Document CI API availability and historical mincrypt layouts
This commit is contained in:
nefarius committed
1 parent
7aa23f50be
commit
cb23a31adb
12 files changed
+743
-40
No files matched your search
+81
-10
@@ -11,9 +11,80 @@ The evidence is static REA/Ghidra analysis of SHA-256
|
||||
`c7d23814f3202c51fb23e3ca3d4328855787383cee5d14c4a986a13ec2aeda0b`, with
|
||||
Microsoft ci.pdb GUID `1CAE574B-CF1F-3564-5F74-49567A128629`, age 1 supplying the
|
||||
address/name map. The companion CodeIntegrity-RE repository retains the full
|
||||
records and readable `evidence/` files. These observations do not establish
|
||||
older-Windows or ARM64 ABI compatibility. Compile-target `NTDDI_VERSION` is not
|
||||
runtime layout negotiation.
|
||||
records and readable `evidence/` files. The historical corpus below adds
|
||||
sampled x64 Windows 10 observations; ARM64 and unsampled-build compatibility
|
||||
remain open. Compile-target `NTDDI_VERSION` is not runtime layout negotiation.
|
||||
|
||||
## Historical x64 corpus: availability and structure evolution
|
||||
|
||||
The [CI API compatibility matrix](ci-api-compatibility.md) lists observed named
|
||||
exports for ten exact x64 CI files, including the later ISO samples. Consult it
|
||||
for import availability, and the contracts below for layout and ownership limits.
|
||||
|
||||
[NOTES.md](../NOTES.md) lists the exact identities of six sampled Windows 10
|
||||
files: `10.0.10240.16463`, `10.0.10586.0`, `10.0.14393.2189`, `10.0.15063.0`,
|
||||
`10.0.16299.125`, and `10.0.17134.1130`. All export `CiValidateFileObject` and
|
||||
the digest/catalog functions. The global setter is already present in sampled
|
||||
1703, correcting the old 1709 note. The publisher-name export is absent from
|
||||
all six. ISO samples additionally show absence in 19041.1 and presence in
|
||||
19041.1865 and 22000.318 x64; the original 26100 file also exports it. The first
|
||||
Windows 10 servicing update adding it remains unresolved. See CodeIntegrity-RE
|
||||
`iso-corpus-index.json`. Header guards do not negotiate runtime import availability.
|
||||
|
||||
All six sampled x64 file-object exports transfer 48 bytes into each caller
|
||||
policy, with the owned chain pointer at `+0x10`; cleanup zeros `0x30` bytes. Their
|
||||
file-object helpers require hash capacity >=64, return `STATUS_BUFFER_TOO_SMALL`
|
||||
and required length 64 for a smaller buffer, and consume the third input as a
|
||||
byte. This supports the stable policy storage prefix on these exact artifacts;
|
||||
it does not establish all field semantics or every servicing build's behavior.
|
||||
|
||||
**The chain header evolves within Windows 10. The default header's
|
||||
`NTDDI_VERSION >= NTDDI_WIN10` condition cannot safely expose every later field
|
||||
on Windows 10 1507.** Constructor evidence establishes:
|
||||
|
||||
- `10.0.10240.16463` (1507): fixed header 56 bytes (`0x38`), root ID at `+0x34`,
|
||||
variable payload beginning at `+0x38`. There is **no AuthenticodeAttributes
|
||||
header field at `+0x38`**. Accessing the default structure's member on this
|
||||
layout would interpret variable payload bytes as a blob descriptor.
|
||||
- `10.0.10586.0` (1511): fixed header 72 bytes (`0x48`), attributes descriptor at
|
||||
`+0x38`, payload beginning at `+0x48`.
|
||||
- Sampled 1607/1703/1709/1803: fixed header 104 bytes (`0x68`), root ID still at
|
||||
`+0x34`, attributes at `+0x38`, payload beginning at `+0x68`. Constructor evidence
|
||||
establishes space for the 32-byte extension at `+0x48`, not its semantic
|
||||
contents on every build. The historical view leaves this region reserved.
|
||||
|
||||
`Domito.MinCrypt.Historical.h` supplies distinct opt-in x64 views for those
|
||||
observed profiles with 12 compile-time assertions. The common prefix ends after
|
||||
root ID at `+0x34`; chain elements use 120-byte strides in these constructors,
|
||||
but the prefix views expose their storage as opaque. Do not assume every element
|
||||
field is populated on every version. The 26100-specific header separately names
|
||||
its recovered binary-ID field.
|
||||
|
||||
Choose a view only after establishing the runtime artifact/layout. `Size` is
|
||||
**total allocation bytes including payload**: a 1507 allocation can be larger
|
||||
than 72 or 104 bytes, so `Size >= sizeof(later_header)` is not version detection.
|
||||
Once layout identity is established, a size check is an additional field-read
|
||||
bound, not a substitute for identity. The default declarations remain unchanged
|
||||
for source compatibility; their later fields require this explicit runtime scope.
|
||||
|
||||
Successful exported/helper records in CodeIntegrity-RE retain the evidence:
|
||||
|
||||
- `historical/1507-export-contracts.json`:
|
||||
`ev_489c3b57057b0bc5c86950d7bb4ea25108bbc7762abc363e1be7eb5cca034796`.
|
||||
- `historical/ci-10240-helpers.json`:
|
||||
`ev_6d602c57de9614e7c5c28b9532c139f750f0e014b151000ecb41ad36f54bf764`.
|
||||
- `historical/ci-10586-exports.json`:
|
||||
`ev_a09e04976cfd90e9ba69cc6618892f15c3da166c64fa9241efae0db85234fd6e`.
|
||||
- `historical/ci-10586-helpers.json`:
|
||||
`ev_3403d5b8bf7c322fd924880d4cd9b296b98e94238cac2e1c1e9605c4b4d27255`.
|
||||
- `historical/ci-14393-contracts.json`:
|
||||
`ev_e63a4c4b7613e231795051b784b9571605b9bf81258b5dcd04d32ddc681abb41`.
|
||||
- `historical/ci-15063-contracts.json`:
|
||||
`ev_338658fb82559fa6daa8ae5487b90fe84b8e408ea7578feed6d8dff5d590e114`.
|
||||
- `historical/ci-16299-contracts.json`:
|
||||
`ev_fe5731175f0726f0d46af2f78ca615d284f8598939296815e26b5589db3001cf`.
|
||||
- `historical/ci-17134-contracts.json`:
|
||||
`ev_0c3e3359b8b7486318006afa6b95eb2257a18abeec9041a86a32db487bcbe996`.
|
||||
|
||||
## Results and trust policy
|
||||
|
||||
@@ -33,7 +104,7 @@ bytes the application will subsequently use.
|
||||
|
||||
The [file-object flag document](ci-validate-file-object.md) covers `0x20`, hash
|
||||
capacity, signing level, and its pending VM experiment. Other observed flag
|
||||
effects on this build are:
|
||||
effects on 26100.8328 x64 are:
|
||||
|
||||
- `0x1` selects hash scenario 5.
|
||||
- Otherwise `0x2` selects scenario 4 for signing levels <=4; higher levels use
|
||||
@@ -96,11 +167,11 @@ The wrapper selects the first certificate-table entry. Multiple table entries
|
||||
and nested signatures are separate concepts; this is not a complete signature
|
||||
enumeration interface.
|
||||
|
||||
These exports remain implemented on the analyzed Windows 11 build. The older
|
||||
header's “Win7–8.1 only” comments described a workflow, not verified export
|
||||
availability. Exact first-available builds and pre/post-KB3033929 ABI changes
|
||||
still require matching historical binaries. Import-library symbol names and
|
||||
stdcall stack-byte counts alone do not settle parameter semantics.
|
||||
These exports are present in all six sampled Windows 10 x64 files and the
|
||||
analyzed Windows 11 file. The older header's “Win7–8.1 only” comments described
|
||||
a workflow, not verified export availability. Earlier first-available builds
|
||||
and pre/post-KB3033929 ABI changes still require matching Windows 7/8 artifacts.
|
||||
Import-library names and stdcall stack-byte counts alone do not settle semantics.
|
||||
|
||||
## Catalog controls
|
||||
|
||||
@@ -201,7 +272,7 @@ be tested.
|
||||
CI global; it is not an ordinary per-file trust selector. Ordinal-only exports
|
||||
and other initialization interfaces require their own evidence and callers.
|
||||
|
||||
Still required: historical/ARM64 layout and parameter verification, real CI
|
||||
Still required: complete sampled-build/ARM64 layout and parameter verification, real CI
|
||||
output lifetimes and retry behavior under failures, timestamp propagation,
|
||||
revocation freshness/network policy, weak-crypto selection, multiple/nested
|
||||
signatures, catalog-only algorithms, and extension of the bounded digest subset to additional PE layouts.
|
||||
|
||||
Reference in new issue
Block a user