74 lines
3.0 KiB
C
74 lines
3.0 KiB
C
/* Opt-in x64 chain views for exact observed Windows 10 CI artifacts.
|
|
* Include after ntddk.h. This does not alter Domito's default declarations.
|
|
* Select a view only after establishing the matching runtime layout from
|
|
* build/artifact evidence. ChainInfo->Size is TOTAL allocation size; it cannot
|
|
* identify the header version, because variable payload follows the header.
|
|
* See docs/mincrypt-contracts.md and NOTES.md for exact sampled versions/hashes.
|
|
*/
|
|
#pragma once
|
|
#include "Domito.MinCrypt.h"
|
|
|
|
#if !defined(_M_AMD64) && !defined(__x86_64__)
|
|
#error Historical CI views are validated only for the documented x64 artifacts.
|
|
#endif
|
|
|
|
#pragma pack(push, 8)
|
|
// Observed ci.dll 10.0.10240.16463. The variable payload begins at +0x38;
|
|
// AuthenticodeAttributes does not exist at that offset in this header.
|
|
typedef struct _DOMITO_CI10240_CHAIN_INFO
|
|
{
|
|
UINT32 Size;
|
|
MINCERT_BLOB* PublicKeys;
|
|
UINT32 NumberOfPublicKeys;
|
|
MINCERT_BLOB* EKUs;
|
|
UINT32 NumberOfEKUs;
|
|
PVOID ChainElements; // Constructor copies 120-byte elements; borrowed storage.
|
|
UINT32 NumberOfChainElements;
|
|
UINT32 RootId; // Opaque identifier, not PolicyBits.
|
|
} DOMITO_CI10240_CHAIN_INFO, *PDOMITO_CI10240_CHAIN_INFO;
|
|
|
|
// Observed ci.dll 10.0.10586.0. The variable payload begins at +0x48.
|
|
typedef struct _DOMITO_CI10586_CHAIN_INFO
|
|
{
|
|
UINT32 Size;
|
|
MINCERT_BLOB* PublicKeys;
|
|
UINT32 NumberOfPublicKeys;
|
|
MINCERT_BLOB* EKUs;
|
|
UINT32 NumberOfEKUs;
|
|
PVOID ChainElements;
|
|
UINT32 NumberOfChainElements;
|
|
UINT32 RootId;
|
|
MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
|
|
} DOMITO_CI10586_CHAIN_INFO, *PDOMITO_CI10586_CHAIN_INFO;
|
|
|
|
// Observed 10.0.14393.2189, 15063.0, 16299.125 and 17134.1130 x64.
|
|
// The variable payload begins at +0x68. Constructor evidence establishes the
|
|
// 32-byte extension's space, not its semantic contents on every sampled build.
|
|
typedef struct _DOMITO_CI14393_CHAIN_INFO
|
|
{
|
|
UINT32 Size;
|
|
MINCERT_BLOB* PublicKeys;
|
|
UINT32 NumberOfPublicKeys;
|
|
MINCERT_BLOB* EKUs;
|
|
UINT32 NumberOfEKUs;
|
|
PVOID ChainElements;
|
|
UINT32 NumberOfChainElements;
|
|
UINT32 RootId;
|
|
MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
|
|
UINT8 ReservedExtension[32];
|
|
} DOMITO_CI14393_CHAIN_INFO, *PDOMITO_CI14393_CHAIN_INFO;
|
|
#pragma pack(pop)
|
|
|
|
C_ASSERT(sizeof(DOMITO_CI10240_CHAIN_INFO) == 56);
|
|
C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, PublicKeys) == 8);
|
|
C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, EKUs) == 24);
|
|
C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, ChainElements) == 40);
|
|
C_ASSERT(FIELD_OFFSET(DOMITO_CI10240_CHAIN_INFO, RootId) == 52);
|
|
C_ASSERT(sizeof(DOMITO_CI10586_CHAIN_INFO) == 72);
|
|
C_ASSERT(FIELD_OFFSET(DOMITO_CI10586_CHAIN_INFO, RootId) == 52);
|
|
C_ASSERT(FIELD_OFFSET(DOMITO_CI10586_CHAIN_INFO, AuthenticodeAttributes) == 56);
|
|
C_ASSERT(sizeof(DOMITO_CI14393_CHAIN_INFO) == 104);
|
|
C_ASSERT(FIELD_OFFSET(DOMITO_CI14393_CHAIN_INFO, RootId) == 52);
|
|
C_ASSERT(FIELD_OFFSET(DOMITO_CI14393_CHAIN_INFO, AuthenticodeAttributes) == 56);
|
|
C_ASSERT(FIELD_OFFSET(DOMITO_CI14393_CHAIN_INFO, ReservedExtension) == 72);
|