Add reusable certificate and file validation helpers

Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style.

include/Domito.Consumer.h

@@ -0,0 +1,200 @@
+#pragma once
+#include "Domito.h"
+
+// Consumer helpers: see docs/consumer-helpers.md for ownership and trust limits.
+typedef struct _DOMITO_BYTE_VIEW
+{
+    const UCHAR* Data;
+    ULONG Size;
+} DOMITO_BYTE_VIEW;
+
+typedef struct _DOMITO_CERTIFICATE_SPKI
+{
+    DOMITO_BYTE_VIEW Encoded; // Complete SPKI SEQUENCE, including tag and length.
+    DOMITO_BYTE_VIEW Content; // Legacy consumer convention: excludes that header.
+} DOMITO_CERTIFICATE_SPKI;
+
+typedef enum _DOMITO_CERTIFICATE_HASH_KIND
+{
+    DomitoCertificateHashDer = 0,
+    DomitoCertificateHashSpkiDer = 1,
+    DomitoCertificateHashSpkiContentLegacy = 2
+} DOMITO_CERTIFICATE_HASH_KIND;
+
+// Bounded positional DER extraction, not X.509 validation. Views borrow CertData.
+_Must_inspect_result_
+_IRQL_requires_max_(PASSIVE_LEVEL)
+EXTERN_C
+NTSTATUS
+DomitoGetCertificateSpki(
+    _In_reads_bytes_(CertSize) const UCHAR* CertData,
+    _In_ ULONG CertSize,
+    _Out_ DOMITO_CERTIFICATE_SPKI* Spki
+);
+
+// SHA-1/256/384/512. HashSize is capacity on entry, bytes on success, required
+// size on BUFFER_TOO_SMALL, zero on other failures. Hash may be NULL to size.
+// Input/output must not overlap. Hash contains zero bytes on operational failure.
+_Must_inspect_result_
+_IRQL_requires_max_(PASSIVE_LEVEL)
+EXTERN_C
+NTSTATUS
+DomitoHashBuffer(
+    _In_reads_bytes_opt_(Size) const UCHAR* Bytes,
+    _In_ ULONG Size,
+    _In_ ALG_ID Algorithm,
+    _Out_writes_bytes_to_opt_(*HashSize, *HashSize) UCHAR* Hash,
+    _Inout_ ULONG* HashSize
+);
+
+_Must_inspect_result_
+_IRQL_requires_max_(PASSIVE_LEVEL)
+EXTERN_C
+NTSTATUS
+DomitoHashCertificate(
+    _In_reads_bytes_(CertSize) const UCHAR* CertData,
+    _In_ ULONG CertSize,
+    _In_ DOMITO_CERTIFICATE_HASH_KIND Kind,
+    _In_ ALG_ID Algorithm,
+    _Out_writes_bytes_to_opt_(*HashSize, *HashSize) UCHAR* Hash,
+    _Inout_ ULONG* HashSize
+);
+
+// Strict length-delimited hex: no spaces, prefixes, separators or invalid digits.
+// Nonoverlapping buffers. Decode clears its output on malformed input.
+_Must_inspect_result_
+_IRQL_requires_max_(PASSIVE_LEVEL)
+EXTERN_C
+NTSTATUS
+DomitoDecodeHex(
+    _In_ const UNICODE_STRING* Hex,
+    _Out_writes_bytes_(ByteCount) UCHAR* Bytes,
+    _In_ ULONG ByteCount
+);
+
+// Writes uppercase hex plus NUL; HexChars includes terminator capacity.
+_Must_inspect_result_
+_IRQL_requires_max_(PASSIVE_LEVEL)
+EXTERN_C
+NTSTATUS
+DomitoEncodeHex(
+    _In_reads_bytes_opt_(ByteCount) const UCHAR* Bytes,
+    _In_ ULONG ByteCount,
+    _Out_writes_(HexChars) WCHAR* Hex,
+    _In_ ULONG HexChars
+);
+
+// Resolve optional exports without creating a static import. Requires DomitoInit.
+// ModuleName is the full loaded-module path used by FindModuleBaseAddress.
+// Caller must keep that module mapped; this does not acquire a loader reference.
+_Must_inspect_result_
+_IRQL_requires_max_(PASSIVE_LEVEL)
+EXTERN_C
+NTSTATUS
+DomitoFindModuleExportedFunctionAddress(
+    _In_ PANSI_STRING ModuleName,
+    _In_ PANSI_STRING FunctionName,
+    _Outptr_result_maybenull_ PVOID* FunctionAddress
+);
+
+// Results from either process-name API use one Domito allocation. The memory
+// callback pair must remain unchanged until all allocations are released.
+_IRQL_requires_max_(PASSIVE_LEVEL)
+EXTERN_C
+void
+DomitoFreeProcessImageName(
+    _In_opt_ PUNICODE_STRING ImageName
+);
+
+// Caller holds a referenced PEPROCESS throughout the call. No PID re-lookup.
+// Returns a copy owned by Domito; use DomitoFreeProcessImageName once.
+// Name lookup does not establish the identity of a later reopened file.
+_Must_inspect_result_
+_IRQL_requires_max_(PASSIVE_LEVEL)
+EXTERN_C
+NTSTATUS
+DomitoGetProcessImageNameEx(
+    _In_ PEPROCESS Process,
+    _Outptr_result_maybenull_ PUNICODE_STRING* ImageName
+);
+
+#if (NTDDI_VERSION >= NTDDI_WIN10)
+// These wrappers do not require DomitoInit. Handle must be a trusted kernel
+// handle with FILE_READ_DATA; it is borrowed, referenced for the call, not closed.
+// Same initialized-result/cleanup rules and explicit flags as FileObjectEx.
+_Must_inspect_result_
+_IRQL_requires_max_(PASSIVE_LEVEL)
+EXTERN_C
+NTSTATUS
+DomitoValidateFileHandleEx(
+    _In_ HANDLE FileHandle,
+    _In_ UINT32 ValidationFlags,
+    _In_ UINT8 RequestedSigningLevel,
+    _In_ DOMITO_CI_SIGNATURE_SELECTION Selection,
+    _Inout_ DOMITO_CI_VALIDATION_RESULT* Result
+);
+
+// Absolute native path (e.g. \??\C:\...). Opens read-only, shares only reads,
+// closes its own handle. The path can be reparsed; this validates the opened
+// file, not process memory or a previous path identity. No fallback is implicit.
+_Must_inspect_result_
+_IRQL_requires_max_(PASSIVE_LEVEL)
+EXTERN_C
+NTSTATUS
+DomitoValidateFilePathEx(
+    _In_ const UNICODE_STRING* Path,
+    _In_ UINT32 ValidationFlags,
+    _In_ UINT8 RequestedSigningLevel,
+    _In_ DOMITO_CI_SIGNATURE_SELECTION Selection,
+    _Inout_ DOMITO_CI_VALIDATION_RESULT* Result
+);
+
+typedef enum _DOMITO_CI_CHAIN_LAYOUT
+{
+    // Explicit caller assertion: observed x64 +0x28 array/+0x30 count, 120-byte
+    // elements and a minimum 56-byte header. NOT selected by allocation Size.
+    DomitoCiChainLayoutObservedX64 = 1
+} DOMITO_CI_CHAIN_LAYOUT;
+
+typedef struct _DOMITO_CI_CHAIN_VIEW
+{
+    const MINCRYPT_CHAIN_ELEMENT* Elements;
+    ULONG Count;
+    ULONG RootId; // Opaque CI identifier, not proof the last element is a root.
+} DOMITO_CI_CHAIN_VIEW;
+
+// Only accepts a readable, initialized CI-owned policy, never arbitrary pointers.
+// Checks every exposed name/certificate span against CI's owned allocation.
+// Leaf-first order is observed in sampled layouts. Last element is not promised
+// to be a self-signed/trusted root. No issuer/subject byte equality is imposed.
+// View borrows policy storage until CiFreePolicyInfo/result reuse. x64 only.
+_Must_inspect_result_
+_IRQL_requires_max_(PASSIVE_LEVEL)
+EXTERN_C
+NTSTATUS
+DomitoGetCiChainView(
+    _In_ const MINCRYPT_POLICY_INFO* Policy,
+    _In_ DOMITO_CI_CHAIN_LAYOUT Layout,
+    _Out_ DOMITO_CI_CHAIN_VIEW* View
+);
+
+// Optional export, resolved at call time; requires DomitoInit. No static import
+// of CiGetCertPublisherName. Extracts a display name, not certificate trust.
+// Start with {0}; release even after failure using the dedicated free function.
+// Never pass an owning previous string: free it before making another call.
+_Must_inspect_result_
+_IRQL_requires_max_(PASSIVE_LEVEL)
+EXTERN_C
+NTSTATUS
+DomitoGetCertificatePublisherName(
+    _In_ const MINCERT_BLOB* Certificate,
+    _Out_ PUNICODE_STRING PublisherName
+);
+
+_IRQL_requires_max_(PASSIVE_LEVEL)
+EXTERN_C
+void
+DomitoFreeCertificatePublisherName(
+    _Inout_ PUNICODE_STRING PublisherName
+);
+#endif

include/Domito.MinCrypt.26100.h

@@ -13,18 +13,22 @@
 #endif
 
 #pragma pack(push, 8)
-typedef struct _DOMITO_CI26100_BLOB {
+
+typedef struct _DOMITO_CI26100_BLOB
+{
     ULONG Size;
-    UCHAR *Data;
+    UCHAR* Data;
 } DOMITO_CI26100_BLOB;
 
-typedef struct _DOMITO_CI26100_NAME_BLOB {
-    UCHAR *Data;              /* Borrowed, length-delimited encoded bytes. */
-    USHORT Size;              /* Bytes, not characters. */
-    UCHAR Asn1StringTag;      /* Observed: 0x0c UTF8String, 0x1e BMPString. */
+typedef struct _DOMITO_CI26100_NAME_BLOB
+{
+    UCHAR* Data;         /* Borrowed, length-delimited encoded bytes. */
+    USHORT Size;         /* Bytes, not characters. */
+    UCHAR Asn1StringTag; /* Observed: 0x0c UTF8String, 0x1e BMPString. */
 } DOMITO_CI26100_NAME_BLOB;
 
-typedef struct _DOMITO_CI26100_CHAIN_ELEMENT {
+typedef struct _DOMITO_CI26100_CHAIN_ELEMENT
+{
     ULONG HashAlgId;
     ULONG HashSize;
     UCHAR Hash[64];
@@ -33,72 +37,121 @@ typedef struct _DOMITO_CI26100_CHAIN_ELEMENT {
     DOMITO_CI26100_BLOB Certificate;
 } DOMITO_CI26100_CHAIN_ELEMENT;
 
-typedef struct _DOMITO_CI26100_CHAIN_INFO {
-    ULONG Size;               /* Entire allocation, including trailing data. */
-    DOMITO_CI26100_BLOB *PublicKeys;
+typedef struct _DOMITO_CI26100_CHAIN_INFO
+{
+    ULONG Size; /* Entire allocation, including trailing data. */
+    DOMITO_CI26100_BLOB* PublicKeys;
     ULONG NumberOfPublicKeys;
-    DOMITO_CI26100_BLOB *EKUs;
+    DOMITO_CI26100_BLOB* EKUs;
     ULONG NumberOfEKUs;
-    DOMITO_CI26100_CHAIN_ELEMENT *ChainElements;
+    DOMITO_CI26100_CHAIN_ELEMENT* ChainElements;
     ULONG NumberOfChainElements;
-    ULONG RootId;             /* Opaque classification, NOT policy bits. */
+    ULONG RootId; /* Opaque classification, NOT policy bits. */
     DOMITO_CI26100_BLOB AuthenticodeAttributes;
     UCHAR PlatformManifestBinaryId[32]; /* NOT a file or certificate hash. */
 } DOMITO_CI26100_CHAIN_INFO;
 
-typedef struct _DOMITO_CI26100_POLICY_INFO {
+typedef struct _DOMITO_CI26100_POLICY_INFO
+{
     ULONG Size;
     NTSTATUS VerificationStatus; /* Does not replace the API return status. */
     ULONG PolicyBits;
-    DOMITO_CI26100_CHAIN_INFO *ChainInfo;
+    DOMITO_CI26100_CHAIN_INFO* ChainInfo;
     LARGE_INTEGER RevocationTime;
     LARGE_INTEGER NotBefore;
     LARGE_INTEGER NotAfter;
 } DOMITO_CI26100_POLICY_INFO, *PDOMITO_CI26100_POLICY_INFO;
+
 #pragma pack(pop)
 
 C_ASSERT(sizeof(DOMITO_CI26100_BLOB) == 16);
 C_ASSERT(sizeof(DOMITO_CI26100_NAME_BLOB) == 16);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI26100_NAME_BLOB, Asn1StringTag) == 10);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI26100_NAME_BLOB,
+        Asn1StringTag
+    ) == 10
+);
 C_ASSERT(sizeof(DOMITO_CI26100_CHAIN_ELEMENT) == 120);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI26100_CHAIN_ELEMENT, Certificate) == 104);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI26100_CHAIN_INFO, RootId) == 52);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI26100_CHAIN_INFO, AuthenticodeAttributes) == 56);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI26100_CHAIN_INFO, PlatformManifestBinaryId) == 72);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI26100_CHAIN_ELEMENT,
+        Certificate
+    ) == 104
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI26100_CHAIN_INFO,
+        RootId
+    ) == 52
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI26100_CHAIN_INFO,
+        AuthenticodeAttributes
+    ) == 56
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI26100_CHAIN_INFO,
+        PlatformManifestBinaryId
+    ) == 72
+);
 C_ASSERT(sizeof(DOMITO_CI26100_CHAIN_INFO) == 104);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI26100_POLICY_INFO, ChainInfo) == 16);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI26100_POLICY_INFO, RevocationTime) == 24);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI26100_POLICY_INFO, NotBefore) == 32);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI26100_POLICY_INFO, NotAfter) == 40);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI26100_POLICY_INFO,
+        ChainInfo
+    ) == 16
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI26100_POLICY_INFO,
+        RevocationTime
+    ) == 24
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI26100_POLICY_INFO,
+        NotBefore
+    ) == 32
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI26100_POLICY_INFO,
+        NotAfter
+    ) == 40
+);
 C_ASSERT(sizeof(DOMITO_CI26100_POLICY_INFO) == 48);
 
 /* Zero-initialize policies before first use. Free existing owned chains before
  * reuse. Never copy these structs as independently owned objects with memcpy.
  * Size is an output/initialization marker here, not runtime ABI negotiation.
  */
-typedef VOID (NTAPI *DOMITO_CI26100_FREE_POLICY_INFO)(
-    DOMITO_CI26100_POLICY_INFO *PolicyInfo);
+typedef VOID(NTAPI* DOMITO_CI26100_FREE_POLICY_INFO)(DOMITO_CI26100_POLICY_INFO* PolicyInfo);
 
-typedef NTSTATUS (NTAPI *DOMITO_CI26100_VALIDATE_FILE_OBJECT)(
+typedef NTSTATUS(NTAPI* DOMITO_CI26100_VALIDATE_FILE_OBJECT)(
     PFILE_OBJECT FileObject,
     ULONG ValidationFlags,
     UCHAR RequestedSigningLevel,
-    DOMITO_CI26100_POLICY_INFO *PolicyInfo,
-    DOMITO_CI26100_POLICY_INFO *TimeStampPolicyInfo,
-    LARGE_INTEGER *SigningTime,
-    UCHAR *Hash,              /* Provide 64-byte capacity, even for SHA-1. */
-    ULONG *HashSize,          /* In: capacity >=64. Out success: actual size. */
-    ULONG *HashAlgId);
+    DOMITO_CI26100_POLICY_INFO* PolicyInfo,
+    DOMITO_CI26100_POLICY_INFO* TimeStampPolicyInfo,
+    LARGE_INTEGER* SigningTime,
+    UCHAR* Hash,     /* Provide 64-byte capacity, even for SHA-1. */
+    ULONG* HashSize, /* In: capacity >=64. Out success: actual size. */
+    ULONG* HashAlgId
+);
 
-typedef NTSTATUS (NTAPI *DOMITO_CI26100_CHECK_SIGNED_FILE)(
+typedef NTSTATUS(NTAPI* DOMITO_CI26100_CHECK_SIGNED_FILE)(
     PVOID Hash,
     ULONG HashSize,
     ULONG HashAlgId,
-    PVOID WinCertificate,     /* WIN_CERTIFICATE header, not bCertificate. */
+    PVOID WinCertificate, /* WIN_CERTIFICATE header, not bCertificate. */
     ULONG SizeOfSecurityDirectory,
-    DOMITO_CI26100_POLICY_INFO *PolicyInfo,
-    LARGE_INTEGER *SigningTime,
-    DOMITO_CI26100_POLICY_INFO *TimeStampPolicyInfo);
+    DOMITO_CI26100_POLICY_INFO* PolicyInfo,
+    LARGE_INTEGER* SigningTime,
+    DOMITO_CI26100_POLICY_INFO* TimeStampPolicyInfo
+);
 
 /* The existing BOOLEAN reload parameter ABI was not independently resolved
  * beyond the full-width use in this build; retain Domito's declaration until
@@ -106,49 +159,51 @@ typedef NTSTATUS (NTAPI *DOMITO_CI26100_CHECK_SIGNED_FILE)(
  * Fifth argument nonzero filters on the catalog TRUSTED marker.
  * Sixth argument requires ANY overlap with catalog PolicyInfo.PolicyBits.
  */
-typedef NTSTATUS (NTAPI *DOMITO_CI26100_VERIFY_HASH_IN_CATALOG)(
+typedef NTSTATUS(NTAPI* DOMITO_CI26100_VERIFY_HASH_IN_CATALOG)(
     PVOID Hash,
     ULONG HashSize,
     ULONG HashAlgId,
     BOOLEAN ReloadCatalogs,
     ULONG RequireTrustedCatalog,
     ULONG AcceptedCatalogPolicyBits,
-    DOMITO_CI26100_POLICY_INFO *PolicyInfo,
-    UNICODE_STRING *CatalogName, /* Optional; separate RtlFreeUnicodeString. */
-    LARGE_INTEGER *SigningTime,
-    DOMITO_CI26100_POLICY_INFO *TimeStampPolicyInfo);
+    DOMITO_CI26100_POLICY_INFO* PolicyInfo,
+    UNICODE_STRING* CatalogName, /* Optional; separate RtlFreeUnicodeString. */
+    LARGE_INTEGER* SigningTime,
+    DOMITO_CI26100_POLICY_INFO* TimeStampPolicyInfo
+);
 
-typedef PVOID (NTAPI *DOMITO_CI26100_ALLOCATE)(SIZE_T ByteSize);
-typedef NTSTATUS (NTAPI *DOMITO_CI26100_GET_CERT_PUBLISHER_NAME)(
-    DOMITO_CI26100_BLOB *Certificate,
+typedef PVOID(NTAPI* DOMITO_CI26100_ALLOCATE)(SIZE_T ByteSize);
+typedef NTSTATUS(NTAPI* DOMITO_CI26100_GET_CERT_PUBLISHER_NAME)(
+    DOMITO_CI26100_BLOB* Certificate,
     DOMITO_CI26100_ALLOCATE AllocateRoutine,
-    UNICODE_STRING *PublisherName); /* Free with callback's allocator pair. */
+    UNICODE_STRING* PublisherName
+); /* Free with callback's allocator pair. */
 
 /* Proposed descriptive diagnostic names. Not official Microsoft names, not
  * an exhaustive dictionary, and not accepted-input validation flags.
  * See the report for narrower branch conditions and composite values.
  */
-#define DOMITO_CI26100_POLICY_SELF_ISSUED_TERMINAL    0x00000001UL
+#define DOMITO_CI26100_POLICY_SELF_ISSUED_TERMINAL 0x00000001UL
 // Also present on rgbMicrosoftRoot4 together with bit 0x800.
-#define DOMITO_CI26100_POLICY_MICROSOFT_ROOT_0_1_2   0x00000002UL
-#define DOMITO_CI26100_POLICY_TEST_ROOT              0x00000004UL
-#define DOMITO_CI26100_POLICY_MICROSOFT_ROOT_3       0x00000008UL
-#define DOMITO_CI26100_POLICY_DMD_ROOT               0x00000020UL
-#define DOMITO_CI26100_POLICY_DMD_TEST_ROOT          0x00000040UL
-#define DOMITO_CI26100_POLICY_MICROSOFT_ROOT_5       0x00000080UL
-#define DOMITO_CI26100_POLICY_FLIGHT_ROOT            0x00000400UL
-#define DOMITO_CI26100_POLICY_MARKETPLACE_ROOT       0x00002000UL
-#define DOMITO_CI26100_POLICY_SUPPLIED_CERT_OR_KEY   0x00004000UL
-#define DOMITO_CI26100_POLICY_IDENTITY_ROOT_2020     0x00008000UL
-#define DOMITO_CI26100_POLICY_PARTIAL_CHAIN          0x00000010UL
-#define DOMITO_CI26100_POLICY_CHAIN_FAILURE          0x00020000UL
-#define DOMITO_CI26100_POLICY_CRYPTO_FAILURE         0x00040000UL
-#define DOMITO_CI26100_POLICY_EKU_FAILURE            0x00080000UL
-#define DOMITO_CI26100_POLICY_PAGE_HASH_FAILURE      0x00100000UL
-#define DOMITO_CI26100_POLICY_CERT_REVOKED           0x00200000UL
-#define DOMITO_CI26100_POLICY_CERT_VALIDITY_FAILURE  0x00400000UL
-#define DOMITO_CI26100_POLICY_PATH_LENGTH_FAILURE   0x08000000UL
-#define DOMITO_CI26100_POLICY_GENERIC_FAILURE       0x10000000UL
+#define DOMITO_CI26100_POLICY_MICROSOFT_ROOT_0_1_2 0x00000002UL
+#define DOMITO_CI26100_POLICY_TEST_ROOT 0x00000004UL
+#define DOMITO_CI26100_POLICY_MICROSOFT_ROOT_3 0x00000008UL
+#define DOMITO_CI26100_POLICY_DMD_ROOT 0x00000020UL
+#define DOMITO_CI26100_POLICY_DMD_TEST_ROOT 0x00000040UL
+#define DOMITO_CI26100_POLICY_MICROSOFT_ROOT_5 0x00000080UL
+#define DOMITO_CI26100_POLICY_FLIGHT_ROOT 0x00000400UL
+#define DOMITO_CI26100_POLICY_MARKETPLACE_ROOT 0x00002000UL
+#define DOMITO_CI26100_POLICY_SUPPLIED_CERT_OR_KEY 0x00004000UL
+#define DOMITO_CI26100_POLICY_IDENTITY_ROOT_2020 0x00008000UL
+#define DOMITO_CI26100_POLICY_PARTIAL_CHAIN 0x00000010UL
+#define DOMITO_CI26100_POLICY_CHAIN_FAILURE 0x00020000UL
+#define DOMITO_CI26100_POLICY_CRYPTO_FAILURE 0x00040000UL
+#define DOMITO_CI26100_POLICY_EKU_FAILURE 0x00080000UL
+#define DOMITO_CI26100_POLICY_PAGE_HASH_FAILURE 0x00100000UL
+#define DOMITO_CI26100_POLICY_CERT_REVOKED 0x00200000UL
+#define DOMITO_CI26100_POLICY_CERT_VALIDITY_FAILURE 0x00400000UL
+#define DOMITO_CI26100_POLICY_PATH_LENGTH_FAILURE 0x08000000UL
+#define DOMITO_CI26100_POLICY_GENERIC_FAILURE 0x10000000UL
 #define DOMITO_CI26100_POLICY_CA_CONSTRAINT_FAILURE 0x20000000UL
 
 /* Narrow branch observation: no usable timestamp during revoked-cert recovery;

include/Domito.MinCrypt.Historical.h

@@ -13,6 +13,7 @@
 #endif
 
 #pragma pack(push, 8)
+
 // Observed ci.dll 10.0.10240.16463. The variable payload begins at +0x38;
 // AuthenticodeAttributes does not exist at that offset in this header.
 typedef struct _DOMITO_CI10240_CHAIN_INFO
@@ -57,17 +58,63 @@ typedef struct _DOMITO_CI14393_CHAIN_INFO
     MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
     UINT8 ReservedExtension[32];
 } DOMITO_CI14393_CHAIN_INFO, *PDOMITO_CI14393_CHAIN_INFO;
+
 #pragma pack(pop)
 
 C_ASSERT(sizeof(DOMITO_CI10240_CHAIN_INFO) == 56);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, PublicKeys) == 8);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, EKUs) == 24);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, ChainElements) == 40);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, RootId) == 52);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI10240_CHAIN_INFO,
+        PublicKeys
+    ) == 8
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI10240_CHAIN_INFO,
+        EKUs
+    ) == 24
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI10240_CHAIN_INFO,
+        ChainElements
+    ) == 40
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI10240_CHAIN_INFO,
+        RootId
+    ) == 52
+);
 C_ASSERT(sizeof(DOMITO_CI10586_CHAIN_INFO) == 72);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI10586_CHAIN_INFO, RootId) == 52);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI10586_CHAIN_INFO, AuthenticodeAttributes) == 56);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI10586_CHAIN_INFO,
+        RootId
+    ) == 52
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI10586_CHAIN_INFO,
+        AuthenticodeAttributes
+    ) == 56
+);
 C_ASSERT(sizeof(DOMITO_CI14393_CHAIN_INFO) == 104);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI14393_CHAIN_INFO, RootId) == 52);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI14393_CHAIN_INFO, AuthenticodeAttributes) == 56);
-C_ASSERT(FIELD_OFFSET(DOMITO_CI14393_CHAIN_INFO, ReservedExtension) == 72);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI14393_CHAIN_INFO,
+        RootId
+    ) == 52
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI14393_CHAIN_INFO,
+        AuthenticodeAttributes
+    ) == 56
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI14393_CHAIN_INFO,
+        ReservedExtension
+    ) == 72
+);

include/Domito.MinCrypt.h

@@ -22,16 +22,16 @@
 
 #pragma once
 
- // Warnings which disabled for compiling
+// Warnings which disabled for compiling
 #if _MSC_VER >= 1200
 #pragma warning(push)
 // nonstandard extension used : nameless struct/union
-#pragma warning(disable:4201)
+#pragma warning(disable : 4201)
 // 'struct_name' : structure was padded due to __declspec(align())
-#pragma warning(disable:4324)
+#pragma warning(disable : 4324)
 // 'enumeration': a forward declaration of an unscoped enumeration must have an
 // underlying type (int assumed)
-#pragma warning(disable:4471)
+#pragma warning(disable : 4471)
 #endif
 
 EXTERN_C_START
@@ -47,144 +47,144 @@ EXTERN_C_START
 //
 
 // ALG_ID crackers
-#define GET_ALG_CLASS(x)                (x & (7 << 13))
-#define GET_ALG_TYPE(x)                 (x & (15 << 9))
-#define GET_ALG_SID(x)                  (x & (511))
+#define GET_ALG_CLASS(x) (x & (7 << 13))
+#define GET_ALG_TYPE(x) (x & (15 << 9))
+#define GET_ALG_SID(x) (x & (511))
 
 // Algorithm classes
 // certenrolld_begin -- ALG_CLASS_*
-#define ALG_CLASS_ANY                   (0)
-#define ALG_CLASS_SIGNATURE             (1 << 13)
-#define ALG_CLASS_MSG_ENCRYPT           (2 << 13)
-#define ALG_CLASS_DATA_ENCRYPT          (3 << 13)
-#define ALG_CLASS_HASH                  (4 << 13)
-#define ALG_CLASS_KEY_EXCHANGE          (5 << 13)
-#define ALG_CLASS_ALL                   (7 << 13)
+#define ALG_CLASS_ANY (0)
+#define ALG_CLASS_SIGNATURE (1 << 13)
+#define ALG_CLASS_MSG_ENCRYPT (2 << 13)
+#define ALG_CLASS_DATA_ENCRYPT (3 << 13)
+#define ALG_CLASS_HASH (4 << 13)
+#define ALG_CLASS_KEY_EXCHANGE (5 << 13)
+#define ALG_CLASS_ALL (7 << 13)
 // certenrolld_end
 
 // Algorithm types
-#define ALG_TYPE_ANY                    (0)
-#define ALG_TYPE_DSS                    (1 << 9)
-#define ALG_TYPE_RSA                    (2 << 9)
-#define ALG_TYPE_BLOCK                  (3 << 9)
-#define ALG_TYPE_STREAM                 (4 << 9)
-#define ALG_TYPE_DH                     (5 << 9)
-#define ALG_TYPE_SECURECHANNEL          (6 << 9)
+#define ALG_TYPE_ANY (0)
+#define ALG_TYPE_DSS (1 << 9)
+#define ALG_TYPE_RSA (2 << 9)
+#define ALG_TYPE_BLOCK (3 << 9)
+#define ALG_TYPE_STREAM (4 << 9)
+#define ALG_TYPE_DH (5 << 9)
+#define ALG_TYPE_SECURECHANNEL (6 << 9)
 #if (NTDDI_VERSION >= NTDDI_VISTA)
-#define ALG_TYPE_ECDH                   (7 << 9)
+#define ALG_TYPE_ECDH (7 << 9)
 #endif //(NTDDI_VERSION >= NTDDI_VISTA)
 #if (NTDDI_VERSION >= NTDDI_WIN10_RS1)
-#define ALG_TYPE_THIRDPARTY             (8 << 9)
+#define ALG_TYPE_THIRDPARTY (8 << 9)
 #endif //(NTDDI_VERSION >= NTDDI_WIN10_RS1)
 
 // Generic sub-ids
-#define ALG_SID_ANY                     (0)
+#define ALG_SID_ANY (0)
 
 // Generic ThirdParty sub-ids
 #if (NTDDI_VERSION >= NTDDI_WIN10_RS1)
-#define ALG_SID_THIRDPARTY_ANY          (0)
+#define ALG_SID_THIRDPARTY_ANY (0)
 #endif //(NTDDI_VERSION >= NTDDI_WIN10_RS1)
 
 // Some RSA sub-ids
-#define ALG_SID_RSA_ANY                 0
-#define ALG_SID_RSA_PKCS                1
-#define ALG_SID_RSA_MSATWORK            2
-#define ALG_SID_RSA_ENTRUST             3
-#define ALG_SID_RSA_PGP                 4
+#define ALG_SID_RSA_ANY 0
+#define ALG_SID_RSA_PKCS 1
+#define ALG_SID_RSA_MSATWORK 2
+#define ALG_SID_RSA_ENTRUST 3
+#define ALG_SID_RSA_PGP 4
 
 // Some DSS sub-ids
 //
-#define ALG_SID_DSS_ANY                 0
-#define ALG_SID_DSS_PKCS                1
-#define ALG_SID_DSS_DMS                 2
+#define ALG_SID_DSS_ANY 0
+#define ALG_SID_DSS_PKCS 1
+#define ALG_SID_DSS_DMS 2
 #if (NTDDI_VERSION >= NTDDI_VISTA)
-#define ALG_SID_ECDSA                   3
+#define ALG_SID_ECDSA 3
 #endif //(NTDDI_VERSION >= NTDDI_VISTA)
 
 // Block cipher sub ids
 // DES sub_ids
-#define ALG_SID_DES                     1
-#define ALG_SID_3DES                    3
-#define ALG_SID_DESX                    4
-#define ALG_SID_IDEA                    5
-#define ALG_SID_CAST                    6
-#define ALG_SID_SAFERSK64               7
-#define ALG_SID_SAFERSK128              8
-#define ALG_SID_3DES_112                9
-#define ALG_SID_CYLINK_MEK              12
-#define ALG_SID_RC5                     13
+#define ALG_SID_DES 1
+#define ALG_SID_3DES 3
+#define ALG_SID_DESX 4
+#define ALG_SID_IDEA 5
+#define ALG_SID_CAST 6
+#define ALG_SID_SAFERSK64 7
+#define ALG_SID_SAFERSK128 8
+#define ALG_SID_3DES_112 9
+#define ALG_SID_CYLINK_MEK 12
+#define ALG_SID_RC5 13
 #if (NTDDI_VERSION >= NTDDI_WINXP)
-#define ALG_SID_AES_128                 14
-#define ALG_SID_AES_192                 15
-#define ALG_SID_AES_256                 16
-#define ALG_SID_AES                     17
+#define ALG_SID_AES_128 14
+#define ALG_SID_AES_192 15
+#define ALG_SID_AES_256 16
+#define ALG_SID_AES 17
 #endif //(NTDDI_VERSION >= NTDDI_WINXP)
 
 // Fortezza sub-ids
-#define ALG_SID_SKIPJACK                10
-#define ALG_SID_TEK                     11
+#define ALG_SID_SKIPJACK 10
+#define ALG_SID_TEK 11
 
 // KP_MODE
-#define CRYPT_MODE_CBCI                 6       // ANSI CBC Interleaved
-#define CRYPT_MODE_CFBP                 7       // ANSI CFB Pipelined
-#define CRYPT_MODE_OFBP                 8       // ANSI OFB Pipelined
-#define CRYPT_MODE_CBCOFM               9       // ANSI CBC + OF Masking
-#define CRYPT_MODE_CBCOFMI              10      // ANSI CBC + OFM Interleaved
+#define CRYPT_MODE_CBCI 6     // ANSI CBC Interleaved
+#define CRYPT_MODE_CFBP 7     // ANSI CFB Pipelined
+#define CRYPT_MODE_OFBP 8     // ANSI OFB Pipelined
+#define CRYPT_MODE_CBCOFM 9   // ANSI CBC + OF Masking
+#define CRYPT_MODE_CBCOFMI 10 // ANSI CBC + OFM Interleaved
 
 // RC2 sub-ids
-#define ALG_SID_RC2                     2
+#define ALG_SID_RC2 2
 
 // Stream cipher sub-ids
-#define ALG_SID_RC4                     1
-#define ALG_SID_SEAL                    2
+#define ALG_SID_RC4 1
+#define ALG_SID_SEAL 2
 
 // Diffie-Hellman sub-ids
-#define ALG_SID_DH_SANDF                1
-#define ALG_SID_DH_EPHEM                2
-#define ALG_SID_AGREED_KEY_ANY          3
-#define ALG_SID_KEA                     4
+#define ALG_SID_DH_SANDF 1
+#define ALG_SID_DH_EPHEM 2
+#define ALG_SID_AGREED_KEY_ANY 3
+#define ALG_SID_KEA 4
 #if (NTDDI_VERSION >= NTDDI_VISTA)
-#define ALG_SID_ECDH                    5
-#define ALG_SID_ECDH_EPHEM              6
+#define ALG_SID_ECDH 5
+#define ALG_SID_ECDH_EPHEM 6
 #endif //(NTDDI_VERSION >= NTDDI_VISTA)
 
 // Hash sub ids
-#define ALG_SID_MD2                     1
-#define ALG_SID_MD4                     2
-#define ALG_SID_MD5                     3
-#define ALG_SID_SHA                     4
-#define ALG_SID_SHA1                    4
-#define ALG_SID_MAC                     5
-#define ALG_SID_RIPEMD                  6
-#define ALG_SID_RIPEMD160               7
-#define ALG_SID_SSL3SHAMD5              8
-#define ALG_SID_HMAC                    9
-#define ALG_SID_TLS1PRF                 10
+#define ALG_SID_MD2 1
+#define ALG_SID_MD4 2
+#define ALG_SID_MD5 3
+#define ALG_SID_SHA 4
+#define ALG_SID_SHA1 4
+#define ALG_SID_MAC 5
+#define ALG_SID_RIPEMD 6
+#define ALG_SID_RIPEMD160 7
+#define ALG_SID_SSL3SHAMD5 8
+#define ALG_SID_HMAC 9
+#define ALG_SID_TLS1PRF 10
 #if (NTDDI_VERSION >= NTDDI_WINXP)
-#define ALG_SID_HASH_REPLACE_OWF        11
+#define ALG_SID_HASH_REPLACE_OWF 11
 #endif //(NTDDI_VERSION >= NTDDI_WINXP)
 #if (NTDDI_VERSION > NTDDI_WINXPSP2)
-#define ALG_SID_SHA_256                 12
-#define ALG_SID_SHA_384                 13
-#define ALG_SID_SHA_512                 14
+#define ALG_SID_SHA_256 12
+#define ALG_SID_SHA_384 13
+#define ALG_SID_SHA_512 14
 #endif //(NTDDI_VERSION > NTDDI_WINXPSP2)
 
 // secure channel sub ids
-#define ALG_SID_SSL3_MASTER             1
-#define ALG_SID_SCHANNEL_MASTER_HASH    2
-#define ALG_SID_SCHANNEL_MAC_KEY        3
-#define ALG_SID_PCT1_MASTER             4
-#define ALG_SID_SSL2_MASTER             5
-#define ALG_SID_TLS1_MASTER             6
-#define ALG_SID_SCHANNEL_ENC_KEY        7
+#define ALG_SID_SSL3_MASTER 1
+#define ALG_SID_SCHANNEL_MASTER_HASH 2
+#define ALG_SID_SCHANNEL_MAC_KEY 3
+#define ALG_SID_PCT1_MASTER 4
+#define ALG_SID_SSL2_MASTER 5
+#define ALG_SID_TLS1_MASTER 6
+#define ALG_SID_SCHANNEL_ENC_KEY 7
 
 #if (NTDDI_VERSION >= NTDDI_VISTA)
 // misc ECC sub ids
-#define ALG_SID_ECMQV                   1
+#define ALG_SID_ECMQV 1
 #endif //(NTDDI_VERSION >= NTDDI_VISTA)
 
 // Our silly example sub-id
-#define ALG_SID_EXAMPLE                 80
+#define ALG_SID_EXAMPLE 80
 
 // certenrolls_begin -- PROV_ENUMALGS_EX
 #ifndef ALGIDDEF
@@ -194,133 +194,127 @@ typedef unsigned int ALG_ID;
 // certenrolls_end
 
 // algorithm identifier definitions
-#define CALG_MD2                (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_MD2)
-#define CALG_MD4                (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_MD4)
-#define CALG_MD5                (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_MD5)
-#define CALG_SHA                (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA)
-#define CALG_SHA1               (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA1)
-#define CALG_MAC                (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_MAC)           // Deprecated. Don't use.
-#define CALG_RSA_SIGN           (ALG_CLASS_SIGNATURE | ALG_TYPE_RSA | ALG_SID_RSA_ANY)
-#define CALG_DSS_SIGN           (ALG_CLASS_SIGNATURE | ALG_TYPE_DSS | ALG_SID_DSS_ANY)
+#define CALG_MD2 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_MD2)
+#define CALG_MD4 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_MD4)
+#define CALG_MD5 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_MD5)
+#define CALG_SHA (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA)
+#define CALG_SHA1 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA1)
+#define CALG_MAC (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_MAC) // Deprecated. Don't use.
+#define CALG_RSA_SIGN (ALG_CLASS_SIGNATURE | ALG_TYPE_RSA | ALG_SID_RSA_ANY)
+#define CALG_DSS_SIGN (ALG_CLASS_SIGNATURE | ALG_TYPE_DSS | ALG_SID_DSS_ANY)
 #if (NTDDI_VERSION >= NTDDI_WINXP)
-#define CALG_NO_SIGN            (ALG_CLASS_SIGNATURE | ALG_TYPE_ANY | ALG_SID_ANY)
+#define CALG_NO_SIGN (ALG_CLASS_SIGNATURE | ALG_TYPE_ANY | ALG_SID_ANY)
 #endif //(NTDDI_VERSION >= NTDDI_WINXP)
-#define CALG_RSA_KEYX           (ALG_CLASS_KEY_EXCHANGE|ALG_TYPE_RSA|ALG_SID_RSA_ANY)
-#define CALG_DES                (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_DES)
-#define CALG_3DES_112           (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_3DES_112)
-#define CALG_3DES               (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_3DES)
-#define CALG_DESX               (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_DESX)
-#define CALG_RC2                (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_RC2)
-#define CALG_RC4                (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_STREAM|ALG_SID_RC4)
-#define CALG_SEAL               (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_STREAM|ALG_SID_SEAL)
-#define CALG_DH_SF              (ALG_CLASS_KEY_EXCHANGE|ALG_TYPE_DH|ALG_SID_DH_SANDF)
-#define CALG_DH_EPHEM           (ALG_CLASS_KEY_EXCHANGE|ALG_TYPE_DH|ALG_SID_DH_EPHEM)
-#define CALG_AGREEDKEY_ANY      (ALG_CLASS_KEY_EXCHANGE|ALG_TYPE_DH|ALG_SID_AGREED_KEY_ANY)
-#define CALG_KEA_KEYX           (ALG_CLASS_KEY_EXCHANGE|ALG_TYPE_DH|ALG_SID_KEA)
-#define CALG_HUGHES_MD5         (ALG_CLASS_KEY_EXCHANGE|ALG_TYPE_ANY|ALG_SID_MD5)
-#define CALG_SKIPJACK           (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_SKIPJACK)
-#define CALG_TEK                (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_TEK)
-#define CALG_CYLINK_MEK         (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_CYLINK_MEK)  // Deprecated. Do not use
-#define CALG_SSL3_SHAMD5        (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SSL3SHAMD5)
-#define CALG_SSL3_MASTER        (ALG_CLASS_MSG_ENCRYPT|ALG_TYPE_SECURECHANNEL|ALG_SID_SSL3_MASTER)
-#define CALG_SCHANNEL_MASTER_HASH   (ALG_CLASS_MSG_ENCRYPT|ALG_TYPE_SECURECHANNEL|ALG_SID_SCHANNEL_MASTER_HASH)
-#define CALG_SCHANNEL_MAC_KEY   (ALG_CLASS_MSG_ENCRYPT|ALG_TYPE_SECURECHANNEL|ALG_SID_SCHANNEL_MAC_KEY)
-#define CALG_SCHANNEL_ENC_KEY   (ALG_CLASS_MSG_ENCRYPT|ALG_TYPE_SECURECHANNEL|ALG_SID_SCHANNEL_ENC_KEY)
-#define CALG_PCT1_MASTER        (ALG_CLASS_MSG_ENCRYPT|ALG_TYPE_SECURECHANNEL|ALG_SID_PCT1_MASTER)
-#define CALG_SSL2_MASTER        (ALG_CLASS_MSG_ENCRYPT|ALG_TYPE_SECURECHANNEL|ALG_SID_SSL2_MASTER)
-#define CALG_TLS1_MASTER        (ALG_CLASS_MSG_ENCRYPT|ALG_TYPE_SECURECHANNEL|ALG_SID_TLS1_MASTER)
-#define CALG_RC5                (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_RC5)
-#define CALG_HMAC               (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_HMAC)
-#define CALG_TLS1PRF            (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_TLS1PRF)
+#define CALG_RSA_KEYX (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_RSA | ALG_SID_RSA_ANY)
+#define CALG_DES (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK | ALG_SID_DES)
+#define CALG_3DES_112 (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK | ALG_SID_3DES_112)
+#define CALG_3DES (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK | ALG_SID_3DES)
+#define CALG_DESX (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK | ALG_SID_DESX)
+#define CALG_RC2 (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK | ALG_SID_RC2)
+#define CALG_RC4 (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_STREAM | ALG_SID_RC4)
+#define CALG_SEAL (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_STREAM | ALG_SID_SEAL)
+#define CALG_DH_SF (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_DH | ALG_SID_DH_SANDF)
+#define CALG_DH_EPHEM (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_DH | ALG_SID_DH_EPHEM)
+#define CALG_AGREEDKEY_ANY (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_DH | ALG_SID_AGREED_KEY_ANY)
+#define CALG_KEA_KEYX (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_DH | ALG_SID_KEA)
+#define CALG_HUGHES_MD5 (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_ANY | ALG_SID_MD5)
+#define CALG_SKIPJACK (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK | ALG_SID_SKIPJACK)
+#define CALG_TEK (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK | ALG_SID_TEK)
+#define CALG_CYLINK_MEK (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK | ALG_SID_CYLINK_MEK) // Deprecated. Do not use
+#define CALG_SSL3_SHAMD5 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SSL3SHAMD5)
+#define CALG_SSL3_MASTER (ALG_CLASS_MSG_ENCRYPT | ALG_TYPE_SECURECHANNEL | ALG_SID_SSL3_MASTER)
+#define CALG_SCHANNEL_MASTER_HASH (ALG_CLASS_MSG_ENCRYPT | ALG_TYPE_SECURECHANNEL | ALG_SID_SCHANNEL_MASTER_HASH)
+#define CALG_SCHANNEL_MAC_KEY (ALG_CLASS_MSG_ENCRYPT | ALG_TYPE_SECURECHANNEL | ALG_SID_SCHANNEL_MAC_KEY)
+#define CALG_SCHANNEL_ENC_KEY (ALG_CLASS_MSG_ENCRYPT | ALG_TYPE_SECURECHANNEL | ALG_SID_SCHANNEL_ENC_KEY)
+#define CALG_PCT1_MASTER (ALG_CLASS_MSG_ENCRYPT | ALG_TYPE_SECURECHANNEL | ALG_SID_PCT1_MASTER)
+#define CALG_SSL2_MASTER (ALG_CLASS_MSG_ENCRYPT | ALG_TYPE_SECURECHANNEL | ALG_SID_SSL2_MASTER)
+#define CALG_TLS1_MASTER (ALG_CLASS_MSG_ENCRYPT | ALG_TYPE_SECURECHANNEL | ALG_SID_TLS1_MASTER)
+#define CALG_RC5 (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK | ALG_SID_RC5)
+#define CALG_HMAC (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_HMAC)
+#define CALG_TLS1PRF (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_TLS1PRF)
 #if (NTDDI_VERSION >= NTDDI_WINXP)
-#define CALG_HASH_REPLACE_OWF   (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_HASH_REPLACE_OWF)
-#define CALG_AES_128            (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_AES_128)
-#define CALG_AES_192            (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_AES_192)
-#define CALG_AES_256            (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_AES_256)
-#define CALG_AES                (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_AES)
+#define CALG_HASH_REPLACE_OWF (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_HASH_REPLACE_OWF)
+#define CALG_AES_128 (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK | ALG_SID_AES_128)
+#define CALG_AES_192 (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK | ALG_SID_AES_192)
+#define CALG_AES_256 (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK | ALG_SID_AES_256)
+#define CALG_AES (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK | ALG_SID_AES)
 #endif //(NTDDI_VERSION >= NTDDI_WINXP)
 #if (NTDDI_VERSION > NTDDI_WINXPSP2)
-#define CALG_SHA_256            (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_256)
-#define CALG_SHA_384            (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_384)
-#define CALG_SHA_512            (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_512)
+#define CALG_SHA_256 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_256)
+#define CALG_SHA_384 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_384)
+#define CALG_SHA_512 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_512)
 #endif //(NTDDI_VERSION > NTDDI_WINXPSP2)
 #if (NTDDI_VERSION >= NTDDI_VISTA)
-#define CALG_ECDH               (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_DH | ALG_SID_ECDH)
-#define CALG_ECDH_EPHEM         (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_ECDH | ALG_SID_ECDH_EPHEM)
-#define CALG_ECMQV              (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_ANY | ALG_SID_ECMQV)
-#define CALG_ECDSA              (ALG_CLASS_SIGNATURE | ALG_TYPE_DSS | ALG_SID_ECDSA)
-#define CALG_NULLCIPHER         (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_ANY | 0)
+#define CALG_ECDH (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_DH | ALG_SID_ECDH)
+#define CALG_ECDH_EPHEM (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_ECDH | ALG_SID_ECDH_EPHEM)
+#define CALG_ECMQV (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_ANY | ALG_SID_ECMQV)
+#define CALG_ECDSA (ALG_CLASS_SIGNATURE | ALG_TYPE_DSS | ALG_SID_ECDSA)
+#define CALG_NULLCIPHER (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_ANY | 0)
 #endif //(NTDDI_VERSION >= NTDDI_VISTA)
 #if (NTDDI_VERSION >= NTDDI_WIN10_RS1)
-#define CALG_THIRDPARTY_KEY_EXCHANGE    (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_THIRDPARTY | ALG_SID_THIRDPARTY_ANY)
-#define CALG_THIRDPARTY_SIGNATURE       (ALG_CLASS_SIGNATURE    | ALG_TYPE_THIRDPARTY | ALG_SID_THIRDPARTY_ANY)
-#define CALG_THIRDPARTY_CIPHER          (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_THIRDPARTY | ALG_SID_THIRDPARTY_ANY)
-#define CALG_THIRDPARTY_HASH            (ALG_CLASS_HASH         | ALG_TYPE_THIRDPARTY | ALG_SID_THIRDPARTY_ANY)
+#define CALG_THIRDPARTY_KEY_EXCHANGE (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_THIRDPARTY | ALG_SID_THIRDPARTY_ANY)
+#define CALG_THIRDPARTY_SIGNATURE (ALG_CLASS_SIGNATURE | ALG_TYPE_THIRDPARTY | ALG_SID_THIRDPARTY_ANY)
+#define CALG_THIRDPARTY_CIPHER (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_THIRDPARTY | ALG_SID_THIRDPARTY_ANY)
+#define CALG_THIRDPARTY_HASH (ALG_CLASS_HASH | ALG_TYPE_THIRDPARTY | ALG_SID_THIRDPARTY_ANY)
 #endif //(NTDDI_VERSION >= NTDDI_WIN10_RS1)
 
 #include <pshpack8.h>
+
 typedef struct _MINCRYPTOAPI_BLOB
 {
     UINT32 Size;
-    _Field_size_bytes_(Size)  UINT8* Data;
+    _Field_size_bytes_(Size) UINT8* Data;
 
-} MINCRYPT_INTEGER_BLOB, * PMINCRYPT_INTEGER_BLOB,
-MINCRYPT_UINT_BLOB, * PMINCRYPT_UINT_BLOB,
-MINCRYPT_OBJID_BLOB, * PMINCRYPT_OBJID_BLOB,
-MINCERT_NAME_BLOB, * PMINCERT_NAME_BLOB,
-MINCERT_RDN_VALUE_BLOB, * PMINCERT_RDN_VALUE_BLOB,
-MINCERT_BLOB, * PMINCERT_BLOB,
-MINCRL_BLOB, * PMINCRL_BLOB,
-MINCRYPT_DATA_BLOB, * PMINCRYPT_DATA_BLOB,
-MINCRYPT_HASH_BLOB, * PMINCRYPT_HASH_BLOB,
-MINCRYPT_DIGEST_BLOB, * PMINCRYPT_DIGEST_BLOB,
-MINCRYPT_DER_BLOB, * PMINCRYPT_DER_BLOB,
-MINCRYPT_ATTR_BLOB, * PMINCRYPT_ATTR_BLOB;
+} MINCRYPT_INTEGER_BLOB, *PMINCRYPT_INTEGER_BLOB, MINCRYPT_UINT_BLOB, *PMINCRYPT_UINT_BLOB, MINCRYPT_OBJID_BLOB,
+    *PMINCRYPT_OBJID_BLOB, MINCERT_NAME_BLOB, *PMINCERT_NAME_BLOB, MINCERT_RDN_VALUE_BLOB, *PMINCERT_RDN_VALUE_BLOB,
+    MINCERT_BLOB, *PMINCERT_BLOB, MINCRL_BLOB, *PMINCRL_BLOB, MINCRYPT_DATA_BLOB, *PMINCRYPT_DATA_BLOB,
+    MINCRYPT_HASH_BLOB, *PMINCRYPT_HASH_BLOB, MINCRYPT_DIGEST_BLOB, *PMINCRYPT_DIGEST_BLOB, MINCRYPT_DER_BLOB,
+    *PMINCRYPT_DER_BLOB, MINCRYPT_ATTR_BLOB, *PMINCRYPT_ATTR_BLOB;
 
 // Encoded, length-delimited name bytes; not necessarily ANSI or NUL-terminated.
 // The observed 26100 x64 string tag occupies padding; see the opt-in version header.
 typedef struct _MINCRYPT_NAME_BLOB
 {
-    _Field_size_bytes_(Size)  PCHAR Data;
+    _Field_size_bytes_(Size) PCHAR Data;
     USHORT Size;
 
-}MINCRYPT_NAME_BLOB, * PMINCRYPT_NAME_BLOB;
+} MINCRYPT_NAME_BLOB, *PMINCRYPT_NAME_BLOB;
 
-#define MINCRYPT_MAX_HASH_LENGTH    (64)
-#define MINCRYPT_SHA1_LENGTH        (160/8)
-#define MINCRYPT_SHA256_LENGTH      (256/8)
-#define MINCRYPT_SHA384_LENGTH      (384/8)
-#define MINCRYPT_SHA512_LENGTH      (512/8)
+#define MINCRYPT_MAX_HASH_LENGTH (64)
+#define MINCRYPT_SHA1_LENGTH (160 / 8)
+#define MINCRYPT_SHA256_LENGTH (256 / 8)
+#define MINCRYPT_SHA384_LENGTH (384 / 8)
+#define MINCRYPT_SHA512_LENGTH (512 / 8)
 
 typedef struct _MINCRYPT_CHAIN_ELEMENT
 {
-    ALG_ID          HashAlgId;  // CALG_SHA1,       CALG_SHA_256
-    UINT32          HashSize;   // SHA1(160bit/8),  SHA256(256bit/8)
-    UINT8           Hash[MINCRYPT_MAX_HASH_LENGTH];
+    ALG_ID HashAlgId; // CALG_SHA1,       CALG_SHA_256
+    UINT32 HashSize;  // SHA1(160bit/8),  SHA256(256bit/8)
+    UINT8 Hash[MINCRYPT_MAX_HASH_LENGTH];
 
     MINCRYPT_NAME_BLOB Subject;
     MINCRYPT_NAME_BLOB Issuer;
 
-    MINCERT_BLOB    Certificate;
+    MINCERT_BLOB Certificate;
 
-}MINCRYPT_CHAIN_ELEMENT, * PMINCRYPT_CHAIN_ELEMENT;
+} MINCRYPT_CHAIN_ELEMENT, *PMINCRYPT_CHAIN_ELEMENT;
 
 // CI owns one chain allocation; nested pointers borrow that allocation.
 // Do not free child blobs separately or use memcpy to create a second owner.
 typedef struct _MINCRYPT_CHAIN_INFO
 {
-    UINT32          Size; // Observed 26100 x64: total allocation bytes, including trailing data.
+    UINT32 Size; // Observed 26100 x64: total allocation bytes, including trailing data.
 
-    MINCERT_BLOB*   PublicKeys;
-    UINT32          NumberOfPublicKeys;
+    MINCERT_BLOB* PublicKeys;
+    UINT32 NumberOfPublicKeys;
 
-    MINCERT_BLOB*   EKUs;
-    UINT32          NumberOfEKUs;
+    MINCERT_BLOB* EKUs;
+    UINT32 NumberOfEKUs;
 
 #if (NTDDI_VERSION >= NTDDI_WIN10)
 
     PMINCRYPT_CHAIN_ELEMENT ChainElements;
-    UINT32          NumberOfChainElement;
+    UINT32 NumberOfChainElement;
 
     // REQUIRES a confirmed runtime layout (10586 and later sampled profiles).
     // Sampled 10240 has only 56 header bytes: +0x38 begins variable payload.
@@ -346,30 +340,29 @@ typedef struct _MINCRYPT_CHAIN_INFO
 
     // ChainElements[NumberOfChainElement]
 
-}MINCRYPT_CHAIN_INFO, * PMINCRYPT_CHAIN_INFO;
+} MINCRYPT_CHAIN_INFO, *PMINCRYPT_CHAIN_INFO;
 
 typedef struct _MINCRYPT_POLICY_INFO
 {
-    UINT32          Size;
-    NTSTATUS        VerificationStatus; // Check API return status separately.
-    UINT32          PolicyBits;
+    UINT32 Size;
+    NTSTATUS VerificationStatus; // Check API return status separately.
+    UINT32 PolicyBits;
 
     MINCRYPT_CHAIN_INFO* ChainInfo;
 
-    LARGE_INTEGER   RevocationTime;     // When was the certificate revoked (if applicable)
+    LARGE_INTEGER RevocationTime; // When was the certificate revoked (if applicable)
 
 #if (NTDDI_VERSION >= NTDDI_WIN10)
 
-    LARGE_INTEGER   NotBefore;          // Observed: signer certificate validity start.
-    LARGE_INTEGER   NotAfter;           // Observed: signer certificate validity end.
+    LARGE_INTEGER NotBefore; // Observed: signer certificate validity start.
+    LARGE_INTEGER NotAfter;  // Observed: signer certificate validity end.
 
 #endif // NTDDI_VERSION >= NTDDI_WIN10
 
-}MINCRYPT_POLICY_INFO, *PMINCRYPT_POLICY_INFO;
+} MINCRYPT_POLICY_INFO, *PMINCRYPT_POLICY_INFO;
+
 #include <poppack.h>
 
-
-
 /**
 *  Release a known initialized policy's owned ChainInfo allocation and reset it.
 *  Zero-initialize policy objects before first use. Release both signer and TSA
@@ -384,13 +377,11 @@ typedef struct _MINCRYPT_POLICY_INFO
 */
 _IRQL_requires_max_(PASSIVE_LEVEL)
 MINCRYPTAPI
-PVOID
-NTAPI
+PVOID NTAPI
 CiFreePolicyInfo(
     _Inout_ MINCRYPT_POLICY_INFO* PolicyInfo
 );
 
-
 /**
 *  Digest-based workflow, also implemented on observed Windows 11 build 26100.
 *  Prefer the file-object workflow when its policy fits. Older-build ABI and
@@ -429,20 +420,18 @@ CiFreePolicyInfo(
 */
 _IRQL_requires_max_(PASSIVE_LEVEL)
 MINCRYPTAPI
-NTSTATUS
-NTAPI
+NTSTATUS NTAPI
 CiCheckSignedFile(
     _In_reads_bytes_(HashSize) PVOID Hash,
-    _In_ UINT32                 HashSize,
-    _In_ ALG_ID                 HashAlgId,
+    _In_ UINT32 HashSize,
+    _In_ ALG_ID HashAlgId,
     _In_reads_bytes_(SizeOfSecurityDirectory) PVOID SecurityDirectory,
-    _In_ UINT32                 SizeOfSecurityDirectory,
+    _In_ UINT32 SizeOfSecurityDirectory,
     _Out_ MINCRYPT_POLICY_INFO* PolicyInfo,
-    _Out_ LARGE_INTEGER*        SigningTime,
+    _Out_ LARGE_INTEGER* SigningTime,
     _Out_ MINCRYPT_POLICY_INFO* TimeStampPolicyInfo
 );
 
-
 // Existing Domito compatibility filter, not a universal trusted-root policy.
 // Includes test/DMD categories and a diagnostic bit; select policy deliberately.
 #define DOMITO_CI_LEGACY_CATALOG_POLICY_BITS 0x0002007FUL
@@ -493,33 +482,29 @@ CiCheckSignedFile(
 */
 _IRQL_requires_max_(PASSIVE_LEVEL)
 MINCRYPTAPI
-NTSTATUS
-NTAPI
+NTSTATUS NTAPI
 CiVerifyHashInCatalog(
     _In_reads_bytes_(HashSize) PVOID Hash,
-    _In_ UINT32                 HashSize,
-    _In_ ALG_ID                 HashAlgId,
-    _In_ BOOLEAN                ReloadCatalogs,
-    _In_ UINT32                 RequireTrustedCatalog,
-    _In_ UINT32                 AcceptedCatalogPolicyBits,
+    _In_ UINT32 HashSize,
+    _In_ ALG_ID HashAlgId,
+    _In_ BOOLEAN ReloadCatalogs,
+    _In_ UINT32 RequireTrustedCatalog,
+    _In_ UINT32 AcceptedCatalogPolicyBits,
     _Out_ MINCRYPT_POLICY_INFO* PolicyInfo,
-    _Out_opt_ UNICODE_STRING*   CatalogName,
-    _Out_ LARGE_INTEGER*        SigningTime,
+    _Out_opt_ UNICODE_STRING* CatalogName,
+    _Out_ LARGE_INTEGER* SigningTime,
     _Out_ MINCRYPT_POLICY_INFO* TimeStampPolicyInfo
 );
 
-
 #if (NTDDI_VERSION >= NTDDI_WIN10)
 
-typedef
-_IRQL_requires_same_
-_Function_class_(MINCRYPT_ALLOCATE_ROUTINE)
-__drv_allocatesMem(Mem)
+typedef _IRQL_requires_same_ _Function_class_(MINCRYPT_ALLOCATE_ROUTINE)
+__drv_allocatesMem(
+    Mem
+)
 PVOID
 NTAPI
-MINCRYPT_ALLOCATE_ROUTINE(
-    _In_ SIZE_T ByteSize
-);
+MINCRYPT_ALLOCATE_ROUTINE(_In_ SIZE_T ByteSize);
 typedef MINCRYPT_ALLOCATE_ROUTINE* PMINCRYPT_ALLOCATE_ROUTINE;
 
 /**
@@ -548,12 +533,10 @@ CiGetCertPublisherName(
     _Out_ PUNICODE_STRING PublisherName
 );
 
-
 // Export observed already in 15063.0 x64 (1703); absent from sampled
 // 10240/10586/14393 files. This writes CI-global state, not per-file policy.
 MINCRYPTAPI
-VOID
-NTAPI
+VOID NTAPI
 CiSetTrustedOriginClaimId(
     _In_ UINT32 ClaimId
 );
@@ -611,18 +594,17 @@ CiSetTrustedOriginClaimId(
 */
 _IRQL_requires_max_(PASSIVE_LEVEL)
 MINCRYPTAPI
-NTSTATUS
-NTAPI
+NTSTATUS NTAPI
 CiValidateFileObject(
-    _In_ FILE_OBJECT*           FileObject,
-    _In_ UINT32                 ValidationFlags,
-    _In_ UINT32                 RequestedSigningLevel,
+    _In_ FILE_OBJECT* FileObject,
+    _In_ UINT32 ValidationFlags,
+    _In_ UINT32 RequestedSigningLevel,
     _Out_ MINCRYPT_POLICY_INFO* PolicyInfo,
     _Out_ MINCRYPT_POLICY_INFO* TimeStampPolicyInfo,
-    _Out_ LARGE_INTEGER*        SigningTime,
+    _Out_ LARGE_INTEGER* SigningTime,
     _Out_writes_bytes_(*HashSize) UINT8* Hash,
-    _Inout_ UINT32*             HashSize,
-    _Out_ ALG_ID*               HashAlgId
+    _Inout_ UINT32* HashSize,
+    _Out_ ALG_ID* HashAlgId
 );
 
 #endif // NTDDI_VERSION >= NTDDI_WIN10

include/Domito.h

@@ -2,7 +2,6 @@
 
 #include <Domito.MinCrypt.h>
 
-
 /*   ___
  *  / __|___ _ __  _ __  ___ _ _
  * | (__/ _ \ '  \| '  \/ _ \ ' \
@@ -12,7 +11,7 @@
 
 //
 // Library initialization tasks. Call once in your DriverEntry
-// 
+//
 _Success_(return == STATUS_SUCCESS)
 _Must_inspect_result_
 _IRQL_requires_max_(PASSIVE_LEVEL)
@@ -25,7 +24,6 @@ EXTERN_C
 void
 DomitoShutdown();
 
-
 /*  __  __                          __  __                                       _   
  * |  \/  |___ _ __  ___ _ _ _  _  |  \/  |__ _ _ _  __ _ __ _ ___ _ __  ___ _ _| |_ 
  * | |\/| / -_) '  \/ _ \ '_| || | | |\/| / _` | ' \/ _` / _` / -_) '  \/ -_) ' \  _|
@@ -35,34 +33,26 @@ DomitoShutdown();
 
 //
 // Allocator function the library uses.
-// 
-typedef
-_IRQL_requires_same_
-_Function_class_(EVT_DOMITO_ALLOCATE_ROUTINE)
-__drv_allocatesMem(mem)
+//
+typedef _IRQL_requires_same_ _Function_class_(EVT_DOMITO_ALLOCATE_ROUTINE)
+__drv_allocatesMem(
+    mem
+)
 PVOID
 NTAPI
-EVT_DOMITO_ALLOCATE_ROUTINE(
-    _In_ SIZE_T ByteSize
-);
+EVT_DOMITO_ALLOCATE_ROUTINE(_In_ SIZE_T ByteSize);
 typedef EVT_DOMITO_ALLOCATE_ROUTINE* PFN_DOMITO_ALLOCATE_ROUTINE;
 
 //
 // Freeing function the library uses.
-// 
-typedef
-_IRQL_requires_same_
-_Function_class_(EVT_DOMITO_FREE_ROUTINE)
-void
-NTAPI
-EVT_DOMITO_FREE_ROUTINE(
-    _In_ __drv_freesMem(mem) PVOID Memory
-);
+//
+typedef _IRQL_requires_same_ _Function_class_(EVT_DOMITO_FREE_ROUTINE) void NTAPI
+EVT_DOMITO_FREE_ROUTINE(_In_ __drv_freesMem(mem) PVOID Memory);
 typedef EVT_DOMITO_FREE_ROUTINE* PFN_DOMITO_FREE_ROUTINE;
 
 //
 // Get the original set of Domito memory functions.
-// 
+//
 EXTERN_C
 void
 DomitoGetOriginalMemoryFunctions(
@@ -72,7 +62,7 @@ DomitoGetOriginalMemoryFunctions(
 
 //
 // Get the current set of Domito memory functions.
-//  
+//
 EXTERN_C
 void
 DomitoGetMemoryFunctions(
@@ -81,7 +71,9 @@ DomitoGetMemoryFunctions(
 );
 
 //
-//  Replace Domito's memory allocation functions with a custom set
+// Replace Domito's memory allocation functions with a compatible pair during
+// quiescent initialization. No in-flight calls or outstanding callback-backed
+// allocations may span a pair change. Replacement is not synchronized.
 EXTERN_C
 void
 DomitoSetMemoryFunctions(
@@ -89,7 +81,6 @@ DomitoSetMemoryFunctions(
     _In_opt_ PFN_DOMITO_FREE_ROUTINE Free
 );
 
-
 /*   ___               _                           _        
  *  / __|_ _ _  _ _ __| |_ ___  __ _ _ _ __ _ _ __| |_ _  _ 
  * | (__| '_| || | '_ \  _/ _ \/ _` | '_/ _` | '_ \ ' \ || |
@@ -97,9 +88,9 @@ DomitoSetMemoryFunctions(
  *           |__/|_|           |___/         |_|       |__/ 
  */
 
- //
- // This structure encapsulates a signature used in verifying executable files.
- // 
+//
+// This structure encapsulates a signature used in verifying executable files.
+//
 #if !defined(WIN_CERTIFICATE)
 typedef struct _WIN_CERTIFICATE
 {
@@ -112,16 +103,16 @@ typedef struct _WIN_CERTIFICATE
 
 //
 // UM definitions of WinCrypt.h
-// 
+//
 
 #if !defined(WIN_CERT_TYPE_X509)
-#define WIN_CERT_TYPE_X509 (0x0001)	// The bCertificate member contains an X.509 certificate.
+#define WIN_CERT_TYPE_X509 (0x0001) // The bCertificate member contains an X.509 certificate.
 #endif
 #if !defined(WIN_CERT_TYPE_PKCS_SIGNED_DATA)
-#define WIN_CERT_TYPE_PKCS_SIGNED_DATA (0x0002)	// The bCertificate member contains a PKCS SignedData structure.
+#define WIN_CERT_TYPE_PKCS_SIGNED_DATA (0x0002) // The bCertificate member contains a PKCS SignedData structure.
 #endif
 #if !defined(WIN_CERT_TYPE_PKCS1_SIGN)
-#define WIN_CERT_TYPE_PKCS1_SIGN (0x0009)	// The bCertificate member contains PKCS1_MODULE_SIGN fields.
+#define WIN_CERT_TYPE_PKCS1_SIGN (0x0009) // The bCertificate member contains PKCS1_MODULE_SIGN fields.
 #endif
 
 #if !defined(CALG_SHA1)
@@ -141,6 +132,7 @@ typedef struct _WIN_CERTIFICATE
 // Converts a WinCrypt CALG_ID to a BCRYPT_ALGORITHM identifier.
 //
 PCWSTR
+
 FORCEINLINE
 DOMITO_CALG_TO_BCRYPT_ALGORITHM(
     _In_ UINT32 Calg
@@ -161,7 +153,6 @@ DOMITO_CALG_TO_BCRYPT_ALGORITHM(
     }
 }
 
-
 /*   ___         _       ___     _                _ _
  *  / __|___  __| |___  |_ _|_ _| |_ ___ __ _ _ _(_) |_ _  _
  * | (__/ _ \/ _` / -_)  | || ' \  _/ -_) _` | '_| |  _| || |
@@ -177,7 +168,9 @@ DOMITO_CALG_TO_BCRYPT_ALGORITHM(
 //
 _IRQL_requires_max_(DISPATCH_LEVEL)
 EXTERN_C
-UINT32
+__declspec(deprecated(
+    "Use DomitoGetPortableExecutableDigestKindEx; heuristic detection silently falls back to SHA-1. Check the returned NTSTATUS."
+)) UINT32
 DomitoGetPortableExecutableDigestKind(
     _In_ PUCHAR pPeBytes,
     _In_ ULONG PeSize,
@@ -228,12 +221,14 @@ DomitoCalculatePortableExecutableDigestEx(
 // The returned certificate pointer borrows the input buffer; free only the digest
 // with DomitoFreePortableExecutableDigest. Algorithm detection is heuristic;
 // general section-ordered Authenticode hashing is not implemented here.
-// 
+//
 _Success_(return == STATUS_SUCCESS)
 _Must_inspect_result_
 _IRQL_requires_max_(PASSIVE_LEVEL)
 EXTERN_C
-NTSTATUS
+__declspec(deprecated(
+    "Use DomitoCalculatePortableExecutableDigestEx with an explicit algorithm; review its supported PE layout and failure statuses."
+)) NTSTATUS
 DomitoCalculatePortableExecutableDigest(
     _In_ PUCHAR pPeBytes,
     _In_ ULONG PeSize,
@@ -246,7 +241,7 @@ DomitoCalculatePortableExecutableDigest(
 
 //
 // Frees the memory allocated by DomitoCalculatePortableExecutableDigest.
-// 
+//
 _IRQL_requires_max_(DISPATCH_LEVEL)
 EXTERN_C
 void
@@ -278,7 +273,7 @@ typedef struct _DOMITO_CI_VALIDATION_RESULT
     UINT32 HashSize;
     ALG_ID HashAlgId;
     UINT32 FileObjectValidationFlags; // Flags passed to CI export; zero for embedded helper.
-    UINT8 RequestedSigningLevel;     // File-object helper only.
+    UINT8 RequestedSigningLevel;      // File-object helper only.
 } DOMITO_CI_VALIDATION_RESULT, *PDOMITO_CI_VALIDATION_RESULT;
 
 // Safe for NULL or an empty/initialized result; resets all fields after cleanup.
@@ -328,7 +323,7 @@ DomitoValidatePortableExecutableEmbeddedSignature(
 #endif // NTDDI_VERSION >= NTDDI_WIN10
 
 #define DOMITO_CI_SOURCE_EMBEDDED 1UL
-#define DOMITO_CI_SOURCE_CATALOG  2UL
+#define DOMITO_CI_SOURCE_CATALOG 2UL
 
 // Policy-explicit legacy helper. SHA-1/256 only; hash size must match algorithm.
 // Policy objects must be zero-initialized or own valid CI results; both are freed
@@ -361,12 +356,14 @@ DomitoValidateFileLegacyModeEx(
 // Compatibility wrapper around DomitoValidateFileLegacyModeEx, with catalog
 // mask DOMITO_CI_LEGACY_CATALOG_POLICY_BITS and RequireTrustedCatalog = FALSE.
 // The same initialization, ownership, hash, handle, and stable-file rules apply.
-// 
+//
 _Success_(return == STATUS_SUCCESS)
 _Must_inspect_result_
 _IRQL_requires_max_(PASSIVE_LEVEL)
 EXTERN_C
-NTSTATUS
+__declspec(deprecated(
+    "Use DomitoValidateFileLegacyModeEx with explicit catalog policy and validation-source output; do not change trust policy implicitly."
+)) NTSTATUS
 DomitoValidateFileLegacyMode(
     _In_ HANDLE FileHandle,
     _In_ PVOID Hash,
@@ -378,7 +375,6 @@ DomitoValidateFileLegacyMode(
     _Inout_ MINCRYPT_POLICY_INFO* TimeStampPolicyInfo
 );
 
-
 /*  __  __ _          
  * |  \/  (_)___ __   
  * | |\/| | (_-</ _|_ 
@@ -386,9 +382,9 @@ DomitoValidateFileLegacyMode(
  *                    
  */
 
- // 
- // Finds the base address of a driver module.
- // 
+//
+// Finds the base address of a driver module. Clears the optional output first.
+//
 _Success_(return == STATUS_SUCCESS)
 _Must_inspect_result_
 _IRQL_requires_max_(PASSIVE_LEVEL)
@@ -404,7 +400,7 @@ DomitoFindModuleBaseAddress(
 // ModuleBase must remain mapped; arbitrary file buffers are not supported.
 // Export table spans are checked against SizeOfImage. Forwarded exports return
 // STATUS_NOT_SUPPORTED; the optional output is cleared before lookup.
-// 
+//
 _Success_(return == STATUS_SUCCESS)
 _Must_inspect_result_
 _IRQL_requires_max_(PASSIVE_LEVEL)
@@ -418,7 +414,7 @@ DomitoFindExportedFunctionAddress(
 
 //
 // Scans a provided buffer for a memory pattern.
-// 
+//
 _Success_(return == STATUS_SUCCESS)
 _Must_inspect_result_
 _IRQL_requires_max_(DISPATCH_LEVEL)
@@ -456,7 +452,7 @@ DomitoReadFileAt(
 // with special kernel APCs enabled, a readable handle valid in the current process
 // (or a kernel handle), and a buffer that remains valid for the entire call.
 // For synchronous handles, the explicit read also updates the file position.
-// 
+//
 _Success_(return == STATUS_SUCCESS)
 _Must_inspect_result_
 _IRQL_requires_max_(PASSIVE_LEVEL)
@@ -469,14 +465,23 @@ DomitoReadFile(
 );
 
 //
-// Gets the name of the main image of the process identified by PID.
-// 
+// Gets the main image name after resolving the ULONG PID once to a process handle.
+// Requires DomitoInit. Output is NULL on failure; successful result is one Domito
+// allocation containing UNICODE_STRING and its buffer. Use DomitoFreeProcessImageName.
+// Do not change memory callbacks with outstanding allocations. PID reuse can race
+// the initial open; a later path reopen is not proof of original image identity.
+//
 _Success_(return == STATUS_SUCCESS)
 _Must_inspect_result_
 _IRQL_requires_max_(PASSIVE_LEVEL)
 EXTERN_C
-NTSTATUS
+__declspec(deprecated(
+    "Use DomitoGetProcessImageNameEx with a caller-referenced PEPROCESS to avoid a fresh PID lookup; free the result with DomitoFreeProcessImageName."
+)) NTSTATUS
 DomitoGetProcessImageName(
     _In_ ULONG ProcessId,
-    _Inout_ PUNICODE_STRING* ProcessImageName
+    _Outptr_result_maybenull_ PUNICODE_STRING* ProcessImageName
 );
+
+// Additive consumer helpers, included here for existing Domito.h clients.
+#include "Domito.Consumer.h"