From 183cbc087a7551e4335da212e93732a72a7570f0 Mon Sep 17 00:00:00 2001 From: Mounir IDRASSI Date: Sat, 24 Sep 2016 23:26:39 +0200 Subject: Windows Driver: Erase sensitive boot memory before throwing fatal exception --- src/Driver/DriveFilter.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/Driver/DriveFilter.c b/src/Driver/DriveFilter.c index a3d76b3a..9c53147b 100644 --- a/src/Driver/DriveFilter.c +++ b/src/Driver/DriveFilter.c @@ -424,7 +424,16 @@ static NTSTATUS MountDrive (DriveFilterExtension *Extension, Password *password, Extension->Queue.CryptoInfo->EncryptedAreaStart.Value = BootArgs.DecoySystemPartitionStart; if (Extension->Queue.CryptoInfo->VolumeSize.Value > hiddenPartitionOffset - BootArgs.DecoySystemPartitionStart) + { + // Erase boot loader scheduled keys + if (mappedCryptoInfo) + { + burn (mappedCryptoInfo, BootArgs.CryptoInfoLength); + MmUnmapIoSpace (mappedCryptoInfo, BootArgs.CryptoInfoLength); + BootArgs.CryptoInfoLength = 0; + } TC_THROW_FATAL_EXCEPTION; + } Dump ("RemappedAreaOffset = %I64d\n", Extension->Queue.RemappedAreaOffset); Dump ("RemappedAreaDataUnitOffset = %I64d\n", Extension->Queue.RemappedAreaDataUnitOffset); -- cgit v1.2.3