nefarius
a491bbd3f8
Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style.
32 lines
938 B
C
32 lines
938 B
C
#pragma once
|
|
|
|
// Include ntifs.h and Domito.MinCrypt.h first. Test support, not a library API.
|
|
typedef struct _DOMITO_CI_PROBE_RESULT
|
|
{
|
|
ULONG Flags;
|
|
ULONG InputCapacity;
|
|
NTSTATUS Status;
|
|
UINT32 HashSize;
|
|
ALG_ID HashAlgId;
|
|
UCHAR Hash[MINCRYPT_MAX_HASH_LENGTH];
|
|
LARGE_INTEGER SigningTime;
|
|
ULONG PolicyBits;
|
|
ULONG TimeStampPolicyBits;
|
|
NTSTATUS VerificationStatus;
|
|
NTSTATUS TimeStampVerificationStatus;
|
|
BOOLEAN HasChain;
|
|
BOOLEAN HasTimeStampChain;
|
|
BOOLEAN HashGuardIntact;
|
|
} DOMITO_CI_PROBE_RESULT;
|
|
|
|
#define DOMITO_CI_PROBE_RESULT_COUNT 6
|
|
|
|
// PASSIVE_LEVEL; referenced file object; file bytes must remain stable.
|
|
// Writes observations, not an overall trust verdict. Frees both policies per call.
|
|
_IRQL_requires_max_(PASSIVE_LEVEL)
|
|
void
|
|
DomitoProbeCiValidateFileObject(
|
|
_In_ PFILE_OBJECT FileObject,
|
|
_Out_writes_(DOMITO_CI_PROBE_RESULT_COUNT) DOMITO_CI_PROBE_RESULT* Results
|
|
);
|