nefarius
a491bbd3f8
Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style.
73 lines
2.3 KiB
C++
73 lines
2.3 KiB
C++
// Compile into an existing signed test driver; this file has no DriverEntry.
|
|
#ifndef DOMITO_CI_PROBE_HOST_TEST
|
|
#include <ntifs.h>
|
|
#include "Domito.MinCrypt.h"
|
|
#endif
|
|
#include "ci-file-object-probe.h"
|
|
|
|
_IRQL_requires_max_(PASSIVE_LEVEL)
|
|
void
|
|
DomitoProbeCiValidateFileObject(
|
|
PFILE_OBJECT FileObject,
|
|
DOMITO_CI_PROBE_RESULT* Results
|
|
)
|
|
{
|
|
const ULONG flags[DOMITO_CI_PROBE_RESULT_COUNT] = {
|
|
0,
|
|
DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE,
|
|
DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE,
|
|
0,
|
|
0,
|
|
DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE
|
|
};
|
|
|
|
for (ULONG i = 0; i < DOMITO_CI_PROBE_RESULT_COUNT; ++i)
|
|
{
|
|
MINCRYPT_POLICY_INFO policy = {};
|
|
MINCRYPT_POLICY_INFO timestamp = {};
|
|
policy.Size = sizeof(policy);
|
|
timestamp.Size = sizeof(timestamp);
|
|
|
|
struct
|
|
{
|
|
UCHAR Bytes[MINCRYPT_MAX_HASH_LENGTH];
|
|
ULONG Guard;
|
|
} hash = {};
|
|
|
|
hash.Guard = 0xD01170AB;
|
|
DOMITO_CI_PROBE_RESULT& result = Results[i];
|
|
result = {};
|
|
result.Flags = flags[i];
|
|
result.InputCapacity = i < 4 ? sizeof(hash.Bytes) : sizeof(hash.Bytes) - 1;
|
|
result.HashSize = result.InputCapacity;
|
|
result.Status = CiValidateFileObject(
|
|
FileObject,
|
|
result.Flags,
|
|
0,
|
|
&policy,
|
|
×tamp,
|
|
&result.SigningTime,
|
|
hash.Bytes,
|
|
&result.HashSize,
|
|
&result.HashAlgId
|
|
);
|
|
result.HashGuardIntact = hash.Guard == 0xD01170AB;
|
|
// Keep failure outputs as raw observations; only successful calls have
|
|
// a usable digest. Do not dereference the incompletely mapped chains.
|
|
result.PolicyBits = policy.PolicyBits;
|
|
result.TimeStampPolicyBits = timestamp.PolicyBits;
|
|
result.VerificationStatus = (NTSTATUS)policy.VerificationStatus;
|
|
result.TimeStampVerificationStatus = (NTSTATUS)timestamp.VerificationStatus;
|
|
result.HasChain = policy.ChainInfo != nullptr;
|
|
result.HasTimeStampChain = timestamp.ChainInfo != nullptr;
|
|
|
|
if (NT_SUCCESS(result.Status) && result.HashSize <= sizeof(result.Hash))
|
|
{
|
|
RtlCopyMemory(result.Hash, hash.Bytes, result.HashSize);
|
|
}
|
|
|
|
CiFreePolicyInfo(&policy);
|
|
CiFreePolicyInfo(×tamp);
|
|
}
|
|
}
|