From 652e989d238fff2ade0de5a33a0e307e233c06e0 Mon Sep 17 00:00:00 2001 From: Mounir IDRASSI Date: Wed, 9 Jan 2019 00:25:06 +0100 Subject: Windows Security: Add new entry point in driver that allows emergency clearing of all encryption keys from memory. This entry point requires administrative privileges and it will caused BSDO when system encryption is active. It can be useful for example to applications that monitors physical access to the machine and which need to erase sensitive key material from RAM when unauthorized access is detected. --- src/Driver/DriveFilter.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/Driver/DriveFilter.h') diff --git a/src/Driver/DriveFilter.h b/src/Driver/DriveFilter.h index 9ce151c7..17459cbc 100644 --- a/src/Driver/DriveFilter.h +++ b/src/Driver/DriveFilter.h @@ -44,7 +44,7 @@ typedef struct _DriveFilterExtension KEVENT MountWorkItemCompletedEvent; - CRYPTO_INFO *HeaderCryptoInfo; + volatile CRYPTO_INFO *HeaderCryptoInfo; BOOL HiddenSystem; } DriveFilterExtension; @@ -73,6 +73,7 @@ BOOL IsHiddenSystemRunning (); NTSTATUS LoadBootArguments (); static NTSTATUS SaveDriveVolumeHeader (DriveFilterExtension *Extension); NTSTATUS StartBootEncryptionSetup (PDEVICE_OBJECT DeviceObject, PIRP irp, PIO_STACK_LOCATION irpSp); +void EmergencyClearAllKeys (PIRP irp, PIO_STACK_LOCATION irpSp); void ReopenBootVolumeHeader (PIRP irp, PIO_STACK_LOCATION irpSp); NTSTATUS StartDecoySystemWipe (PDEVICE_OBJECT DeviceObject, PIRP irp, PIO_STACK_LOCATION irpSp); void StartLegacyHibernationDriverFilter (); -- cgit v1.2.3