1.5 KiB
Code Integrity regression tests
From an x64 Visual Studio developer shell, with the Windows SDK and Python 3:
python tests\run-digest-tests.py
The runner extracts the production digest, pattern-search, algorithm-mapping, and legacy-validation functions without changing their bodies. The C++ harness uses real user-mode BCrypt hashing and test doubles for pool allocation, file reads, and CI. No driver is installed or loaded. Build outputs are temporary.
Coverage includes PE32/PE32+ digest fixtures, checksum and certificate exclusions, a DOS stub larger than 4 MiB, truncated headers next to inaccessible guard pages, invalid offsets and lengths, absent security-directory entries, injected hashing and allocation failures, deterministic failure outputs, allocation ownership, and rejection of successful-but-short certificate reads before invoking CI.
The tests do not validate CI trust policy, asynchronous kernel I/O behavior, or general Authenticode hashing of unusual section layouts. The digest implementation still uses its existing linear byte-order convention and heuristic signature algorithm detection; replacing those requires a separate compatibility corpus.
File-object validation flag probe
See the flag documentation and VM procedure
for CiValidateFileObject flag 0x20. Run python tests\run-ci-probe-tests.py
from the same developer shell to test probe plumbing with mock CI. The kernel
probe must still be run in a suitable VM to verify actual policy behavior.