53 lines
2.2 KiB
C++
53 lines
2.2 KiB
C++
// Compile into an existing signed test driver; this file has no DriverEntry.
|
|
#ifndef DOMITO_CI_PROBE_HOST_TEST
|
|
#include <ntifs.h>
|
|
#include "Domito.MinCrypt.h"
|
|
#endif
|
|
#include "ci-file-object-probe.h"
|
|
|
|
_IRQL_requires_max_(PASSIVE_LEVEL)
|
|
void DomitoProbeCiValidateFileObject(
|
|
PFILE_OBJECT FileObject, DOMITO_CI_PROBE_RESULT* Results)
|
|
{
|
|
const ULONG flags[DOMITO_CI_PROBE_RESULT_COUNT] = {
|
|
0, DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE,
|
|
DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE, 0,
|
|
0, DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE
|
|
};
|
|
for (ULONG i = 0; i < DOMITO_CI_PROBE_RESULT_COUNT; ++i)
|
|
{
|
|
MINCRYPT_POLICY_INFO policy = {};
|
|
MINCRYPT_POLICY_INFO timestamp = {};
|
|
policy.Size = sizeof(policy);
|
|
timestamp.Size = sizeof(timestamp);
|
|
struct {
|
|
UCHAR Bytes[MINCRYPT_MAX_HASH_LENGTH];
|
|
ULONG Guard;
|
|
} hash = {};
|
|
hash.Guard = 0xD01170AB;
|
|
DOMITO_CI_PROBE_RESULT& result = Results[i];
|
|
result = {};
|
|
result.Flags = flags[i];
|
|
result.InputCapacity = i < 4 ? sizeof(hash.Bytes) : sizeof(hash.Bytes) - 1;
|
|
result.HashSize = result.InputCapacity;
|
|
result.Status = CiValidateFileObject(FileObject, result.Flags, 0,
|
|
&policy, ×tamp, &result.SigningTime, hash.Bytes,
|
|
&result.HashSize, &result.HashAlgId);
|
|
result.HashGuardIntact = hash.Guard == 0xD01170AB;
|
|
// Keep failure outputs as raw observations; only successful calls have
|
|
// a usable digest. Do not dereference the incompletely mapped chains.
|
|
result.PolicyBits = policy.PolicyBits;
|
|
result.TimeStampPolicyBits = timestamp.PolicyBits;
|
|
result.VerificationStatus = (NTSTATUS)policy.VerificationStatus;
|
|
result.TimeStampVerificationStatus = (NTSTATUS)timestamp.VerificationStatus;
|
|
result.HasChain = policy.ChainInfo != nullptr;
|
|
result.HasTimeStampChain = timestamp.ChainInfo != nullptr;
|
|
if (NT_SUCCESS(result.Status) && result.HashSize <= sizeof(result.Hash))
|
|
{
|
|
RtlCopyMemory(result.Hash, hash.Bytes, result.HashSize);
|
|
}
|
|
CiFreePolicyInfo(&policy);
|
|
CiFreePolicyInfo(×tamp);
|
|
}
|
|
}
|