@@ -3963,6 +3963,326 @@ typedef struct _SYSTEM_HANDLECOUNT_INFORMATION
39633963 ULONG HandleCount ;
39643964} SYSTEM_HANDLECOUNT_INFORMATION , * PSYSTEM_HANDLECOUNT_INFORMATION ;
39653965
3966+ #pragma region RUNTIME_REPORT_HEADER
3967+
3968+ #ifndef RUNTIME_REPORT_PACKAGE_MAGIC
3969+
3970+ #define RUNTIME_REPORT_PACKAGE_MAGIC 0x52545250 // = "RTRP"
3971+ #define RUNTIME_REPORT_PACKAGE_VERSION_CURRENT (1)
3972+ #define RUNTIME_REPORT_NONCE_SIZE 32
3973+ #define RUNTIME_REPORT_DIGEST_MAX_SIZE 64
3974+ #define RUNTIME_REPORT_SIGNATURE_SCHEME_SHA512_RSA_PSS_SHA512 (1)
3975+
3976+ //
3977+ // Runtime Report Type Enumeration
3978+ //
3979+
3980+ typedef enum _RUNTIME_REPORT_TYPE
3981+ {
3982+ RuntimeReportTypeDriver = 0 ,
3983+ RuntimeReportTypeCodeIntegrity = 1 ,
3984+ RuntimeReportTypeMax
3985+ } RUNTIME_REPORT_TYPE ;
3986+
3987+ //
3988+ // Macro to convert a report type enum value to a bitmap mask
3989+ //
3990+
3991+ #define RUNTIME_REPORT_TYPE_TO_MASK (type ) (1ULL << (type))
3992+
3993+ //
3994+ // Bitmap mask containing all valid report types
3995+ //
3996+
3997+ #define RUNTIME_REPORT_TYPE_MASK_ALL ((1ULL << RuntimeReportTypeMax) - 1)
3998+
3999+ typedef struct _RUNTIME_REPORT_PACKAGE_HEADER
4000+ {
4001+ //
4002+ // Set to RUNTIME_REPORT_PACKAGE_MAGIC = 0x52545250 ("RTRP")
4003+ //
4004+
4005+ ULONG Magic ;
4006+
4007+ //
4008+ // The version of the package format
4009+ //
4010+
4011+ USHORT PackageVersion ;
4012+
4013+ //
4014+ // Number of different report types contained in the package.
4015+ //
4016+
4017+ USHORT NumberOfReports ;
4018+
4019+ //
4020+ // A bitmap of all the report types in the package.
4021+ //
4022+ // Use RUNTIME_REPORT_TYPE_TO_MASK macro to convert enum values to bitmap masks.
4023+ // Current valid report types:
4024+ // RuntimeReportTypeDriver = 0
4025+ // RuntimeReportTypeCodeIntegrity = 1
4026+ //
4027+
4028+ ULONG_PTR ReportTypesBitmap ;
4029+
4030+ //
4031+ // The size of the total package including the package header,
4032+ // various runtime reports, their digests, and the signature blob.
4033+ //
4034+
4035+ ULONG PackageSize ;
4036+
4037+ //
4038+ // The type of digest contained in the report digest headers.
4039+ //
4040+ // Current valid values:
4041+ // CALG_SHA_512 (see wincrypt.h)
4042+ //
4043+
4044+ USHORT ReportDigestType ;
4045+
4046+ //
4047+ // Total size of the signed runtime report digest headers
4048+ // following the package header.
4049+ //
4050+
4051+ USHORT TotalReportDigestsSize ;
4052+
4053+ //
4054+ // Reserved field. Must be set to zero.
4055+ //
4056+
4057+ USHORT Reserved ;
4058+
4059+ //
4060+ // The signature scheme used to sign the runtime reports.
4061+ //
4062+ // Current valid values:
4063+ // RUNTIME_REPORT_SIGNATURE_SCHEME_SHA512_RSA_PSS_SHA512 = 1
4064+ //
4065+
4066+ USHORT SignatureScheme ;
4067+
4068+ //
4069+ // Size of the signature blob following the runtime report digests.
4070+ //
4071+
4072+ ULONG SignatureSize ;
4073+
4074+ //
4075+ // Total size of the authenticated (but unsigned) runtime reports
4076+ // following the signature blob.
4077+ //
4078+
4079+ ULONG TotalAuthenticatedReportsSize ;
4080+
4081+ } RUNTIME_REPORT_PACKAGE_HEADER , * PRUNTIME_REPORT_PACKAGE_HEADER ;
4082+
4083+ typedef struct _RUNTIME_REPORT_DIGEST_HEADER
4084+ {
4085+ //
4086+ // Indicates the type of report that was hashed.
4087+ //
4088+ // Current valid values:
4089+ // RuntimeReportTypeDriver = 0
4090+ // RuntimeReportTypeCodeIntegrity = 1
4091+ //
4092+
4093+ USHORT ReportType ;
4094+
4095+ //
4096+ // Reserved field.
4097+ //
4098+
4099+ USHORT Reserved ;
4100+
4101+ //
4102+ // Digest of the report including the report header.
4103+ // This is a SHA-512 digest.
4104+ //
4105+
4106+ UCHAR ReportDigest [RUNTIME_REPORT_DIGEST_MAX_SIZE ];
4107+
4108+ } RUNTIME_REPORT_DIGEST_HEADER , * PRUNTIME_REPORT_DIGEST_HEADER ;
4109+
4110+ typedef struct _RUNTIME_REPORT_HEADER
4111+ {
4112+ //
4113+ // Indicates the type of report.
4114+ //
4115+ // Current valid values:
4116+ // RuntimeReportTypeDriver = 0
4117+ // RuntimeReportTypeCodeIntegrity = 1
4118+ //
4119+
4120+ USHORT ReportType ;
4121+
4122+ //
4123+ // Reserved field.
4124+ //
4125+
4126+ USHORT Reserved ;
4127+
4128+ //
4129+ // The number of bytes consumed by this report, including the header.
4130+ //
4131+
4132+ ULONG ReportSize ;
4133+
4134+ } RUNTIME_REPORT_HEADER , * PRUNTIME_REPORT_HEADER ;
4135+
4136+ //
4137+ // Driver Report Definitions
4138+ //
4139+
4140+ #define DRIVER_REPORT_DIGEST_MAX_SIZE RUNTIME_REPORT_DIGEST_MAX_SIZE
4141+ #define DRIVER_REPORT_NAME_MAX_LENGTH 32
4142+
4143+ typedef struct _DRIVER_INFO_ENTRY
4144+ {
4145+ //
4146+ // Internal name of the driver from the resource section.
4147+ //
4148+
4149+ CHAR InternalName [DRIVER_REPORT_NAME_MAX_LENGTH ];
4150+
4151+ //
4152+ // Hash algorithm used to calculate the image digest.
4153+ //
4154+
4155+ USHORT ImageHashAlgorithm ;
4156+
4157+ //
4158+ // Hash algorithm used to calculate the thumbprint of the leaf certificate
4159+ // that validates the entire image.
4160+ //
4161+
4162+ USHORT PublisherThumbprintHashAlgorithm ;
4163+
4164+ //
4165+ // Offset from the start of the driver report to a buffer containing the
4166+ // digest of the driver image on disk.
4167+ //
4168+
4169+ ULONG ImageHashOffset ;
4170+
4171+ //
4172+ // Offset from the start of the driver report to a buffer containing the
4173+ // thumbprint of the leaf certificate validating the entire image
4174+ //
4175+
4176+ ULONG PublisherThumbprintOffset ;
4177+
4178+ //
4179+ // Number of times that this driver image has been loaded into the system.
4180+ //
4181+
4182+ USHORT NumberOfLoadingTimes ;
4183+
4184+ //
4185+ // Size and Offset of a string indicating the OEM name stored in the
4186+ // authenticated OPUS block of the image digital signature.
4187+ // There is no OEM name for inbox Windows signed drivers. The size does *NOT*
4188+ // include the NULL terminator (even though the string is NULL-terminated).
4189+ //
4190+
4191+ USHORT OemNameSize ;
4192+ ULONG OemNameOffset ;
4193+
4194+ //
4195+ // Flags indicating various properties of the current driver image:
4196+ // - Unloaded - Set to 1 in case the driver is current unloaded.
4197+ //
4198+ // - BootDriver - Set to 1 in case the image is a Boot Driver;
4199+ // 0 otherwise (the image is a Runtime driver).
4200+ //
4201+ // - HotPatch - Set to 1 in case the image can be also loaded as Hotpatch;
4202+ //
4203+ // - Reserved - Reserved flags bits.
4204+ //
4205+
4206+ union
4207+ {
4208+ struct
4209+ {
4210+ USHORT Unloaded : 1 ;
4211+ USHORT BootDriver : 1 ;
4212+ USHORT HotPatch : 1 ;
4213+ USHORT Reserved : 13 ;
4214+ };
4215+ USHORT AsUInt16 ;
4216+ } Flags ;
4217+
4218+ USHORT Padding ;
4219+ } DRIVER_INFO_ENTRY , * PDRIVER_INFO_ENTRY ;
4220+
4221+ typedef struct _DRIVER_RUNTIME_REPORT
4222+ {
4223+ //
4224+ // The driver runtime report header.
4225+ //
4226+
4227+ RUNTIME_REPORT_HEADER Header ;
4228+
4229+ //
4230+ // The current number of unique drivers in the report.
4231+ //
4232+
4233+ USHORT NumberOfDrivers ;
4234+
4235+ //
4236+ // Flags indicating various properties of the report:
4237+ // - ReportOverflowed - Secure Kernel places a limit on the number of
4238+ // drivers it can list in the report. If this is set, it indicates
4239+ // that some loaded drivers might be missing from the report.
4240+ //
4241+ // - PartialReport - Indicates whether the report contains only a
4242+ // subset of NT loaded drivers.
4243+ //
4244+ // - IncludeBootDrivers - Set to 1 in case the report includes
4245+ // boot-loaded drivers; 0 otherwise (in that case the information
4246+ // is stored in the TCG Log).
4247+ //
4248+ // - Reserved - Reserved flags bits.
4249+ //
4250+
4251+ union
4252+ {
4253+ struct
4254+ {
4255+ USHORT ReportOverflowed : 1 ;
4256+ USHORT PartialReport : 1 ;
4257+ USHORT IncludeBootDrivers : 1 ;
4258+ USHORT Reserved : 13 ;
4259+ };
4260+ USHORT AsUInt16 ;
4261+ } Flags ;
4262+
4263+ //
4264+ // A list, of size zero up to MaximumDriversRecorded, containing driver entries.
4265+ // Unloaded drivers are not removed from the list.
4266+ //
4267+
4268+ DRIVER_INFO_ENTRY DriverEntries [ANYSIZE_ARRAY ];
4269+
4270+ //
4271+ // After the driver info array the driver runtime report store hashes,
4272+ // strings and information that are dynamic in size.
4273+ //
4274+ // BYTE DynamicBuffer[ANYSIZE_ARRAY];
4275+ //
4276+ // The dynamic buffer, for each driver is composed off:
4277+ // ImageHash - PublisherHash - OemName.
4278+ //
4279+
4280+ } DRIVER_RUNTIME_REPORT , * PDRIVER_RUNTIME_REPORT ;
4281+
4282+ #endif
4283+
4284+ #pragma endregion TODO: Remove this block when GitHub Action Update Windows SDK, this will be defined in winnt.h
4285+
39664286//
39674287// Code Integrity Report Definitions.
39684288//
0 commit comments