Public/VeraCrypt
1
0
Fork 0
mirror of https://github.com/veracrypt/VeraCrypt.git synced 2026-08-22 12:08:54 -05:00
Code Activity

Windows: warn when Secure Boot stops trusting the boot chain

Browse Source 
Track Microsoft Windows Production PCA 2011 and Windows UEFI CA 2023 in the firmware db parser so the trust of the chainloaded Windows boot manager copy (bootmgfw_ms.vc) can be verified.

Add BootEncryption::GetEfiBootChainTrustStatus to check the installed VeraCrypt loader set and the bootmgfw_ms.vc signer against the active Secure Boot db, asserting nothing from malformed or partial firmware data.

Warn before reboot during Setup upgrade/repair and log a System Favorites service event when a boot chain component is no longer trusted, so Secure Boot certificate changes surface in Windows instead of as a pre-boot failure.

Refs #1655.
This commit is contained in:
Mounir IDRASSI
2026-07-07 13:14:31 +09:00
parent 48f8d87418
commit 7f24d98db2
48 changed files with 354 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Mount/Mount.c
+40
View File
@@ -10827,6 +10827,22 @@ static void SystemFavoritesServiceLogInfo (const wstring &infoMessage)
SystemFavoritesServiceLogMessage (infoMessage, EVENTLOG_INFORMATION_TYPE);
}
static bool IsUnsupportedEfiSecureBootDbException (const ErrorException &e)
{
return e.ErrLangId && strcmp (e.ErrLangId, "SYSENC_EFI_UNSUPPORTED_SECUREBOOT_CA") == 0;
}
static void SystemFavoritesServiceLogBootLoaderUpdateError (const wchar_t *operation, const ErrorException &e)
{
if (IsUnsupportedEfiSecureBootDbException (e))
{
SystemFavoritesServiceLogError (wstring (operation) + L" failed: Secure Boot is enabled, but the firmware Secure Boot db does not trust any Microsoft UEFI CA set supported by VeraCrypt. See HKLM\\SOFTWARE\\VeraCrypt\\Diagnostics\\EfiBootLoader for the recorded selection reason.");
return;
}
SystemFavoritesServiceLogError (wstring (operation) + L" failed while updating the boot loader.");
}
static void SystemFavoritesServiceSetStatus (DWORD status, DWORD waitHint = 0)
{
@@ -10884,8 +10900,28 @@ static void SystemFavoritesServiceUpdateLoaderProcessing (BOOL bForce)
SystemFavoritesServiceLogInfo (L"SystemFavoritesServiceUpdateLoaderProcessing: InstallBootLoader calling");
bootEnc.InstallBootLoader (true);
SystemFavoritesServiceLogInfo (L"SystemFavoritesServiceUpdateLoaderProcessing: InstallBootLoader called");
// Record in the event log when the active Secure Boot db no longer trusts a
// component of the boot chain (e.g. after a Secure Boot certificate update),
// so that a subsequent pre-boot failure can be diagnosed from Windows.
try
{
EfiBootChainTrustStatus trustStatus;
if (bootEnc.GetEfiBootChainTrustStatus (trustStatus) && trustStatus.StatusKnown && trustStatus.SecureBootEnabled)
{
if (!trustStatus.VeraCryptLoaderTrusted)
SystemFavoritesServiceLogWarning (L"Secure Boot chain check: the firmware Secure Boot db does not trust the Microsoft UEFI CA that signs the installed VeraCrypt EFI bootloader. Pre-boot authentication may fail at the next reboot.");
else if (trustStatus.WindowsLoaderSignerKnown && !trustStatus.WindowsLoaderTrusted)
SystemFavoritesServiceLogWarning (L"Secure Boot chain check: the firmware Secure Boot db does not trust the Microsoft CA that signs the Windows boot manager copy used by VeraCrypt (bootmgfw_ms.vc). The handoff to Windows after pre-boot authentication may fail at the next reboot.");
}
}
catch (...) { }
}
}
catch (ErrorException &e)
{
SystemFavoritesServiceLogBootLoaderUpdateError (L"SystemFavoritesServiceUpdateLoaderProcessing", e);
}
catch (Exception &)
{
SystemFavoritesServiceLogError (L"SystemFavoritesServiceUpdateLoaderProcessing failed while updating the boot loader.");
@@ -11202,6 +11238,10 @@ int WINAPI wWinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance, wchar_t *lpsz
bootEnc.InstallBootLoader (true);
}
}
catch (ErrorException &e)
{
SystemFavoritesServiceLogBootLoaderUpdateError (L"PostOOBE boot loader update", e);
}
catch (Exception &)
{
SystemFavoritesServiceLogError (L"PostOOBE boot loader update failed.");