/* Opt-in x64 chain views for exact observed Windows 10 CI artifacts.
 * Include after ntddk.h. This does not alter Domito's default declarations.
 * Select a view only after establishing the matching runtime layout from
 * build/artifact evidence. ChainInfo->Size is TOTAL allocation size; it cannot
 * identify the header version, because variable payload follows the header.
 * See docs/mincrypt-contracts.md and NOTES.md for exact sampled versions/hashes.
 */
#pragma once
#include "Domito.MinCrypt.h"

#if !defined(_M_AMD64) && !defined(__x86_64__)
#error Historical CI views are validated only for the documented x64 artifacts.
#endif

#pragma pack(push, 8)

// Observed ci.dll 10.0.10240.16463. The variable payload begins at +0x38;
// AuthenticodeAttributes does not exist at that offset in this header.
typedef struct _DOMITO_CI10240_CHAIN_INFO
{
    UINT32 Size;
    MINCERT_BLOB* PublicKeys;
    UINT32 NumberOfPublicKeys;
    MINCERT_BLOB* EKUs;
    UINT32 NumberOfEKUs;
    PVOID ChainElements; // Constructor copies 120-byte elements; borrowed storage.
    UINT32 NumberOfChainElements;
    UINT32 RootId; // Opaque identifier, not PolicyBits.
} DOMITO_CI10240_CHAIN_INFO, *PDOMITO_CI10240_CHAIN_INFO;

// Observed ci.dll 10.0.10586.0. The variable payload begins at +0x48.
typedef struct _DOMITO_CI10586_CHAIN_INFO
{
    UINT32 Size;
    MINCERT_BLOB* PublicKeys;
    UINT32 NumberOfPublicKeys;
    MINCERT_BLOB* EKUs;
    UINT32 NumberOfEKUs;
    PVOID ChainElements;
    UINT32 NumberOfChainElements;
    UINT32 RootId;
    MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
} DOMITO_CI10586_CHAIN_INFO, *PDOMITO_CI10586_CHAIN_INFO;

// Observed 10.0.14393.2189, 15063.0, 16299.125 and 17134.1130 x64.
// The variable payload begins at +0x68. Constructor evidence establishes the
// 32-byte extension's space, not its semantic contents on every sampled build.
typedef struct _DOMITO_CI14393_CHAIN_INFO
{
    UINT32 Size;
    MINCERT_BLOB* PublicKeys;
    UINT32 NumberOfPublicKeys;
    MINCERT_BLOB* EKUs;
    UINT32 NumberOfEKUs;
    PVOID ChainElements;
    UINT32 NumberOfChainElements;
    UINT32 RootId;
    MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
    UINT8 ReservedExtension[32];
} DOMITO_CI14393_CHAIN_INFO, *PDOMITO_CI14393_CHAIN_INFO;

#pragma pack(pop)

C_ASSERT(sizeof(DOMITO_CI10240_CHAIN_INFO) == 56);
C_ASSERT(
    FIELD_OFFSET(
        DOMITO_CI10240_CHAIN_INFO,
        PublicKeys
    ) == 8
);
C_ASSERT(
    FIELD_OFFSET(
        DOMITO_CI10240_CHAIN_INFO,
        EKUs
    ) == 24
);
C_ASSERT(
    FIELD_OFFSET(
        DOMITO_CI10240_CHAIN_INFO,
        ChainElements
    ) == 40
);
C_ASSERT(
    FIELD_OFFSET(
        DOMITO_CI10240_CHAIN_INFO,
        RootId
    ) == 52
);
C_ASSERT(sizeof(DOMITO_CI10586_CHAIN_INFO) == 72);
C_ASSERT(
    FIELD_OFFSET(
        DOMITO_CI10586_CHAIN_INFO,
        RootId
    ) == 52
);
C_ASSERT(
    FIELD_OFFSET(
        DOMITO_CI10586_CHAIN_INFO,
        AuthenticodeAttributes
    ) == 56
);
C_ASSERT(sizeof(DOMITO_CI14393_CHAIN_INFO) == 104);
C_ASSERT(
    FIELD_OFFSET(
        DOMITO_CI14393_CHAIN_INFO,
        RootId
    ) == 52
);
C_ASSERT(
    FIELD_OFFSET(
        DOMITO_CI14393_CHAIN_INFO,
        AuthenticodeAttributes
    ) == 56
);
C_ASSERT(
    FIELD_OFFSET(
        DOMITO_CI14393_CHAIN_INFO,
        ReservedExtension
    ) == 72
);