83 lines
4.3 KiB
Markdown
83 lines
4.3 KiB
Markdown
# Regression tests
|
|
|
|
From an **x64 Visual Studio developer shell**, with the Windows SDK and Python 3:
|
|
|
|
```powershell
|
|
python tests\run-digest-tests.py
|
|
python tests\run-common-tests.py
|
|
python tests\run-ci-probe-tests.py
|
|
python tests\run-ci-validation-tests.py
|
|
```
|
|
|
|
Build outputs are temporary. No driver is installed or loaded. Test runners
|
|
extract the actual production functions or include the probe body unchanged;
|
|
kernel calls, CI calls, and pool allocation are replaced with test doubles.
|
|
The digest harness uses real BCrypt, Crypt32 and the Windows PE SIP provider.
|
|
|
|
## Digest and legacy verification tests
|
|
|
|
Coverage includes PE32/PE32+ files, all four supported hash algorithms, checksum
|
|
and certificate exclusions, overlays, reverse section-header order, multiple
|
|
certificate entries, certificate padding, unsupported section layouts, bounded
|
|
DER algorithm discovery, SHA-1 pattern decoys, truncated ASN.1, explicit catalog
|
|
policy forwarding and cleanup between failed/successful CI attempts.
|
|
|
|
The test compares digests against `CryptSIPCreateIndirectData` and reads the
|
|
installed system `ci.dll`, `ntdll.dll`, `kernel32.dll`, and `notepad.exe` as a
|
|
real-file corpus. For embedded signatures, Crypt32 independently decodes the SPC
|
|
algorithm and expected file digest. These checks do not verify signature trust.
|
|
|
|
Guard pages cover truncated headers and invalid ranges in both compatibility
|
|
and strict paths. Fault injection covers allocation/hash failures, deterministic
|
|
outputs, short certificate reads and digest ownership. A DOS stub larger than
|
|
4 MiB exercises the removed scratch-buffer limit. Older entry points retain
|
|
legacy selection/layout behavior; strict Ex APIs enforce their documented subset.
|
|
|
|
## File and export helper tests
|
|
|
|
The common harness checks explicit and zero offsets, exact/short/failed reads,
|
|
pending completion, event/object cleanup, and error propagation. Export fixtures
|
|
cover nonidentity name-ordinal mappings, forwarders, empty slots, invalid spans,
|
|
unbounded strings, and deterministic failure outputs. The export API requires a
|
|
valid loader-mapped module; it is not an arbitrary file parser.
|
|
|
|
## CI validation result and selection helpers
|
|
|
|
`run-ci-validation-tests.py` compiles the production wrapper source unchanged
|
|
(apart from replacing its private include with test dependencies) and extracts
|
|
the public declarations/constants. It checks native flag/level forwarding,
|
|
64-byte capacity on every call, the opt-in x64 experimental bit, non-x64 mode
|
|
rejection, invalid inputs, returned hash invariants, deterministic failure
|
|
scalars, preserved diagnostic policies, and result cleanup/reuse. The embedded
|
|
path covers all four explicit algorithms, unsupported/unsigned/invalid layouts,
|
|
partial digest allocation cleanup, CI failure propagation and no catalog retry.
|
|
CI/hash-layout behavior is injected; real digest behavior is checked by the
|
|
existing Windows SIP/Crypt32 differential harness. A second host build exercises
|
|
the non-x64 conditional branch; real ARM64 compilation is a separate build check.
|
|
|
|
The first kernel trace used direct CI calls. Probe v2 in CodeIntegrity-RE now
|
|
consumes these library helpers; a returned v2 trace is needed to claim runtime
|
|
verification of the wrappers themselves. The earlier native result is not
|
|
silently relabelled as an API-wrapper test.
|
|
|
|
## File-object validation flag probe
|
|
|
|
See [the flag documentation and VM procedure](../docs/ci-validate-file-object.md)
|
|
for `CiValidateFileObject` flag `0x20`. The host runner tests probe plumbing with
|
|
mock CI. The kernel probe must still run in a suitable VM to verify actual
|
|
policy behavior.
|
|
|
|
## Kernel compile checks and remaining validation
|
|
|
|
`mincrypt-layout-tests.cpp` asserts default modern x64/ARM64 and pre-Windows-10
|
|
compile layouts. On x64 it also includes the opt-in observed 26100 header's 14
|
|
layout assertions. Compile it with the same WDK/kernel architecture flags and
|
|
include paths as the library. This checks structure definitions, not runtime
|
|
compatibility on those systems. `ci-file-object-probe.cpp` is separately compiled
|
|
as kernel code for x64/ARM64; its real CI behavior is still untested.
|
|
|
|
The host tests do not establish CI trust policy, real asynchronous kernel I/O,
|
|
real policy ownership under Driver Verifier, revocation/timestamp behavior, or
|
|
all Windows-version/layout combinations. See the
|
|
[implementation ledger](../docs/implementation-status.md) for the remaining work.
|