30 lines
937 B
C
30 lines
937 B
C
#pragma once
|
|
|
|
// Include ntifs.h and Domito.MinCrypt.h first. Test support, not a library API.
|
|
typedef struct _DOMITO_CI_PROBE_RESULT
|
|
{
|
|
ULONG Flags;
|
|
ULONG InputCapacity;
|
|
NTSTATUS Status;
|
|
UINT32 HashSize;
|
|
ALG_ID HashAlgId;
|
|
UCHAR Hash[MINCRYPT_MAX_HASH_LENGTH];
|
|
LARGE_INTEGER SigningTime;
|
|
ULONG PolicyBits;
|
|
ULONG TimeStampPolicyBits;
|
|
NTSTATUS VerificationStatus;
|
|
NTSTATUS TimeStampVerificationStatus;
|
|
BOOLEAN HasChain;
|
|
BOOLEAN HasTimeStampChain;
|
|
BOOLEAN HashGuardIntact;
|
|
} DOMITO_CI_PROBE_RESULT;
|
|
|
|
#define DOMITO_CI_PROBE_RESULT_COUNT 6
|
|
|
|
// PASSIVE_LEVEL; referenced file object; file bytes must remain stable.
|
|
// Writes observations, not an overall trust verdict. Frees both policies per call.
|
|
_IRQL_requires_max_(PASSIVE_LEVEL)
|
|
void DomitoProbeCiValidateFileObject(
|
|
_In_ PFILE_OBJECT FileObject,
|
|
_Out_writes_(DOMITO_CI_PROBE_RESULT_COUNT) DOMITO_CI_PROBE_RESULT* Results);
|