mirrors/VeraCrypt
1
0
Fork 0
mirror of https://github.com/veracrypt/VeraCrypt.git synced 2026-09-29 03:05:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Windows: make EFI trust checks dbx-aware

Browse Source 
Reject revoked loader CA sets and diagnose the chainloaded Windows manager. Add PCA 2011 migration warnings and update Secure Boot guidance.
This commit is contained in:
Mounir IDRASSI
2026-07-13 22:54:49 +09:00
parent fdd8d77e7c
commit 301496c7e2
55 changed files with 1033 additions and 245 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Translations/Language.vi.xml
+3 -2
View File
@@ -1688,8 +1688,9 @@
<entry lang="vi" key="SYSENC_EFI_UNSUPPORTED_SECUREBOOT_CA">Secure Boot đang được bật, nhưng cơ sở dữ liệu Secure Boot của chương trình cơ sở không tin cậy bất kỳ bộ Microsoft UEFI CA nào được bộ tải khởi động EFI của VeraCrypt hỗ trợ. Hãy bật Microsoft Corporation UEFI CA 2011, hoặc bật cả Microsoft UEFI CA 2023 và Microsoft Option ROM UEFI CA 2023, sau đó chạy tùy chọn Sửa chữa/Cài đặt lại của VeraCrypt. Hoặc, hãy tắt Secure Boot.</entry>
<entry lang="vi" key="MACOSX_CHECK_FILESYS">Một cửa sổ Terminal sẽ mở sau khi bạn bấm 'Đồng ý' và kiểm tra hệ thống tập tin trên tập đĩa VeraCrypt đã chọn bằng 'diskutil'. Kết quả sẽ được hiển thị trong cửa sổ đó.\n\nNếu không thể bắt đầu kiểm tra, Tiện ích Ổ đĩa sẽ được khởi chạy thay thế.</entry>
<entry lang="vi" key="MACOSX_REPAIR_FILESYS">Một cửa sổ Terminal sẽ mở sau khi bạn bấm 'Đồng ý' và thử sửa chữa hệ thống tập tin trên tập đĩa VeraCrypt đã chọn bằng 'diskutil'. Kết quả sẽ được hiển thị trong cửa sổ đó.\n\nNếu không thể bắt đầu sửa chữa, Tiện ích Ổ đĩa sẽ được khởi chạy thay thế.</entry>
<entry lang="en" key="SYSENC_EFI_LOADER_NOT_TRUSTED_BY_SECUREBOOT">Warning: Secure Boot is enabled, but the Microsoft UEFI CA that signs the installed VeraCrypt EFI bootloader was not found in the firmware Secure Boot database (db). The firmware may refuse to start VeraCrypt at the next reboot, so Windows will not start until Secure Boot is disabled or the trusted certificates/loader set are repaired.\n\nBefore restarting this computer, do not disable or remove Microsoft Corporation UEFI CA 2011 unless the firmware db contains both Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023 and VeraCrypt has been repaired/reinstalled so the 2023-signed loader set is installed. Enable the required Microsoft certificates in the BIOS/UEFI settings if needed, then run VeraCrypt Repair/Reinstall. Make sure you have an up-to-date VeraCrypt Rescue Disk before restarting.</entry>
<entry lang="en" key="SYSENC_EFI_WINDOWS_LOADER_NOT_TRUSTED_BY_SECUREBOOT">Warning: Secure Boot is enabled, but the Microsoft CA that signs the Windows Boot Manager copy used by VeraCrypt (bootmgfw_ms.vc) was not found in the firmware Secure Boot database (db). After successful pre-boot authentication, the handoff to Windows may fail and the computer may return to the VeraCrypt password prompt.\n\nBefore restarting this computer, do not disable or revoke Microsoft Windows Production PCA 2011 unless Windows Boot Manager has migrated to a Windows UEFI CA 2023-signed version and the firmware db contains Windows UEFI CA 2023. Apply the Windows Secure Boot certificate updates, then run VeraCrypt Repair/Reinstall if needed. Make sure you have an up-to-date VeraCrypt Rescue Disk before restarting.</entry>
<entry lang="en" key="SYSENC_EFI_LOADER_NOT_TRUSTED_BY_SECUREBOOT">Warning: VeraCrypt could not validate the installed EFI bootloader files against one complete embedded resource set and confirm that all known required signing CAs are present in db and not listed by dbx. Firmware may reject VeraCrypt when Secure Boot is enabled.\n\nBefore booting with Secure Boot enabled, restore the required Microsoft certificates and current dbx as needed, then run VeraCrypt Repair/Reinstall. Do not remove Microsoft Corporation UEFI CA 2011 until db contains both Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023 and the actual installed files match VeraCrypt's 2023 set. This check cannot model every image-hash or security-version revocation. Make sure you have an up-to-date VeraCrypt Rescue Disk.</entry>
<entry lang="en" key="SYSENC_EFI_WINDOWS_LOADER_NOT_TRUSTED_BY_SECUREBOOT">Warning: VeraCrypt could not validate the embedded signature and known-CA compatibility of the Windows Boot Manager it chainloads (bootmgfw_ms.vc). The file may be missing, unreadable, not a Windows Boot Manager, have an unrecognized embedded signer, or use a known signing CA that is absent from db or listed by dbx. The handoff to Windows may fail when Secure Boot is enabled.\n\nComplete or repair the Windows Secure Boot certificate and boot-manager update, keep the VeraCrypt System Favorites service enabled, and run VeraCrypt Repair/Reinstall. Repair also checks Windows' serviced EFI_EX/EFI copies for a compatible current Boot Manager. If Windows cannot start, temporarily disable Secure Boot to recover. Make sure you have an up-to-date VeraCrypt Rescue Disk.</entry>
<entry lang="en" key="SYSENC_EFI_WINDOWS_LOADER_PCA2011_MIGRATION_NEEDED">Warning: The embedded signature of the Windows Boot Manager used by VeraCrypt (bootmgfw_ms.vc) is still issued by Microsoft Windows Production PCA 2011, although firmware db already contains Windows UEFI CA 2023. Its known CA is currently allowed, but it will no longer start after the PCA 2011 certificate is added to dbx.\n\nDo not apply the PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280) yet. First complete the Windows 2023 boot-manager update while the VeraCrypt System Favorites service is enabled, then run VeraCrypt Repair/Reinstall so VeraCrypt can import a compatible serviced EFI_EX/EFI copy. Verify the embedded issuer of bootmgfw_ms.vc is Windows UEFI CA 2023 and make sure you have an up-to-date VeraCrypt Rescue Disk.</entry>
</localization>
<xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
<xs:element name="VeraCrypt">