Document CI API availability and historical mincrypt layouts

2026-10-26 19:23:08 +01:00
1 parent 7aa23f50be
commit cb23a31adb
@@ -0,0 +1,73 @@
+/* Opt-in x64 chain views for exact observed Windows 10 CI artifacts.
+ * Include after ntddk.h. This does not alter Domito's default declarations.
+ * Select a view only after establishing the matching runtime layout from
+ * build/artifact evidence. ChainInfo->Size is TOTAL allocation size; it cannot
+ * identify the header version, because variable payload follows the header.
+ * See docs/mincrypt-contracts.md and NOTES.md for exact sampled versions/hashes.
+ */
+#pragma once
+#include "Domito.MinCrypt.h"
+
+#if !defined(_M_AMD64) && !defined(__x86_64__)
+#error Historical CI views are validated only for the documented x64 artifacts.
+#endif
+
+#pragma pack(push, 8)
+// Observed ci.dll 10.0.10240.16463. The variable payload begins at +0x38;
+// AuthenticodeAttributes does not exist at that offset in this header.
+typedef struct _DOMITO_CI10240_CHAIN_INFO
+{
+    UINT32 Size;
+    MINCERT_BLOB* PublicKeys;
+    UINT32 NumberOfPublicKeys;
+    MINCERT_BLOB* EKUs;
+    UINT32 NumberOfEKUs;
+    PVOID ChainElements; // Constructor copies 120-byte elements; borrowed storage.
+    UINT32 NumberOfChainElements;
+    UINT32 RootId; // Opaque identifier, not PolicyBits.
+} DOMITO_CI10240_CHAIN_INFO, *PDOMITO_CI10240_CHAIN_INFO;
+
+// Observed ci.dll 10.0.10586.0. The variable payload begins at +0x48.
+typedef struct _DOMITO_CI10586_CHAIN_INFO
+{
+    UINT32 Size;
+    MINCERT_BLOB* PublicKeys;
+    UINT32 NumberOfPublicKeys;
+    MINCERT_BLOB* EKUs;
+    UINT32 NumberOfEKUs;
+    PVOID ChainElements;
+    UINT32 NumberOfChainElements;
+    UINT32 RootId;
+    MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
+} DOMITO_CI10586_CHAIN_INFO, *PDOMITO_CI10586_CHAIN_INFO;
+
+// Observed 10.0.14393.2189, 15063.0, 16299.125 and 17134.1130 x64.
+// The variable payload begins at +0x68. Constructor evidence establishes the
+// 32-byte extension's space, not its semantic contents on every sampled build.
+typedef struct _DOMITO_CI14393_CHAIN_INFO
+{
+    UINT32 Size;
+    MINCERT_BLOB* PublicKeys;
+    UINT32 NumberOfPublicKeys;
+    MINCERT_BLOB* EKUs;
+    UINT32 NumberOfEKUs;
+    PVOID ChainElements;
+    UINT32 NumberOfChainElements;
+    UINT32 RootId;
+    MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
+    UINT8 ReservedExtension[32];
+} DOMITO_CI14393_CHAIN_INFO, *PDOMITO_CI14393_CHAIN_INFO;
+#pragma pack(pop)
+
+C_ASSERT(sizeof(DOMITO_CI10240_CHAIN_INFO) == 56);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, PublicKeys) == 8);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, EKUs) == 24);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, ChainElements) == 40);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, RootId) == 52);
+C_ASSERT(sizeof(DOMITO_CI10586_CHAIN_INFO) == 72);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI10586_CHAIN_INFO, RootId) == 52);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI10586_CHAIN_INFO, AuthenticodeAttributes) == 56);
+C_ASSERT(sizeof(DOMITO_CI14393_CHAIN_INFO) == 104);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI14393_CHAIN_INFO, RootId) == 52);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI14393_CHAIN_INFO, AuthenticodeAttributes) == 56);
+C_ASSERT(FIELD_OFFSET(DOMITO_CI14393_CHAIN_INFO, ReservedExtension) == 72);