >= VC_MIN_SMALL_BTRFS_VOLUME_SIZE)
+			                {
+                                                ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "Btrfs"));      filesystems.push_back (VolumeCreationOptions::FilesystemType::Btrfs);
+			                }
+			        }
 #elif defined (TC_MACOSX)
-				ShowInfo (L" 3) Mac OS Extended"); filesystems.push_back (VolumeCreationOptions::FilesystemType::MacOsExt);
-				ShowInfo (L" 4) exFAT");      filesystems.push_back (VolumeCreationOptions::FilesystemType::exFAT);
+				ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "Mac OS Extended")); filesystems.push_back (VolumeCreationOptions::FilesystemType::MacOsExt);
+				ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "exFAT"));      filesystems.push_back (VolumeCreationOptions::FilesystemType::exFAT);
 				if (wxPlatformInfo::Get().CheckOSVersion (10, 13))
 				{
-					ShowInfo (L" 5) APFS");      filesystems.push_back (VolumeCreationOptions::FilesystemType::APFS);
+					ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "APFS"));      filesystems.push_back (VolumeCreationOptions::FilesystemType::APFS);
 				}
 #elif defined (TC_FREEBSD) || defined (TC_SOLARIS)
-				ShowInfo (L" 3) UFS"); filesystems.push_back (VolumeCreationOptions::FilesystemType::UFS);
+				ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "UFS")); filesystems.push_back (VolumeCreationOptions::FilesystemType::UFS);
 #endif
 
 				options->Filesystem = filesystems[AskSelection (filesystems.size(), 2) - 1];
 			}
 		}
 
-		uint64 filesystemSize = layout->GetMaxDataSize (options->Size);
-
 		if (options->Filesystem == VolumeCreationOptions::FilesystemType::FAT
 			&& (filesystemSize < TC_MIN_FAT_FS_SIZE || filesystemSize > TC_MAX_FAT_SECTOR_COUNT * options->SectorSize))
 		{
 			throw_err (_("Specified volume size cannot be used with FAT filesystem."));
 		}
 
+		if (options->Filesystem == VolumeCreationOptions::FilesystemType::Btrfs
+			&& (filesystemSize < VC_MIN_SMALL_BTRFS_VOLUME_SIZE))
+		{
+			throw_err (_("Specified volume size is too small to be used with Btrfs filesystem."));
+		}
+
 		// Password
 		if (!options->Password && !Preferences.NonInteractive)
 		{
@@ -845,6 +923,7 @@ namespace VeraCrypt
 		wxLongLong startTime = wxGetLocalTimeMillis();
 
 		VolumeCreator creator;
+		options->EMVSupportEnabled = true;
 		creator.CreateVolume (options);
 
 		bool volumeCreated = false;
@@ -875,25 +954,9 @@ namespace VeraCrypt
 		if (options->Filesystem != VolumeCreationOptions::FilesystemType::None
 			&& options->Filesystem != VolumeCreationOptions::FilesystemType::FAT)
 		{
-			const char *fsFormatter = nullptr;
-
-			switch (options->Filesystem)
-			{
-#if defined (TC_LINUX)
-			case VolumeCreationOptions::FilesystemType::Ext2:		fsFormatter = "mkfs.ext2"; break;
-			case VolumeCreationOptions::FilesystemType::Ext3:		fsFormatter = "mkfs.ext3"; break;
-			case VolumeCreationOptions::FilesystemType::Ext4:		fsFormatter = "mkfs.ext4"; break;
-			case VolumeCreationOptions::FilesystemType::NTFS:		fsFormatter = "mkfs.ntfs"; break;
-			case VolumeCreationOptions::FilesystemType::exFAT:		fsFormatter = "mkfs.exfat"; break;
-#elif defined (TC_MACOSX)
-			case VolumeCreationOptions::FilesystemType::MacOsExt:	fsFormatter = "newfs_hfs"; break;
-			case VolumeCreationOptions::FilesystemType::exFAT:		fsFormatter = "newfs_exfat"; break;
-			case VolumeCreationOptions::FilesystemType::APFS:		fsFormatter = "newfs_apfs"; break;
-#elif defined (TC_FREEBSD) || defined (TC_SOLARIS)
-			case VolumeCreationOptions::FilesystemType::UFS:		fsFormatter = "newfs" ; break;
-#endif
-			default: throw ParameterIncorrect (SRC_POS);
-			}
+			const char *fsFormatter = VolumeCreationOptions::FilesystemType::GetFsFormatter (options->Filesystem);
+			if (!fsFormatter)
+				throw ParameterIncorrect (SRC_POS);
 
 			MountOptions mountOptions (GetPreferences().DefaultMountOptions);
 			mountOptions.Path = make_shared <VolumePath> (options->Path);
@@ -902,6 +965,7 @@ namespace VeraCrypt
 			mountOptions.Password = options->Password;
 			mountOptions.Pim = options->Pim;
 			mountOptions.Keyfiles = options->Keyfiles;
+			mountOptions.EMVSupportEnabled = true;
 
 			shared_ptr <VolumeInfo> volume = Core->MountVolume (mountOptions);
 			finally_do_arg (shared_ptr <VolumeInfo>, volume, { Core->DismountVolume (finally_arg, true); });
@@ -947,6 +1011,16 @@ namespace VeraCrypt
 			if (options->Filesystem == VolumeCreationOptions::FilesystemType::NTFS)
 				args.push_back ("-f");
 
+			if (options->Filesystem == VolumeCreationOptions::FilesystemType::Btrfs)
+			{
+				args.push_back ("-f");
+				if (filesystemSize < VC_MIN_LARGE_BTRFS_VOLUME_SIZE)
+				{
+					// use mixed mode for small BTRFS volumes
+					args.push_back ("-M");
+				}
+			}
+
 			args.push_back (string (virtualDevice));
 
 			Process::Execute (fsFormatter, args);
@@ -964,7 +1038,7 @@ namespace VeraCrypt
 
 		foreach_ref (const Keyfile &keyfile, *keyfiles)
 		{
-			SecurityToken::DeleteKeyfile (SecurityTokenKeyfilePath (FilePath (keyfile)));
+            SecurityToken::DeleteKeyfile (TokenKeyfilePath (FilePath (keyfile)));
 		}
 	}
 
@@ -980,7 +1054,7 @@ namespace VeraCrypt
 
 	void TextUserInterface::DoShowString (const wxString &str) const
 	{
-		wcout << str.c_str();
+		wcout << str.c_str() << flush;
 	}
 
 	void TextUserInterface::DoShowWarning (const wxString &message) const
@@ -988,17 +1062,17 @@ namespace VeraCrypt
 		wcerr << L"Warning: " << static_cast<wstring> (message) << endl;
 	}
 
-	void TextUserInterface::ExportSecurityTokenKeyfile () const
+	void TextUserInterface::ExportTokenKeyfile () const
 	{
-		wstring keyfilePath = AskString (_("Enter security token keyfile path: "));
+		wstring keyfilePath = AskString (_("Enter token keyfile path: "));
 
 		if (keyfilePath.empty())
 			throw UserAbort (SRC_POS);
 
-		SecurityTokenKeyfile tokenKeyfile (keyfilePath);
+        shared_ptr<TokenKeyfile> tokenKeyfile = Token::getTokenKeyfile(keyfilePath);
 
 		vector <byte> keyfileData;
-		SecurityToken::GetKeyfileData (tokenKeyfile, keyfileData);
+		tokenKeyfile->GetKeyfileData (keyfileData);
 
 		BufferPtr keyfileDataBuf (&keyfileData.front(), keyfileData.size());
 		finally_do_arg (BufferPtr, keyfileDataBuf, { finally_arg.Erase(); });
@@ -1038,9 +1112,9 @@ namespace VeraCrypt
 		return shared_ptr <GetStringFunctor> (new AdminPasswordRequestHandler (this));
 	}
 
-	void TextUserInterface::ImportSecurityTokenKeyfiles () const
+	void TextUserInterface::ImportTokenKeyfiles () const
 	{
-		list <SecurityTokenInfo> tokens = SecurityToken::GetAvailableTokens();
+		list <shared_ptr<TokenInfo>> tokens = Token::GetAvailableTokens();
 
 		if (tokens.empty())
 			throw_err (LangString ["NO_TOKENS_FOUND"]);
@@ -1049,19 +1123,19 @@ namespace VeraCrypt
 
 		if (tokens.size() == 1)
 		{
-			slotId = tokens.front().SlotId;
+			slotId = tokens.front()->SlotId;
 		}
 		else
 		{
-			foreach (const SecurityTokenInfo &token, tokens)
+			foreach (const shared_ptr<TokenInfo> &token, tokens)
 			{
 				wstringstream tokenLabel;
-				tokenLabel << L"[" << token.SlotId << L"] " << LangString["TOKEN_SLOT_ID"].c_str() << L" " << token.SlotId << L"  " << token.Label;
+				tokenLabel << L"[" << token->SlotId << L"] " << LangString["TOKEN_SLOT_ID"].c_str() << L" " << token->SlotId << L"  " << token->Label;
 
 				ShowInfo (tokenLabel.str());
 			}
 
-			slotId = (CK_SLOT_ID) AskSelection (tokens.back().SlotId, tokens.front().SlotId);
+			slotId = (CK_SLOT_ID) AskSelection (tokens.back()->SlotId, tokens.front()->SlotId);
 		}
 
 		shared_ptr <KeyfileList> keyfiles;
@@ -1156,7 +1230,7 @@ namespace VeraCrypt
 
 		try
 		{
-			SecurityToken::InitLibrary (Preferences.SecurityTokenModule, auto_ptr <GetPinFunctor> (new PinRequestHandler (this)), auto_ptr <SendExceptionFunctor> (new WarningHandler (this)));
+			SecurityToken::InitLibrary (Preferences.SecurityTokenModule, unique_ptr <GetPinFunctor> (new PinRequestHandler (this)), unique_ptr <SendExceptionFunctor> (new WarningHandler (this)));
 		}
 		catch (Exception &e)
 		{
@@ -1165,14 +1239,30 @@ namespace VeraCrypt
 		}
 	}
 
-	void TextUserInterface::ListSecurityTokenKeyfiles () const
+	void TextUserInterface::ListTokenKeyfiles () const
 	{
-		foreach (const SecurityTokenKeyfile &keyfile, SecurityToken::GetAvailableKeyfiles())
+		foreach (const shared_ptr<TokenKeyfile> keyfile, Token::GetAvailableKeyfiles(true))
 		{
-			ShowString (wstring (SecurityTokenKeyfilePath (keyfile)));
+			ShowString (wstring (TokenKeyfilePath (*keyfile)));
 			ShowString (L"\n");
 		}
 	}
+    void TextUserInterface::ListSecurityTokenKeyfiles () const
+    {
+        foreach (const TokenKeyfile &keyfile, SecurityToken::GetAvailableKeyfiles())
+        {
+            ShowString (wstring (TokenKeyfilePath (keyfile)));
+            ShowString (L"\n");
+        }
+    }
+    void TextUserInterface::ListEMVTokenKeyfiles () const
+    {
+        foreach (const TokenKeyfile &keyfile, EMVToken::GetAvailableKeyfiles())
+        {
+            ShowString (wstring (TokenKeyfilePath (keyfile)));
+            ShowString (L"\n");
+        }
+    }
 
 	VolumeInfoList TextUserInterface::MountAllDeviceHostedVolumes (MountOptions &options) const
 	{
@@ -1181,12 +1271,14 @@ namespace VeraCrypt
 			if (!options.Password)
 				options.Password = AskPassword();
 
-			if (!options.TrueCryptMode && (options.Pim < 0))
+			if (options.Pim < 0)
 				options.Pim = AskPim (_("Enter PIM"));
 
 			if (!options.Keyfiles)
 				options.Keyfiles = AskKeyfiles();
 
+			options.EMVSupportEnabled = true;
+
 			VolumeInfoList mountedVolumes = UserInterface::MountAllDeviceHostedVolumes (options);
 
 			if (!mountedVolumes.empty())
@@ -1225,6 +1317,8 @@ namespace VeraCrypt
 		VolumePassword password;
 		KeyfileList keyfiles;
 
+		options.EMVSupportEnabled = true;
+
 		if ((!options.Password || options.Password->IsEmpty())
 			&& (!options.Keyfiles || options.Keyfiles->empty())
 			&& !Core->IsPasswordCacheEmpty())
@@ -1247,7 +1341,7 @@ namespace VeraCrypt
 				options.Password = AskPassword (StringFormatter (_("Enter password for {0}"), wstring (*options.Path)));
 			}
 
-			if (!options.TrueCryptMode && (options.Pim < 0))
+			if (options.Pim < 0)
 			{
 				options.Pim = AskPim (StringFormatter (_("Enter PIM for {0}"), wstring (*options.Path)));
 			}
@@ -1266,7 +1360,7 @@ namespace VeraCrypt
 			{
 				if (!options.ProtectionPassword)
 					options.ProtectionPassword = AskPassword (_("Enter password for hidden volume"));
-				if (!options.TrueCryptMode && (options.ProtectionPim < 0))
+				if (options.ProtectionPim < 0)
 					options.ProtectionPim = AskPim (_("Enter PIM for hidden volume"));
 				if (!options.ProtectionKeyfiles)
 					options.ProtectionKeyfiles = AskKeyfiles (_("Enter keyfile for hidden volume"));
@@ -1299,12 +1393,14 @@ namespace VeraCrypt
 						options.UseBackupHeaders = false;
 						ShowInfo (e);
 						options.Password.reset();
+						options.Pim = -1;
 					}
 				}
 				else
 				{
 					ShowInfo (e);
 					options.Password.reset();
+					options.Pim = -1;
 				}
 
 				ShowString (L"\n");
@@ -1412,7 +1508,7 @@ namespace VeraCrypt
 		shared_ptr <Pkcs5Kdf> kdf;
 		if (CmdLine->ArgHash)
 		{
-			kdf = Pkcs5Kdf::GetAlgorithm (*CmdLine->ArgHash, false);
+			kdf = Pkcs5Kdf::GetAlgorithm (*CmdLine->ArgHash);
 		}
 
 		ShowInfo (LangString["HEADER_RESTORE_EXTERNAL_INTERNAL"]);
@@ -1442,6 +1538,7 @@ namespace VeraCrypt
 			shared_ptr <Volume> volume;
 			MountOptions options;
 			options.Path = volumePath;
+			options.EMVSupportEnabled = true;
 
 			while (!volume)
 			{
@@ -1458,8 +1555,8 @@ namespace VeraCrypt
 						options.Password,
 						options.Pim,
 						kdf,
-						false,
 						options.Keyfiles,
+                        options.EMVSupportEnabled,
 						options.Protection,
 						options.ProtectionPassword,
 						options.ProtectionPim,
@@ -1487,7 +1584,7 @@ namespace VeraCrypt
 
 			// Re-encrypt volume header
 			SecureBuffer newHeaderBuffer (volume->GetLayout()->GetHeaderSize());
-			Core->ReEncryptVolumeHeaderWithNewSalt (newHeaderBuffer, volume->GetHeader(), options.Password, options.Pim,  options.Keyfiles);
+			Core->ReEncryptVolumeHeaderWithNewSalt (newHeaderBuffer, volume->GetHeader(), options.Password, options.Pim,  options.Keyfiles, options.EMVSupportEnabled);
 
 			// Write volume header
 			int headerOffset = volume->GetLayout()->GetHeaderOffset();
@@ -1537,6 +1634,7 @@ namespace VeraCrypt
 
 			// Open the volume header stored in the backup file
 			MountOptions options;
+			options.EMVSupportEnabled = true;
 
 			shared_ptr <VolumeLayout> decryptedLayout;
 
@@ -1564,8 +1662,8 @@ namespace VeraCrypt
 						backupFile.ReadAt (headerBuffer, layout->GetType() == VolumeType::Hidden ? layout->GetHeaderSize() : 0);
 
 						// Decrypt header
-						shared_ptr <VolumePassword> passwordKey = Keyfile::ApplyListToPassword (options.Keyfiles, options.Password);
-						if (layout->GetHeader()->Decrypt (headerBuffer, *passwordKey, options.Pim, kdf, false, layout->GetSupportedKeyDerivationFunctions(false), layout->GetSupportedEncryptionAlgorithms(), layout->GetSupportedEncryptionModes()))
+						shared_ptr <VolumePassword> passwordKey = Keyfile::ApplyListToPassword (options.Keyfiles, options.Password, options.EMVSupportEnabled);
+						if (layout->GetHeader()->Decrypt (headerBuffer, *passwordKey, options.Pim, kdf, layout->GetSupportedKeyDerivationFunctions(), layout->GetSupportedEncryptionAlgorithms(), layout->GetSupportedEncryptionModes()))
 						{
 							decryptedLayout = layout;
 							break;
@@ -1589,7 +1687,7 @@ namespace VeraCrypt
 
 			// Re-encrypt volume header
 			SecureBuffer newHeaderBuffer (decryptedLayout->GetHeaderSize());
-			Core->ReEncryptVolumeHeaderWithNewSalt (newHeaderBuffer, decryptedLayout->GetHeader(), options.Password, options.Pim, options.Keyfiles);
+			Core->ReEncryptVolumeHeaderWithNewSalt (newHeaderBuffer, decryptedLayout->GetHeader(), options.Password, options.Pim, options.Keyfiles, options.EMVSupportEnabled);
 
 			// Write volume header
 			int headerOffset = decryptedLayout->GetHeaderOffset();
@@ -1603,7 +1701,7 @@ namespace VeraCrypt
 			if (decryptedLayout->HasBackupHeader())
 			{
 				// Re-encrypt backup volume header
-				Core->ReEncryptVolumeHeaderWithNewSalt (newHeaderBuffer, decryptedLayout->GetHeader(), options.Password, options.Pim, options.Keyfiles);
+				Core->ReEncryptVolumeHeaderWithNewSalt (newHeaderBuffer, decryptedLayout->GetHeader(), options.Password, options.Pim, options.Keyfiles, options.EMVSupportEnabled);
 
 				// Write backup volume header
 				headerOffset = decryptedLayout->GetBackupHeaderOffset();