Domito/NOTES.md

CI API availability observations

See the CI API compatibility matrix for the per-API tables covering all ten VM, ISO and modern x64 samples, with exact versions, file hashes and machine-readable results. The six-sample notes below describe the original VM corpus and its subsequent ISO follow-up.

These are export-table observations from six extracted x64 ci.dll files, not claims about every servicing revision or a proof of the original introduction build. The companion CodeIntegrity-RE corpus-index.json records identities, extraction aliases, manifest checks, and metadata. VM directory names are labels; versions below come from the PE version resources. No target was executed.

Named exports common to all six samples

• CiCheckSignedFile
• CiFindPageHashesInCatalog
• CiFindPageHashesInSignedFile
• CiFreePolicyInfo
• CiGetPEInformation
• CiInitialize
• CiValidateFileObject
• CiVerifyHashInCatalog

CiValidateFileObject is already present in sampled Windows 10 1507 10.0.10240.16463. The old “starting with 1511” list was therefore too narrow. Export presence does not establish a complete compatible parameter/structure contract; consult the per-build static analysis before using it.

Additional names and absent names

CiSetTrustedOriginClaimId is present in sampled 10.0.15063.0 (1703) and in the sampled 1709/1803 files. It is absent from the sampled 1507,1511,1607 export tables. This corrects the old “added in 1709” note, without claiming the first Windows build on which the API ever existed.

CiGetCertPublisherName is absent from all six sampled 1507–1803 export tables. The ISO follow-up also finds it absent in x64 10.0.19041.1, present in x64 10.0.19041.1865 and 10.0.22000.318, and the original investigation finds it present in 10.0.26100.8328. This brackets Windows 10 servicing observations without identifying the first update adding the export. The CodeIntegrity-RE iso-corpus-index.json records the exact files and hashes. A header declaration, import-library symbol, or NTDDI_VERSION >= NTDDI_WIN10 alone does not make an unconditional static import loadable on the older samples. Callers supporting those samples must avoid that import or use optional resolution with an explicit unavailable/fallback path. CiSetTrustedOriginClaimId likewise cannot be assumed available on every Windows 10 build; it is a CI-global setter.

Exact sampled files

• Windows 10 1507: 10.0.10240.16463 x64, SHA-256 e83d900f4675c6e6ffc3fb7dcd3074610876a1398e495796769988df810fd3bc.
• Windows 10 1511: 10.0.10586.0 x64, SHA-256 f949bfa614addea6174b28c3818c56b327c9290fd41bd91dfc545414b3df6783.
• Windows 10 1607: 10.0.14393.2189 x64, SHA-256 ef0c02ecbd0818e84be9f61421f919825f96a3c59199460cab08548eee2881df.
• Windows 10 1703: 10.0.15063.0 x64, SHA-256 3705aaf408f05326e028621380aa5c96a1f3583a2de8a139b188da4b82577863.
• Windows 10 1709: 10.0.16299.125 x64, SHA-256 1db7ae5a08bd2361fc7fcdd373fb980e8d680035e67b02e5967095db0443effd.
• Windows 10 1803: 10.0.17134.1130 x64, SHA-256 8ce3b8fe38c23b699f30b045383640019a429d3a9d513285c655bffe03a796d9.

Matching Microsoft public PDB GUIDs/ages were verified in historical/ci-<build>-symbols.json in CodeIntegrity-RE. Public names help map functions; they are not a full typed SDK. The default Domito declarations remain conservative. See current contracts and limits and implementation status for ABI and runtime work.