Domito/tests

Regression tests

From an x64 Visual Studio developer shell, with the Windows SDK and Python 3:

python tests\run-digest-tests.py
python tests\run-common-tests.py
python tests\run-ci-probe-tests.py
python tests\run-ci-validation-tests.py

Build outputs are temporary. No driver is installed or loaded. Test runners extract the actual production functions or include the probe body unchanged; kernel calls, CI calls, and pool allocation are replaced with test doubles. The digest harness uses real BCrypt, Crypt32 and the Windows PE SIP provider.

Digest and legacy verification tests

Coverage includes PE32/PE32+ files, all four supported hash algorithms, checksum and certificate exclusions, overlays, reverse section-header order, multiple certificate entries, certificate padding, unsupported section layouts, bounded DER algorithm discovery, SHA-1 pattern decoys, truncated ASN.1, explicit catalog policy forwarding and cleanup between failed/successful CI attempts.

The test compares digests against CryptSIPCreateIndirectData and reads the installed system ci.dll, ntdll.dll, kernel32.dll, and notepad.exe as a real-file corpus. For embedded signatures, Crypt32 independently decodes the SPC algorithm and expected file digest. These checks do not verify signature trust.

Guard pages cover truncated headers and invalid ranges in both compatibility and strict paths. Fault injection covers allocation/hash failures, deterministic outputs, short certificate reads and digest ownership. A DOS stub larger than 4 MiB exercises the removed scratch-buffer limit. Older entry points retain legacy selection/layout behavior; strict Ex APIs enforce their documented subset.

File and export helper tests

The common harness checks explicit and zero offsets, exact/short/failed reads, pending completion, event/object cleanup, and error propagation. Export fixtures cover nonidentity name-ordinal mappings, forwarders, empty slots, invalid spans, unbounded strings, and deterministic failure outputs. The export API requires a valid loader-mapped module; it is not an arbitrary file parser.

CI validation result and selection helpers

run-ci-validation-tests.py compiles the production wrapper source unchanged (apart from replacing its private include with test dependencies) and extracts the public declarations/constants. It checks native flag/level forwarding, 64-byte capacity on every call, the opt-in x64 experimental bit, non-x64 mode rejection, invalid inputs, returned hash invariants, deterministic failure scalars, preserved diagnostic policies, and result cleanup/reuse. The embedded path covers all four explicit algorithms, unsupported/unsigned/invalid layouts, partial digest allocation cleanup, CI failure propagation and no catalog retry. CI/hash-layout behavior is injected; real digest behavior is checked by the existing Windows SIP/Crypt32 differential harness. A second host build exercises the non-x64 conditional branch; real ARM64 compilation is a separate build check.

The first kernel trace used direct CI calls. Probe v2 in CodeIntegrity-RE now consumes these library helpers; a returned v2 trace is needed to claim runtime verification of the wrappers themselves. The earlier native result is not silently relabelled as an API-wrapper test.

File-object validation flag probe

See the flag documentation and VM procedure for CiValidateFileObject flag 0x20. The host runner tests probe plumbing with mock CI. The kernel probe must still run in a suitable VM to verify actual policy behavior.

Kernel compile checks and remaining validation

mincrypt-layout-tests.cpp asserts default modern x64/ARM64 and pre-Windows-10 compile layouts. On x64 it also includes the opt-in observed 26100 header's 14 layout assertions. Compile it with the same WDK/kernel architecture flags and include paths as the library. This checks structure definitions, not runtime compatibility on those systems. ci-file-object-probe.cpp is separately compiled as kernel code for x64/ARM64; its real CI behavior is still untested.

The host tests do not establish CI trust policy, real asynchronous kernel I/O, real policy ownership under Driver Verifier, revocation/timestamp behavior, or all Windows-version/layout combinations. See the implementation ledger for the remaining work.

Consumer helper regression tests

Run python tests/run-consumer-helper-tests.py in an x64 Visual Studio developer shell. This fifth host runner compiles the actual certificate/common-consumer implementations and the existing PID name function, with kernel operations replaced by deterministic doubles. Hashing uses real Windows CNG; independent Crypt32 decoding/re-encoding/hash calls verify SPKI representation and pins. The synthetic v1/v3 certificates are framing fixtures, not trust fixtures.

Coverage includes truncated certificate prefixes at inaccessible guard pages, malformed DER lengths and optional read-only comparisons with real system-root certificate SPKIs, four hash algorithms, short capacities and four injected CNG failures, strict hex conversion across all byte values, path/handle ownership, failed references, partial publisher allocation, process-name query failures, stale-output cleanup, and malformed/overflowing x64 chain spans. A second host build exercises the non-x64 rejection branch without claiming ARM64 ABI or runtime emulation. No service is started, certificate trusted, or real CI policy evaluated.

Deprecation compiler checks

Run python tests/run-deprecation-tests.py --arch x64 or --arch ARM64 from a Visual Studio developer shell with the WDK installed. This compile-only runner uses the actual public headers: modern API references must compile under /WX, while each of four deprecated references must fail specifically with C4996 and its migration message. Both C and C++ are checked. It does not link or load code.