diff --git a/NOTES.md b/NOTES.md index 4c0e107..c4461c5 100644 --- a/NOTES.md +++ b/NOTES.md @@ -1,7 +1,7 @@ # CI API availability observations See the [CI API compatibility matrix](docs/ci-api-compatibility.md) for the -per-API tables covering thirteen VM, ISO and modern x64/ARM64 samples, with exact +per-API tables covering 20 VM, ISO and modern x64/ARM64 samples, with exact versions, file hashes and machine-readable results. The six-sample notes below describe the original VM corpus and its subsequent ISO follow-up. @@ -40,6 +40,9 @@ in x64 `10.0.19041.1865` and `10.0.22000.318`, and the original investigation finds it present in `10.0.26100.8328`. This brackets Windows 10 servicing observations without identifying the first update adding the export. The CodeIntegrity-RE `iso-corpus-index.json` records the exact files and hashes. +The Windows 10 ARM64 21H2 sample additionally exports it in CI +`10.0.19041.1566`; this does not establish x64 availability at that revision. +The matrix keeps architecture-specific observations separate. A header declaration, import-library symbol, or `NTDDI_VERSION >= NTDDI_WIN10` alone does not make an unconditional static import loadable on the older samples. Callers supporting @@ -47,6 +50,10 @@ those samples must avoid that import or use optional resolution with an explicit unavailable/fallback path. `CiSetTrustedOriginClaimId` likewise cannot be assumed available on every Windows 10 build; it is a CI-global setter. +The original modern x64 sample has display `FileVersion` **26100.8328**, but +its numeric fixed version is **26100.9444**. The matrix records both under the +same SHA-256 identity and uses numeric fixed versions in its tables. + ## Exact sampled files - Windows 10 1507: `10.0.10240.16463` x64, SHA-256 diff --git a/README.md b/README.md index 1639f41..5d0f829 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ Built for and tested on **Windows 10 version 1507 (or newer) x64/ARM64**. 32-Bit - I do not want to force any consumer of the library to drag C++ paradigms into their project. I do expect the user to utilize a modern compiler though, so the library sources themselves may have some 'C++-ish touches' here and there, for my own convenience 😉 - Compatibility with every Windows 10 version. - APIs not available on older builds will give you a `STATUS_NOT_IMPLEMENTED` instead of hard-linking and therefore making your driver fail to load 🤞 - - CI entry points are currently static imports from `ci.lib`; consumers must avoid imports unavailable on their target Windows builds. The [CI API compatibility matrix](docs/ci-api-compatibility.md) records all ten named exports across thirteen exact Windows 10/11 x64 and ARM64 CI files. Export lookup uses the correct name-ordinal mapping and rejects forwarders. Runtime ABI verification remains separate; see the remaining-work ledger below. + - CI entry points are currently static imports from `ci.lib`; consumers must avoid imports unavailable on their target Windows builds. The [CI API compatibility matrix](docs/ci-api-compatibility.md) records all ten named exports across 20 exact Windows 10/11 x64 and ARM64 CI files. Export lookup uses the correct name-ordinal mapping and rejects forwarders. Runtime ABI verification remains separate; see the remaining-work ledger below. - No conflicts with WDF or DMF - The consuming driver *may* (but doesn't have to) utilize Microsoft WDF or DMF in addition without having to fear any incompatibilities 💪 - Reliable SAL annotations. diff --git a/docs/ci-api-compatibility.json b/docs/ci-api-compatibility.json index aeccb4a..86c39e7 100644 --- a/docs/ci-api-compatibility.json +++ b/docs/ci-api-compatibility.json @@ -1,10 +1,11 @@ { - "schema_version": 1, + "schema_version": 2, "scope": "Observed named PE exports in exact architecture-specific ci.dll samples; not runtime or ABI certification", + "source_hash_encoding": "Canonical JSON: UTF-8, sorted keys, comma/colon separators, ensure_ascii=false", "generated_from": { - "corpus-index.json": "c324dddaa4b88e66eb119e2ce26023face3763fb68d496d6285b836a60d267f8", - "iso-corpus-index.json": "97da9e94d30854f6480429becfff34efe5b5f978a772e0113b54b9f655d8c325", - "manifest.json": "7712d6e88b81ac155bd1371ada61df2848e943a12abe709b7b2050ce4b91c6e5", + "corpus-index.json": "d2c6507794314ca38a2015c74f3b66e81a4bd82d982be0ed1911dcff1d79475a", + "iso-corpus-index.json": "ba526a8548f3be100e8d13019aed57de9703a142615c509870720572bc636217", + "manifest.json": "bd215ebd3deb480a39b5d71a6ed709dad20368cbe90879a52070b56b023284d4", "ci-26100.8328-evidence.json": "ea0f939df9d8b7abde40e3402c01b2ac398253728f329e8c2b7134de8df6305f" }, "apis": [ @@ -203,6 +204,161 @@ "CiVerifyHashInCatalog": true } }, + { + "label": "Windows 10 1809 initial x64 ISO", + "ci_file_version": "10.0.17763.1", + "architecture": "x64", + "sha256": "eb177481f2aea3cae0c2f97f7058e7447c0695e4489428406598f168d4dcc5e8", + "source": "iso-corpus-index.json", + "named_exports": [ + "CiCheckSignedFile", + "CiFindPageHashesInCatalog", + "CiFindPageHashesInSignedFile", + "CiFreePolicyInfo", + "CiGetPEInformation", + "CiInitialize", + "CiSetTrustedOriginClaimId", + "CiValidateFileObject", + "CiVerifyHashInCatalog" + ], + "ordinal_only_export_count": 3, + "api_presence": { + "CiCheckSignedFile": true, + "CiFindPageHashesInCatalog": true, + "CiFindPageHashesInSignedFile": true, + "CiFreePolicyInfo": true, + "CiGetCertPublisherName": false, + "CiGetPEInformation": true, + "CiInitialize": true, + "CiSetTrustedOriginClaimId": true, + "CiValidateFileObject": true, + "CiVerifyHashInCatalog": true + } + }, + { + "label": "Windows 10 1809 October v2 x64 ISO", + "ci_file_version": "10.0.17763.348", + "architecture": "x64", + "sha256": "da8282173cbce7ea38f8fca64db0972c3d9614ddbca98f6b96d11a4cadde92ad", + "source": "iso-corpus-index.json", + "named_exports": [ + "CiCheckSignedFile", + "CiFindPageHashesInCatalog", + "CiFindPageHashesInSignedFile", + "CiFreePolicyInfo", + "CiGetPEInformation", + "CiInitialize", + "CiSetTrustedOriginClaimId", + "CiValidateFileObject", + "CiVerifyHashInCatalog" + ], + "ordinal_only_export_count": 3, + "api_presence": { + "CiCheckSignedFile": true, + "CiFindPageHashesInCatalog": true, + "CiFindPageHashesInSignedFile": true, + "CiFreePolicyInfo": true, + "CiGetCertPublisherName": false, + "CiGetPEInformation": true, + "CiInitialize": true, + "CiSetTrustedOriginClaimId": true, + "CiValidateFileObject": true, + "CiVerifyHashInCatalog": true + } + }, + { + "label": "Windows 10 1903 v1 x64 ISO", + "ci_file_version": "10.0.18362.1", + "architecture": "x64", + "sha256": "5d01bb84fa516e23c25def8ea03fc6b696082ccc67a61575fd00d1fe7c273d72", + "source": "iso-corpus-index.json", + "named_exports": [ + "CiCheckSignedFile", + "CiFindPageHashesInCatalog", + "CiFindPageHashesInSignedFile", + "CiFreePolicyInfo", + "CiGetPEInformation", + "CiInitialize", + "CiSetTrustedOriginClaimId", + "CiValidateFileObject", + "CiVerifyHashInCatalog" + ], + "ordinal_only_export_count": 3, + "api_presence": { + "CiCheckSignedFile": true, + "CiFindPageHashesInCatalog": true, + "CiFindPageHashesInSignedFile": true, + "CiFreePolicyInfo": true, + "CiGetCertPublisherName": false, + "CiGetPEInformation": true, + "CiInitialize": true, + "CiSetTrustedOriginClaimId": true, + "CiValidateFileObject": true, + "CiVerifyHashInCatalog": true + } + }, + { + "label": "Windows 10 1903 v2 x64 ISO", + "ci_file_version": "10.0.18362.329", + "architecture": "x64", + "sha256": "d12131f14f781f8c314a795384e02afc3c2902bf67da9c2e75d8163c891bdd89", + "source": "iso-corpus-index.json", + "named_exports": [ + "CiCheckSignedFile", + "CiFindPageHashesInCatalog", + "CiFindPageHashesInSignedFile", + "CiFreePolicyInfo", + "CiGetPEInformation", + "CiInitialize", + "CiSetTrustedOriginClaimId", + "CiValidateFileObject", + "CiVerifyHashInCatalog" + ], + "ordinal_only_export_count": 3, + "api_presence": { + "CiCheckSignedFile": true, + "CiFindPageHashesInCatalog": true, + "CiFindPageHashesInSignedFile": true, + "CiFreePolicyInfo": true, + "CiGetCertPublisherName": false, + "CiGetPEInformation": true, + "CiInitialize": true, + "CiSetTrustedOriginClaimId": true, + "CiValidateFileObject": true, + "CiVerifyHashInCatalog": true + } + }, + { + "label": "Windows 10 1909 x64 ISO", + "ci_file_version": "10.0.18362.418", + "architecture": "x64", + "sha256": "c3c5d32da42fa69b0795cd0f8c57252670d673fb036685db5c7d6392ffee0293", + "source": "iso-corpus-index.json", + "named_exports": [ + "CiCheckSignedFile", + "CiFindPageHashesInCatalog", + "CiFindPageHashesInSignedFile", + "CiFreePolicyInfo", + "CiGetPEInformation", + "CiInitialize", + "CiSetTrustedOriginClaimId", + "CiValidateFileObject", + "CiVerifyHashInCatalog" + ], + "ordinal_only_export_count": 3, + "api_presence": { + "CiCheckSignedFile": true, + "CiFindPageHashesInCatalog": true, + "CiFindPageHashesInSignedFile": true, + "CiFreePolicyInfo": true, + "CiGetCertPublisherName": false, + "CiGetPEInformation": true, + "CiInitialize": true, + "CiSetTrustedOriginClaimId": true, + "CiValidateFileObject": true, + "CiVerifyHashInCatalog": true + } + }, { "label": "Windows 10 2004 ISO", "ci_file_version": "10.0.19041.1", @@ -332,7 +488,7 @@ }, { "label": "Windows 11 24H2 sample", - "ci_file_version": "10.0.26100.8328", + "ci_file_version": "10.0.26100.9444", "architecture": "x64", "sha256": "c7d23814f3202c51fb23e3ca3d4328855787383cee5d14c4a986a13ec2aeda0b", "source": "ci-26100.8328-evidence.json", @@ -349,6 +505,71 @@ "CiVerifyHashInCatalog" ], "ordinal_only_export_count": 3, + "api_presence": { + "CiCheckSignedFile": true, + "CiFindPageHashesInCatalog": true, + "CiFindPageHashesInSignedFile": true, + "CiFreePolicyInfo": true, + "CiGetCertPublisherName": true, + "CiGetPEInformation": true, + "CiInitialize": true, + "CiSetTrustedOriginClaimId": true, + "CiValidateFileObject": true, + "CiVerifyHashInCatalog": true + }, + "display_file_version": "10.0.26100.8328" + }, + { + "label": "Windows 10 21H2 ARM64 ISO (archive Raspberry Pi folder)", + "ci_file_version": "10.0.19041.1566", + "architecture": "ARM64", + "sha256": "a35f651261691cc67acc9c8bfd00bba7a64dd9f16d2c4b6fe1d183e34aeead78", + "source": "iso-corpus-index.json", + "named_exports": [ + "CiCheckSignedFile", + "CiFindPageHashesInCatalog", + "CiFindPageHashesInSignedFile", + "CiFreePolicyInfo", + "CiGetCertPublisherName", + "CiGetPEInformation", + "CiInitialize", + "CiSetTrustedOriginClaimId", + "CiValidateFileObject", + "CiVerifyHashInCatalog" + ], + "ordinal_only_export_count": 3, + "api_presence": { + "CiCheckSignedFile": true, + "CiFindPageHashesInCatalog": true, + "CiFindPageHashesInSignedFile": true, + "CiFreePolicyInfo": true, + "CiGetCertPublisherName": true, + "CiGetPEInformation": true, + "CiInitialize": true, + "CiSetTrustedOriginClaimId": true, + "CiValidateFileObject": true, + "CiVerifyHashInCatalog": true + } + }, + { + "label": "Windows 10 22H2.7 ARM64 ISO", + "ci_file_version": "10.0.19041.2965", + "architecture": "ARM64", + "sha256": "33f2d1256f60392bbb84c4251d6435461dfa852a100e065376f83dc8a4dd2ec6", + "source": "iso-corpus-index.json", + "named_exports": [ + "CiCheckSignedFile", + "CiFindPageHashesInCatalog", + "CiFindPageHashesInSignedFile", + "CiFreePolicyInfo", + "CiGetCertPublisherName", + "CiGetPEInformation", + "CiInitialize", + "CiSetTrustedOriginClaimId", + "CiValidateFileObject", + "CiVerifyHashInCatalog" + ], + "ordinal_only_export_count": 3, "api_presence": { "CiCheckSignedFile": true, "CiFindPageHashesInCatalog": true, diff --git a/docs/ci-api-compatibility.md b/docs/ci-api-compatibility.md index 6db37d9..ad5ae16 100644 --- a/docs/ci-api-compatibility.md +++ b/docs/ci-api-compatibility.md @@ -1,6 +1,6 @@ # CI API compatibility matrix -This matrix records **named export presence in 13 exact `ci.dll` files**, +This matrix records **named export presence in 20 exact `ci.dll` files**, with architecture stated separately for each sample. **Yes** means the complete PE export directory contains the name; **No** means it does not. Neither result is inferred from a header, import library or PDB. @@ -11,7 +11,14 @@ In particular, the Windows 10 22H2 consumer ISO contains CI **19041.1865**. Do not extrapolate a cell to every servicing revision of that Windows release. [Machine-readable matrix](ci-api-compatibility.json) includes exact SHA-256 identities, -all per-API results and hashes of the retained source inventories. +all per-API results and canonical JSON hashes of the retained source inventories. +Source hashes ignore whitespace and line-ending differences between checkouts; +the binary SHA-256 identities always cover the exact original bytes. + +The tables use numeric `VS_FIXEDFILEINFO` versions. The original modern x64 +sample has **fixed version 26100.9444** but its string `FileVersion` reports +**26100.8328**. Original research/header labels retain that string version; +they identify the same SHA-256 file, not two different CI samples. ## Windows 10 1507–1803 x64 samples @@ -28,20 +35,50 @@ all per-API results and hashes of the retained source inventories. | `CiValidateFileObject` | Yes | Yes | Yes | Yes | Yes | Yes | | `CiVerifyHashInCatalog` | Yes | Yes | Yes | Yes | Yes | Yes | -## Later Windows 10 and Windows 11 x64 samples +## Later Windows 10 x64 samples -| API | 19041.1 | 19041.1865 | 22000.318 | 22621.2792 | 26100.8328 | -| --- | --- | --- | --- | --- | --- | -| `CiCheckSignedFile` | Yes | Yes | Yes | Yes | Yes | -| `CiFindPageHashesInCatalog` | Yes | Yes | Yes | Yes | Yes | -| `CiFindPageHashesInSignedFile` | Yes | Yes | Yes | Yes | Yes | -| `CiFreePolicyInfo` | Yes | Yes | Yes | Yes | Yes | -| `CiGetCertPublisherName` | No | Yes | Yes | Yes | Yes | -| `CiGetPEInformation` | Yes | Yes | Yes | Yes | Yes | -| `CiInitialize` | Yes | Yes | Yes | Yes | Yes | -| `CiSetTrustedOriginClaimId` | Yes | Yes | Yes | Yes | Yes | -| `CiValidateFileObject` | Yes | Yes | Yes | Yes | Yes | -| `CiVerifyHashInCatalog` | Yes | Yes | Yes | Yes | Yes | +| API | 17763.1 | 17763.348 | 18362.1 | 18362.329 | 18362.418 | 19041.1 | 19041.1865 | +| --- | --- | --- | --- | --- | --- | --- | --- | +| `CiCheckSignedFile` | Yes | Yes | Yes | Yes | Yes | Yes | Yes | +| `CiFindPageHashesInCatalog` | Yes | Yes | Yes | Yes | Yes | Yes | Yes | +| `CiFindPageHashesInSignedFile` | Yes | Yes | Yes | Yes | Yes | Yes | Yes | +| `CiFreePolicyInfo` | Yes | Yes | Yes | Yes | Yes | Yes | Yes | +| `CiGetCertPublisherName` | No | No | No | No | No | No | Yes | +| `CiGetPEInformation` | Yes | Yes | Yes | Yes | Yes | Yes | Yes | +| `CiInitialize` | Yes | Yes | Yes | Yes | Yes | Yes | Yes | +| `CiSetTrustedOriginClaimId` | Yes | Yes | Yes | Yes | Yes | Yes | Yes | +| `CiValidateFileObject` | Yes | Yes | Yes | Yes | Yes | Yes | Yes | +| `CiVerifyHashInCatalog` | Yes | Yes | Yes | Yes | Yes | Yes | Yes | + +## Windows 11 x64 samples + +| API | 22000.318 | 22621.2792 | 26100.9444 | +| --- | --- | --- | --- | +| `CiCheckSignedFile` | Yes | Yes | Yes | +| `CiFindPageHashesInCatalog` | Yes | Yes | Yes | +| `CiFindPageHashesInSignedFile` | Yes | Yes | Yes | +| `CiFreePolicyInfo` | Yes | Yes | Yes | +| `CiGetCertPublisherName` | Yes | Yes | Yes | +| `CiGetPEInformation` | Yes | Yes | Yes | +| `CiInitialize` | Yes | Yes | Yes | +| `CiSetTrustedOriginClaimId` | Yes | Yes | Yes | +| `CiValidateFileObject` | Yes | Yes | Yes | +| `CiVerifyHashInCatalog` | Yes | Yes | Yes | + +## Windows 10 ARM64 samples + +| API | 19041.1566 | 19041.2965 | +| --- | --- | --- | +| `CiCheckSignedFile` | Yes | Yes | +| `CiFindPageHashesInCatalog` | Yes | Yes | +| `CiFindPageHashesInSignedFile` | Yes | Yes | +| `CiFreePolicyInfo` | Yes | Yes | +| `CiGetCertPublisherName` | Yes | Yes | +| `CiGetPEInformation` | Yes | Yes | +| `CiInitialize` | Yes | Yes | +| `CiSetTrustedOriginClaimId` | Yes | Yes | +| `CiValidateFileObject` | Yes | Yes | +| `CiVerifyHashInCatalog` | Yes | Yes | ## Windows 11 ARM64 samples @@ -72,6 +109,16 @@ all per-API results and hashes of the retained source inventories. `1db7ae5a08bd2361fc7fcdd373fb980e8d680035e67b02e5967095db0443effd`. - Windows 10 1803: **10.0.17134.1130 x64**, SHA-256 `8ce3b8fe38c23b699f30b045383640019a429d3a9d513285c655bffe03a796d9`. +- Windows 10 1809 initial x64 ISO: **10.0.17763.1 x64**, SHA-256 + `eb177481f2aea3cae0c2f97f7058e7447c0695e4489428406598f168d4dcc5e8`. +- Windows 10 1809 October v2 x64 ISO: **10.0.17763.348 x64**, SHA-256 + `da8282173cbce7ea38f8fca64db0972c3d9614ddbca98f6b96d11a4cadde92ad`. +- Windows 10 1903 v1 x64 ISO: **10.0.18362.1 x64**, SHA-256 + `5d01bb84fa516e23c25def8ea03fc6b696082ccc67a61575fd00d1fe7c273d72`. +- Windows 10 1903 v2 x64 ISO: **10.0.18362.329 x64**, SHA-256 + `d12131f14f781f8c314a795384e02afc3c2902bf67da9c2e75d8163c891bdd89`. +- Windows 10 1909 x64 ISO: **10.0.18362.418 x64**, SHA-256 + `c3c5d32da42fa69b0795cd0f8c57252670d673fb036685db5c7d6392ffee0293`. - Windows 10 2004 ISO: **10.0.19041.1 x64**, SHA-256 `2955710d34db26e352e62b20861ba338f0216cc36b378d128057be955e184282`. - Windows 10 22H2 consumer ISO: **10.0.19041.1865 x64**, SHA-256 @@ -80,8 +127,13 @@ all per-API results and hashes of the retained source inventories. `301ae49ac5b87cf1cbe07d9d3c6486a066d045b6bf55fc8eb392d52951ec69ff`. - Windows 11 23H2 English ISO: **10.0.22621.2792 x64**, SHA-256 `9ed77b8a53946ced8c3540edb26a765060dff908544634e7b069aa49f2b41559`. -- Windows 11 24H2 sample: **10.0.26100.8328 x64**, SHA-256 +- Windows 11 24H2 sample: **10.0.26100.9444 x64**, SHA-256 `c7d23814f3202c51fb23e3ca3d4328855787383cee5d14c4a986a13ec2aeda0b`. + String FileVersion: **10.0.26100.8328** (original research label). +- Windows 10 21H2 ARM64 ISO (archive Raspberry Pi folder): **10.0.19041.1566 ARM64**, SHA-256 + `a35f651261691cc67acc9c8bfd00bba7a64dd9f16d2c4b6fe1d183e34aeead78`. +- Windows 10 22H2.7 ARM64 ISO: **10.0.19041.2965 ARM64**, SHA-256 + `33f2d1256f60392bbb84c4251d6435461dfa852a100e065376f83dc8a4dd2ec6`. - Windows 11 22H2.9 ARM64 ISO: **10.0.22621.1702 ARM64**, SHA-256 `4164ac08fd19628c5ab6cbca6234265ac2bf7f39d5149f57d3845646d8a8ad60`. - Windows 11 24H2 ARM64 ISO: **10.0.26100.1591 ARM64**, SHA-256 @@ -92,9 +144,12 @@ all per-API results and hashes of the retained source inventories. - `CiValidateFileObject` is already exported in the sampled Windows 10 1507 file. - `CiSetTrustedOriginClaimId` is present in the sampled 1703 file and absent in the three earlier samples. This does not prove its first introduction build. -- `CiGetCertPublisherName` is absent in 19041.1 and present in 19041.1865. +- On sampled x64 files, `CiGetCertPublisherName` is absent in 19041.1 + and present in 19041.1865. Its first Windows 10 servicing update remains unknown. It is also present - in the sampled 22000.318 and 26100.8328 files. + in the sampled 22000.318 and 26100.9444 fixed-version files. +- The Windows 10 ARM64 21H2 sample already exports the publisher-name API + in CI 19041.1566. That does not establish x64 availability at that revision. - CI entry points currently use static imports from `ci.lib`. An unavailable import can prevent driver loading; this matrix does not add an automatic `STATUS_NOT_IMPLEMENTED` fallback. Supporting these older samples requires @@ -106,8 +161,8 @@ all per-API results and hashes of the retained source inventories. ## Coverage gaps and evidence -**Unknown / not sampled:** x86 export availability; Windows 10 ARM64; -pre-Windows-10; Windows 10 1809/1903/1909; and other servicing revisions +**Unknown / not sampled:** x86 export availability; pre-Windows-10; +earlier Windows 10 ARM64 releases; and other servicing revisions or architecture/release combinations absent from these tables. These are gaps, not negative export results. No interval between two samples is certified. Runtime verification and cross-version ABI checks diff --git a/docs/implementation-status.md b/docs/implementation-status.md index 30e7420..7cc0d5c 100644 --- a/docs/implementation-status.md +++ b/docs/implementation-status.md @@ -59,8 +59,9 @@ and compilation do not close these: statuses, policies and fixture/environment identities (issue #3). 2. Complete historical and ARM64 ABI/structure verification and runtime tests. The [published export matrix](ci-api-compatibility.md) now covers all ten - named APIs across thirteen exact Windows 10/11 x64 and ARM64 CI files. - Windows 11 ISO extraction adds 23H2 x64 and 22H2/24H2 ARM64 observations. + named APIs across 20 exact Windows 10/11 x64 and ARM64 CI files. + ISO coverage includes Windows 10 1809/1903 revisions, 1909, 21H2/22H2 ARM64, + and Windows 11 23H2 x64 plus 22H2/24H2 ARM64. The ARM64 observations establish export presence; their structure layouts and runtime behavior remain unverified. This closes the initial export-presence matrix; additional releases, servicing revisions and architectures remain diff --git a/docs/mincrypt-contracts.md b/docs/mincrypt-contracts.md index cfcaebb..e032656 100644 --- a/docs/mincrypt-contracts.md +++ b/docs/mincrypt-contracts.md @@ -15,10 +15,15 @@ records and readable `evidence/` files. The historical corpus below adds sampled x64 Windows 10 observations; ARM64 and unsampled-build compatibility remain open. Compile-target `NTDDI_VERSION` is not runtime layout negotiation. +The original modern research and `Domito.MinCrypt.26100.h` use the string +`FileVersion` label **26100.8328**. That same exact binary has numeric +`VS_FIXEDFILEINFO` version **26100.9444**, which the export matrix uses. Its +SHA-256 and recovered contracts are unchanged; these labels identify one file. + ## Historical x64 corpus: availability and structure evolution The [CI API compatibility matrix](ci-api-compatibility.md) lists observed named -exports for thirteen exact x64/ARM64 CI files, including the later ISO samples. Consult it +exports for 20 exact x64/ARM64 CI files, including the later ISO samples. Consult it for import availability, and the contracts below for layout and ownership limits. [NOTES.md](../NOTES.md) lists the exact identities of six sampled Windows 10