nefarius
3fbfe31d15
Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style. Add CI validation helpers with explicit signature selection and owned results Document runtime-confirmed CI signer selection and crypto reuse Expand CI compatibility matrix to twenty verified samples Extend CI export matrix with Windows 11 x64 and ARM64 samples Document CI API availability and historical mincrypt layouts Add explicit Authenticode workflows and correct CI helper contracts Document CI validation flag 0x20 and add kernel probe Harden CI digest parsing and failure cleanup
72 lines
2.4 KiB
Python
72 lines
2.4 KiB
Python
"""Production consumer helpers with real CNG/Crypt32 and deterministic kernel doubles."""
|
|
|
|
from pathlib import Path
|
|
import subprocess
|
|
import tempfile
|
|
|
|
root = Path(__file__).resolve().parents[1]
|
|
public = (root / "include/Domito.h").read_text(encoding="utf-8-sig")
|
|
mincrypt = (root / "include/Domito.MinCrypt.h").read_text(encoding="utf-8-sig")
|
|
structures = mincrypt[
|
|
mincrypt.index("#include <pshpack8.h>") : mincrypt.index("#include <poppack.h>")
|
|
+ len("#include <poppack.h>")
|
|
]
|
|
validation = public[
|
|
public.index("#if (NTDDI_VERSION >= NTDDI_WIN10)\n// Native forwards") : public.index(
|
|
"#define DOMITO_CI_SOURCE_EMBEDDED"
|
|
)
|
|
]
|
|
helpers = (
|
|
(root / "include/Domito.Consumer.h")
|
|
.read_text(encoding="utf-8-sig")
|
|
.replace('#include "Domito.h"', "")
|
|
)
|
|
algorithm = public[
|
|
public.index("#if !defined(CALG_SHA1)") : public.index(
|
|
"/*", public.index("DOMITO_CALG_TO_BCRYPT_ALGORITHM(")
|
|
)
|
|
]
|
|
common = (root / "src/Domito.cpp").read_text(encoding="utf-8-sig")
|
|
process_start = common.rfind("_Success_", 0, common.index("DomitoGetProcessImageName("))
|
|
process = (
|
|
common[process_start:]
|
|
.replace('#pragma code_seg("PAGED")', "")
|
|
.replace("#pragma code_seg()", "")
|
|
)
|
|
with tempfile.TemporaryDirectory(prefix="domito-consumer-tests-") as temp:
|
|
build = Path(temp)
|
|
(build / "consumer-api.inc").write_text(
|
|
algorithm + "\n" + structures + "\n" + validation + "\n" + helpers
|
|
)
|
|
bodies = "\n".join(
|
|
(root / ("src/" + name))
|
|
.read_text(encoding="utf-8-sig")
|
|
.replace('#include "Domito.Internal.h"', "")
|
|
for name in ["Domito.Certificate.cpp", "Domito.Consumer.cpp"]
|
|
)
|
|
(build / "consumer-under-test.inc").write_text(bodies + "\n" + process)
|
|
for branch in ["x64", "other"]:
|
|
exe = build / (branch + ".exe")
|
|
flags = ["/DDOMITO_TEST_OTHER_ARCH"] if branch == "other" else []
|
|
subprocess.run(
|
|
[
|
|
"cl",
|
|
"/nologo",
|
|
"/EHsc",
|
|
"/W4",
|
|
"/WX",
|
|
"/std:c++17",
|
|
"/I" + str(build),
|
|
*flags,
|
|
str(root / "tests/consumer-helper-tests.cpp"),
|
|
"/Fe" + str(exe),
|
|
"/Fo" + str(build / (branch + ".obj")),
|
|
"/link",
|
|
"bcrypt.lib",
|
|
"crypt32.lib",
|
|
],
|
|
cwd=build,
|
|
check=True,
|
|
)
|
|
subprocess.run([str(exe)], check=True)
|