nefarius
a491bbd3f8
Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style.
121 lines
3.2 KiB
C
121 lines
3.2 KiB
C
/* Opt-in x64 chain views for exact observed Windows 10 CI artifacts.
|
|
* Include after ntddk.h. This does not alter Domito's default declarations.
|
|
* Select a view only after establishing the matching runtime layout from
|
|
* build/artifact evidence. ChainInfo->Size is TOTAL allocation size; it cannot
|
|
* identify the header version, because variable payload follows the header.
|
|
* See docs/mincrypt-contracts.md and NOTES.md for exact sampled versions/hashes.
|
|
*/
|
|
#pragma once
|
|
#include "Domito.MinCrypt.h"
|
|
|
|
#if !defined(_M_AMD64) && !defined(__x86_64__)
|
|
#error Historical CI views are validated only for the documented x64 artifacts.
|
|
#endif
|
|
|
|
#pragma pack(push, 8)
|
|
|
|
// Observed ci.dll 10.0.10240.16463. The variable payload begins at +0x38;
|
|
// AuthenticodeAttributes does not exist at that offset in this header.
|
|
typedef struct _DOMITO_CI10240_CHAIN_INFO
|
|
{
|
|
UINT32 Size;
|
|
MINCERT_BLOB* PublicKeys;
|
|
UINT32 NumberOfPublicKeys;
|
|
MINCERT_BLOB* EKUs;
|
|
UINT32 NumberOfEKUs;
|
|
PVOID ChainElements; // Constructor copies 120-byte elements; borrowed storage.
|
|
UINT32 NumberOfChainElements;
|
|
UINT32 RootId; // Opaque identifier, not PolicyBits.
|
|
} DOMITO_CI10240_CHAIN_INFO, *PDOMITO_CI10240_CHAIN_INFO;
|
|
|
|
// Observed ci.dll 10.0.10586.0. The variable payload begins at +0x48.
|
|
typedef struct _DOMITO_CI10586_CHAIN_INFO
|
|
{
|
|
UINT32 Size;
|
|
MINCERT_BLOB* PublicKeys;
|
|
UINT32 NumberOfPublicKeys;
|
|
MINCERT_BLOB* EKUs;
|
|
UINT32 NumberOfEKUs;
|
|
PVOID ChainElements;
|
|
UINT32 NumberOfChainElements;
|
|
UINT32 RootId;
|
|
MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
|
|
} DOMITO_CI10586_CHAIN_INFO, *PDOMITO_CI10586_CHAIN_INFO;
|
|
|
|
// Observed 10.0.14393.2189, 15063.0, 16299.125 and 17134.1130 x64.
|
|
// The variable payload begins at +0x68. Constructor evidence establishes the
|
|
// 32-byte extension's space, not its semantic contents on every sampled build.
|
|
typedef struct _DOMITO_CI14393_CHAIN_INFO
|
|
{
|
|
UINT32 Size;
|
|
MINCERT_BLOB* PublicKeys;
|
|
UINT32 NumberOfPublicKeys;
|
|
MINCERT_BLOB* EKUs;
|
|
UINT32 NumberOfEKUs;
|
|
PVOID ChainElements;
|
|
UINT32 NumberOfChainElements;
|
|
UINT32 RootId;
|
|
MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
|
|
UINT8 ReservedExtension[32];
|
|
} DOMITO_CI14393_CHAIN_INFO, *PDOMITO_CI14393_CHAIN_INFO;
|
|
|
|
#pragma pack(pop)
|
|
|
|
C_ASSERT(sizeof(DOMITO_CI10240_CHAIN_INFO) == 56);
|
|
C_ASSERT(
|
|
FIELD_OFFSET(
|
|
DOMITO_CI10240_CHAIN_INFO,
|
|
PublicKeys
|
|
) == 8
|
|
);
|
|
C_ASSERT(
|
|
FIELD_OFFSET(
|
|
DOMITO_CI10240_CHAIN_INFO,
|
|
EKUs
|
|
) == 24
|
|
);
|
|
C_ASSERT(
|
|
FIELD_OFFSET(
|
|
DOMITO_CI10240_CHAIN_INFO,
|
|
ChainElements
|
|
) == 40
|
|
);
|
|
C_ASSERT(
|
|
FIELD_OFFSET(
|
|
DOMITO_CI10240_CHAIN_INFO,
|
|
RootId
|
|
) == 52
|
|
);
|
|
C_ASSERT(sizeof(DOMITO_CI10586_CHAIN_INFO) == 72);
|
|
C_ASSERT(
|
|
FIELD_OFFSET(
|
|
DOMITO_CI10586_CHAIN_INFO,
|
|
RootId
|
|
) == 52
|
|
);
|
|
C_ASSERT(
|
|
FIELD_OFFSET(
|
|
DOMITO_CI10586_CHAIN_INFO,
|
|
AuthenticodeAttributes
|
|
) == 56
|
|
);
|
|
C_ASSERT(sizeof(DOMITO_CI14393_CHAIN_INFO) == 104);
|
|
C_ASSERT(
|
|
FIELD_OFFSET(
|
|
DOMITO_CI14393_CHAIN_INFO,
|
|
RootId
|
|
) == 52
|
|
);
|
|
C_ASSERT(
|
|
FIELD_OFFSET(
|
|
DOMITO_CI14393_CHAIN_INFO,
|
|
AuthenticodeAttributes
|
|
) == 56
|
|
);
|
|
C_ASSERT(
|
|
FIELD_OFFSET(
|
|
DOMITO_CI14393_CHAIN_INFO,
|
|
ReservedExtension
|
|
) == 72
|
|
);
|