102 lines
6.5 KiB
Markdown
102 lines
6.5 KiB
Markdown
# CI SDK implementation status
|
||
|
||
This ledger tracks the source audit S01–S18 and the remaining binary research.
|
||
The original CodeIntegrity-RE audit remains a snapshot of commit `7985b23`;
|
||
it should not be read as describing the corrected source unchanged.
|
||
|
||
## Implemented with host tests or compilation
|
||
|
||
- **S01–S04:** subtraction-safe PE ranges, no fixed 4 MiB copy, bounded certificate
|
||
intervals, deterministic failure outputs, and digest cleanup. Compatibility
|
||
and explicit paths share the bounded hashing core.
|
||
- **S05:** actual certificate read length checked; allocation bounded against
|
||
file size; per-operation completion waits through the exact-read helper.
|
||
- **S06:** `DomitoReadFileAt` uses an explicit offset and private kernel event;
|
||
`DomitoReadFile` reads exactly from offset zero. Pending completion cannot
|
||
outlive its stack state or caller buffer. Short reads return EOF.
|
||
- **S10:** export lookup uses the name ordinal to index the EAT, bounds tables,
|
||
names and resolved RVAs, and rejects forwarders. A valid loader-mapped module
|
||
remains a precondition because the API has no externally supplied image size.
|
||
- **S11–S12:** corrected policy pointer typedef and publisher return/ownership docs.
|
||
- **S14:** policy cleanup before embedded/catalog/reload retries, with host tests
|
||
allocating results even on failures. Real CI failure ownership still needs
|
||
the VM tests below.
|
||
- **S17:** legacy hash algorithm/length combinations validated and calculation
|
||
versus verification capabilities documented.
|
||
- **S18:** byte-count SAL, buffer-capacity rules, scalar input annotations, and
|
||
kernel read context/APC requirements documented.
|
||
|
||
## Implemented within an explicit support boundary
|
||
|
||
- **S07:** new bounded DER discovery reads the first outer SPC file-digest
|
||
AlgorithmIdentifier; new explicit digest API needs no discovery. The old
|
||
heuristic entry point retains compatibility behavior. Arbitrary BER, nested
|
||
signatures, and full signature enumeration remain outside this parser.
|
||
- **S08:** unsigned/catalog-only files can be hashed with a caller-chosen
|
||
SHA-1 or SHA-256 strategy. The policy-explicit legacy helper forwards catalog
|
||
controls and reports the successful source. Real catalog lookup comparisons
|
||
across OS versions are pending; no implicit algorithm retry policy is imposed.
|
||
- **S09:** the explicit digest path enforces a contiguous raw-section subset and
|
||
EOF certificate tables, with Windows SIP and real embedded-digest comparisons.
|
||
Gaps, overlaps, missing directory slots and nonterminal certificates are
|
||
rejected. The old linear compatibility entry point is not a universal hasher.
|
||
- **S13/S15/S16:** recovered fields, parameter meanings, policy categories, sizes,
|
||
name encoding, borrowed lifetimes, and allocator ownership are documented.
|
||
The opt-in x64 26100 header provides distinct observed layouts and assertions.
|
||
Default declarations retain source compatibility; later chain fields require
|
||
a confirmed runtime layout. The sampled 1507 chain header is 56 bytes and has
|
||
no attributes descriptor at +0x38; 1511 uses 72 bytes; 1607–1803 samples use 104.
|
||
Distinct views are available in `Domito.MinCrypt.Historical.h`. Neither
|
||
`NTDDI_VERSION` nor total allocation Size identifies the layout.
|
||
|
||
## Requires the test VM or additional matching binaries
|
||
|
||
The first user-run kernel trace is available for Windows 11 22631 x64 with
|
||
TESTSIGNING enabled. It confirms the BthPS3 signer-selection comparison and
|
||
primary-signature CI path below. That one run, extracted artifacts, host mocks
|
||
and compilation do not close the remaining work:
|
||
|
||
1. Run the paired `CiValidateFileObject` flag `0`/`0x20` probe on 19041/19045
|
||
with TESTSIGNING off and a loadable signed test driver. Preserve complete
|
||
statuses, policies and fixture/environment identities (issue #3).
|
||
2. Complete historical and ARM64 ABI/structure verification and runtime tests.
|
||
The [published export matrix](ci-api-compatibility.md) now covers all ten
|
||
named APIs across 20 exact Windows 10/11 x64 and ARM64 CI files.
|
||
ISO coverage includes Windows 10 1809/1903 revisions, 1909, 21H2/22H2 ARM64,
|
||
and Windows 11 23H2 x64 plus 22H2/24H2 ARM64.
|
||
The ARM64 observations establish export presence; their structure layouts
|
||
and runtime behavior remain unverified. This closes the initial export-presence
|
||
matrix; additional releases, servicing revisions and architectures remain
|
||
unsampled. It does not certify ABI or runtime behavior. The six 1507–1803
|
||
sampled bodies establish the
|
||
48-byte policy storage and 64-byte hash-capacity gate. Chain constructors
|
||
establish 56/72/104-byte headers; opt-in views prevent treating 1507 payload
|
||
as the later attributes descriptor. Unsampled layouts/runtime remain open.
|
||
3. Test real CI policy ownership on every failure/retry path under Driver
|
||
Verifier, including allocation failures and initialized outputs.
|
||
4. Compare real embedded/catalog-only SHA-1/SHA-256 results, catalog cache/reload
|
||
behavior, trust-mask choices, requested signing levels and flag combinations.
|
||
5. Measure signing-time propagation, zero/sentinel values, timestamp expiry,
|
||
revocation freshness/network policy and weak-crypto policy. Record OS policy,
|
||
Secure Boot/HVCI/WDAC and exact files, not just a boolean result.
|
||
6. Extend the observed multiple/nested selection result beyond the first run.
|
||
On Windows 11 22631 x64 with TESTSIGNING enabled, `0x20` returns Microsoft;
|
||
`0xA0` and direct primary SHA-256 `CiCheckSignedFile` return Nefarius with the
|
||
same signing time and matching signer/timestamp policy observations. All
|
||
calls and policy statuses succeed, the file snapshots match, and no trace
|
||
events are lost. TESTSIGNING-off, general enumeration, full `0x80` semantics
|
||
and cross-build/policy behavior remain open. Extend supported PE gaps/overlays
|
||
only after differential evidence.
|
||
7. Resolve page-hash allocation destruction, normalized-entry/truncation meaning,
|
||
terminal-entry handling and cross-version layouts before publishing a general
|
||
page-hash API. `CiFreePolicyInfo` is not an established destructor for it.
|
||
8. Investigate protected-media/initialization and ordinal-only exports separately
|
||
if they are needed. Recovered export names alone are insufficient contracts.
|
||
|
||
## Checks
|
||
|
||
Run the three host runners in `tests/README.md`. Kernel compilation also covers
|
||
the default modern x64/ARM64 structures, the pre-Windows-10 x64 compile variant,
|
||
and 14 assertions in the 26100 opt-in header plus 12 historical-view assertions. Those are build checks,
|
||
not a claim that historical or ARM64 CI runtime ABI has been verified.
|