Document CI API availability and historical mincrypt layouts

include/Domito.MinCrypt.Historical.h

@@ -0,0 +1,73 @@
+/* Opt-in x64 chain views for exact observed Windows 10 CI artifacts.
+ * Include after ntddk.h. This does not alter Domito's default declarations.
+ * Select a view only after establishing the matching runtime layout from
+ * build/artifact evidence. ChainInfo->Size is TOTAL allocation size; it cannot
+ * identify the header version, because variable payload follows the header.
+ * See docs/mincrypt-contracts.md and NOTES.md for exact sampled versions/hashes.
+ */
+#pragma once
+#include "Domito.MinCrypt.h"
+
+#if !defined(_M_AMD64) && !defined(__x86_64__)
+#error Historical CI views are validated only for the documented x64 artifacts.
+#endif
+
+#pragma pack(push, 8)
+// Observed ci.dll 10.0.10240.16463. The variable payload begins at +0x38;
+// AuthenticodeAttributes does not exist at that offset in this header.
+typedef struct _DOMITO_CI10240_CHAIN_INFO
+{
+    UINT32 Size;
+    MINCERT_BLOB* PublicKeys;
+    UINT32 NumberOfPublicKeys;
+    MINCERT_BLOB* EKUs;
+    UINT32 NumberOfEKUs;
+    PVOID ChainElements; // Constructor copies 120-byte elements; borrowed storage.
+    UINT32 NumberOfChainElements;
+    UINT32 RootId; // Opaque identifier, not PolicyBits.
+} DOMITO_CI10240_CHAIN_INFO, *PDOMITO_CI10240_CHAIN_INFO;
+
+// Observed ci.dll 10.0.10586.0. The variable payload begins at +0x48.
+typedef struct _DOMITO_CI10586_CHAIN_INFO
+{
+    UINT32 Size;
+    MINCERT_BLOB* PublicKeys;
+    UINT32 NumberOfPublicKeys;
+    MINCERT_BLOB* EKUs;
+    UINT32 NumberOfEKUs;
+    PVOID ChainElements;
+    UINT32 NumberOfChainElements;
+    UINT32 RootId;
+    MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
+} DOMITO_CI10586_CHAIN_INFO, *PDOMITO_CI10586_CHAIN_INFO;
+
+// Observed 10.0.14393.2189, 15063.0, 16299.125 and 17134.1130 x64.
+// The variable payload begins at +0x68. Constructor evidence establishes the
+// 32-byte extension's space, not its semantic contents on every sampled build.
+typedef struct _DOMITO_CI14393_CHAIN_INFO
+{
+    UINT32 Size;
+    MINCERT_BLOB* PublicKeys;
+    UINT32 NumberOfPublicKeys;
+    MINCERT_BLOB* EKUs;
+    UINT32 NumberOfEKUs;
+    PVOID ChainElements;
+    UINT32 NumberOfChainElements;
+    UINT32 RootId;
+    MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
+    UINT8 ReservedExtension[32];
+} DOMITO_CI14393_CHAIN_INFO, *PDOMITO_CI14393_CHAIN_INFO;
+#pragma pack(pop)
+
+C_ASSERT(sizeof(DOMITO_CI10240_CHAIN_INFO) == 56);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, PublicKeys) == 8);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, EKUs) == 24);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, ChainElements) == 40);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, RootId) == 52);
+C_ASSERT(sizeof(DOMITO_CI10586_CHAIN_INFO) == 72);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI10586_CHAIN_INFO, RootId) == 52);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI10586_CHAIN_INFO, AuthenticodeAttributes) == 56);
+C_ASSERT(sizeof(DOMITO_CI14393_CHAIN_INFO) == 104);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI14393_CHAIN_INFO, RootId) == 52);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI14393_CHAIN_INFO, AuthenticodeAttributes) == 56);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI14393_CHAIN_INFO, ReservedExtension) == 72);

include/Domito.MinCrypt.h

@@ -322,12 +322,17 @@ typedef struct _MINCRYPT_CHAIN_INFO
     PMINCRYPT_CHAIN_ELEMENT ChainElements;
     UINT32          NumberOfChainElement;
 
-    // ASN.1 blob of authenticated attributes - spcSpOpusInfo, contentType, etc.
+    // REQUIRES a confirmed runtime layout (10586 and later sampled profiles).
+    // Sampled 10240 has only 56 header bytes: +0x38 begins variable payload.
+    // NTDDI_VERSION and allocation Size cannot establish field availability.
+    // See Domito.MinCrypt.Historical.h for distinct observed x64 prefix views.
     MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
 
-    // Observed 26100 x64 adds RootId at +0x34 and a 32-byte platform-manifest
-    // binary ID at +0x48. These are exposed only by Domito.MinCrypt.26100.h.
-    // Do not infer their availability solely from NTDDI_VERSION or Size.
+    // RootId occupies padding at +0x34 in all six historical x64 samples and
+    // 26100. The historical views name it without extending this default layout.
+    // 26100's 32-byte platform-manifest binary ID at +0x48 is named only in its
+    // explicit version header. Earlier 104-byte views reserve that extension.
+    // Do not infer field availability solely from NTDDI_VERSION or Size.
 
 #endif // NTDDI_VERSION >= NTDDI_WIN10
 
@@ -518,7 +523,10 @@ MINCRYPT_ALLOCATE_ROUTINE(
 typedef MINCRYPT_ALLOCATE_ROUTINE* PMINCRYPT_ALLOCATE_ROUTINE;
 
 /**
-*  Parse the publisher name from the certificate
+*  Parse the publisher name from the certificate.
+*  Export absent from sampled Windows 10 x64 builds 10240–17134; observed present
+*  on 19041.1865, 22000.318 and 26100 x64; absent on sampled 19041.1 x64.
+*  The NTDDI guard does not establish runtime availability. See NOTES.md.
 *
 *  @param  Certificate - &PolicyInfo.ChainInfo->ChainElements[x].Certificate
 *
@@ -541,6 +549,8 @@ CiGetCertPublisherName(
 );
 
 
+// Export observed already in 15063.0 x64 (1703); absent from sampled
+// 10240/10586/14393 files. This writes CI-global state, not per-file policy.
 MINCRYPTAPI
 VOID
 NTAPI
@@ -550,7 +560,8 @@ CiSetTrustedOriginClaimId(
 
 // Domito descriptive name, not an official Microsoft flag name.
 // Observed on CI 10.0.26100.8328 x64: broadens the accepted-root mask in
-// CipGetAcceptedRootKeys. This is not a WinVerifyTrust-equivalent trust policy.
+// CipGetAcceptedRootKeys. Sampled 1709/1803 instead select 0x224FF; earlier helper
+// generations differ. This is not a WinVerifyTrust-equivalent trust policy.
 // See docs/ci-validate-file-object.md for evidence and version limitations.
 #define DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE 0x00000020UL