Document CI validation flag 0x20 and add kernel probe

tests/ci-file-object-probe.cpp

@@ -0,0 +1,52 @@
+// Compile into an existing signed test driver; this file has no DriverEntry.
+#ifndef DOMITO_CI_PROBE_HOST_TEST
+#include <ntifs.h>
+#include "Domito.MinCrypt.h"
+#endif
+#include "ci-file-object-probe.h"
+
+_IRQL_requires_max_(PASSIVE_LEVEL)
+void DomitoProbeCiValidateFileObject(
+    PFILE_OBJECT FileObject, DOMITO_CI_PROBE_RESULT* Results)
+{
+    const ULONG flags[DOMITO_CI_PROBE_RESULT_COUNT] = {
+        0, DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE,
+        DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE, 0,
+        0, DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE
+    };
+    for (ULONG i = 0; i < DOMITO_CI_PROBE_RESULT_COUNT; ++i)
+    {
+        MINCRYPT_POLICY_INFO policy = {};
+        MINCRYPT_POLICY_INFO timestamp = {};
+        policy.Size = sizeof(policy);
+        timestamp.Size = sizeof(timestamp);
+        struct {
+            UCHAR Bytes[MINCRYPT_MAX_HASH_LENGTH];
+            ULONG Guard;
+        } hash = {};
+        hash.Guard = 0xD01170AB;
+        DOMITO_CI_PROBE_RESULT& result = Results[i];
+        result = {};
+        result.Flags = flags[i];
+        result.InputCapacity = i < 4 ? sizeof(hash.Bytes) : sizeof(hash.Bytes) - 1;
+        result.HashSize = result.InputCapacity;
+        result.Status = CiValidateFileObject(FileObject, result.Flags, 0,
+            &policy, &timestamp, &result.SigningTime, hash.Bytes,
+            &result.HashSize, &result.HashAlgId);
+        result.HashGuardIntact = hash.Guard == 0xD01170AB;
+        // Keep failure outputs as raw observations; only successful calls have
+        // a usable digest. Do not dereference the incompletely mapped chains.
+        result.PolicyBits = policy.PolicyBits;
+        result.TimeStampPolicyBits = timestamp.PolicyBits;
+        result.VerificationStatus = (NTSTATUS)policy.VerificationStatus;
+        result.TimeStampVerificationStatus = (NTSTATUS)timestamp.VerificationStatus;
+        result.HasChain = policy.ChainInfo != nullptr;
+        result.HasTimeStampChain = timestamp.ChainInfo != nullptr;
+        if (NT_SUCCESS(result.Status) && result.HashSize <= sizeof(result.Hash))
+        {
+            RtlCopyMemory(result.Hash, hash.Bytes, result.HashSize);
+        }
+        CiFreePolicyInfo(&policy);
+        CiFreePolicyInfo(&timestamp);
+    }
+}