31 lines
1.5 KiB
Markdown
31 lines
1.5 KiB
Markdown
# Code Integrity regression tests
|
|
|
|
From an **x64 Visual Studio developer shell**, with the Windows SDK and Python 3:
|
|
|
|
```powershell
|
|
python tests\run-digest-tests.py
|
|
```
|
|
|
|
The runner extracts the production digest, pattern-search, algorithm-mapping,
|
|
and legacy-validation functions without changing their bodies. The C++ harness
|
|
uses real user-mode BCrypt hashing and test doubles for pool allocation, file
|
|
reads, and CI. No driver is installed or loaded. Build outputs are temporary.
|
|
|
|
Coverage includes PE32/PE32+ digest fixtures, checksum and certificate exclusions,
|
|
a DOS stub larger than 4 MiB, truncated headers next to inaccessible guard pages,
|
|
invalid offsets and lengths, absent security-directory entries, injected hashing
|
|
and allocation failures, deterministic failure outputs, allocation ownership,
|
|
and rejection of successful-but-short certificate reads before invoking CI.
|
|
|
|
The tests do not validate CI trust policy, asynchronous kernel I/O behavior, or
|
|
general Authenticode hashing of unusual section layouts. The digest implementation
|
|
still uses its existing linear byte-order convention and heuristic signature
|
|
algorithm detection; replacing those requires a separate compatibility corpus.
|
|
|
|
## File-object validation flag probe
|
|
|
|
See [the flag documentation and VM procedure](../docs/ci-validate-file-object.md)
|
|
for `CiValidateFileObject` flag `0x20`. Run `python tests\run-ci-probe-tests.py`
|
|
from the same developer shell to test probe plumbing with mock CI. The kernel
|
|
probe must still be run in a suitable VM to verify actual policy behavior.
|