Public/VeraCrypt
1
0
Fork 0
mirror of https://github.com/veracrypt/VeraCrypt.git synced 2025-11-11 19:08:26 -06:00
Code Activity

Windows: Fix failure to access EFS data on VeraCrypt volumes under Windows 10 but supporting undocumented IOCTL.

Browse Source
This commit is contained in:
Mounir IDRASSI
2016-10-08 19:00:02 +02:00
parent 2a10640f42
commit 0ac4009720
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Common/Apidrvr.h
View File

@@ -124,6 +124,8 @@
#define TC_IOCTL_LEGACY_GET_DRIVER_VERSION 466968 #define TC_IOCTL_LEGACY_GET_DRIVER_VERSION 466968
#define TC_IOCTL_LEGACY_GET_MOUNTED_VOLUMES 466948 #define TC_IOCTL_LEGACY_GET_MOUNTED_VOLUMES 466948
// Undocumented IOCTL sent by Windows 10 when handling EFS data on volumes
#define IOCTL_UNKNOWN_WINDOWS10_EFS_ACCESS 0x455610D8
/* Start of driver interface structures, the size of these structures may /* Start of driver interface structures, the size of these structures may
change between versions; so make sure you first send DRIVER_VERSION to change between versions; so make sure you first send DRIVER_VERSION to

13
src/Driver/Ntdriver.c
View File

@@ -214,7 +214,7 @@ NTSTATUS TCDispatchQueueIRP (PDEVICE_OBJECT DeviceObject, PIRP Irp)
PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (Irp); PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (Irp);
NTSTATUS ntStatus; NTSTATUS ntStatus;
#ifdef _DEBUG #if defined(_DEBUG) || defined (_DEBUG_TRACE)
if (irpSp->MajorFunction == IRP_MJ_DEVICE_CONTROL && (Extension->bRootDevice || Extension->IsVolumeDevice)) if (irpSp->MajorFunction == IRP_MJ_DEVICE_CONTROL && (Extension->bRootDevice || Extension->IsVolumeDevice))
{ {
switch (irpSp->Parameters.DeviceIoControl.IoControlCode) switch (irpSp->Parameters.DeviceIoControl.IoControlCode)
@@ -896,6 +896,15 @@ NTSTATUS ProcessVolumeDeviceControlIrp (PDEVICE_OBJECT DeviceObject, PEXTENSION
} }
break; break;
case IOCTL_UNKNOWN_WINDOWS10_EFS_ACCESS:
// This undocumented IOCTL is sent when handling EFS data
// We must return success otherwise EFS operations fail
Dump ("ProcessVolumeDeviceControlIrp (unknown IOCTL 0x%.8X, OutputBufferLength = %d). Returning fake success\n", irpSp->Parameters.DeviceIoControl.IoControlCode, (int) irpSp->Parameters.DeviceIoControl.OutputBufferLength);
Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = 0;
break;
default: default:
Dump ("ProcessVolumeDeviceControlIrp (unknown code 0x%.8X)\n", irpSp->Parameters.DeviceIoControl.IoControlCode); Dump ("ProcessVolumeDeviceControlIrp (unknown code 0x%.8X)\n", irpSp->Parameters.DeviceIoControl.IoControlCode);
return TCCompleteIrp (Irp, STATUS_INVALID_DEVICE_REQUEST, 0); return TCCompleteIrp (Irp, STATUS_INVALID_DEVICE_REQUEST, 0);
@@ -2071,7 +2080,7 @@ void TCGetDosNameFromNumber (LPWSTR dosname,int cbDosName, int nDriveNo, DeviceN
RtlStringCbCatW (dosname, cbDosName, tmp); RtlStringCbCatW (dosname, cbDosName, tmp);
} }
#ifdef _DEBUG #if defined(_DEBUG) || defined (_DEBUG_TRACE)
LPWSTR TCTranslateCode (ULONG ulCode) LPWSTR TCTranslateCode (ULONG ulCode)
{ {
switch (ulCode) switch (ulCode)