mirrors/VeraCrypt
1
0
Fork 0
mirror of https://github.com/veracrypt/VeraCrypt.git synced 2026-09-28 18:55:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Windows: warn when Secure Boot stops trusting the boot chain

Browse Source 
Track Microsoft Windows Production PCA 2011 and Windows UEFI CA 2023 in the firmware db parser so the trust of the chainloaded Windows boot manager copy (bootmgfw_ms.vc) can be verified.

Add BootEncryption::GetEfiBootChainTrustStatus to check the installed VeraCrypt loader set and the bootmgfw_ms.vc signer against the active Secure Boot db, asserting nothing from malformed or partial firmware data.

Warn before reboot during Setup upgrade/repair and log a System Favorites service event when a boot chain component is no longer trusted, so Secure Boot certificate changes surface in Windows instead of as a pre-boot failure.

Refs #1655.
This commit is contained in:
Mounir IDRASSI
2026-07-07 13:14:31 +09:00
parent 48f8d87418
commit 7f24d98db2
48 changed files with 354 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Translations/Language.fa.xml
+2
View File
@@ -1688,6 +1688,8 @@
<entry lang="fa" key="SYSENC_EFI_UNSUPPORTED_SECUREBOOT_CA">Secure Boot فعال است، اما پایگاه داده Secure Boot در میان‌افزار به هیچ مجموعه Microsoft UEFI CA که توسط بوت‌لودر EFI وراکریپت پشتیبانی می‌شود اعتماد ندارد. یا Microsoft Corporation UEFI CA 2011 را فعال کنید، یا هر دو Microsoft UEFI CA 2023 و Microsoft Option ROM UEFI CA 2023 را فعال کنید، سپس گزینه Repair/Reinstall را در VeraCrypt اجرا کنید. همچنین می‌توانید Secure Boot را غیرفعال کنید.</entry>
<entry lang="fa" key="MACOSX_CHECK_FILESYS">پس از فشار دادن 'قبول'، یک پنجره Terminal باز می‌شود و فایل سیستم حجم VeraCrypt انتخاب‌شده را با استفاده از 'diskutil' بررسی می‌کند. نتیجه در همان پنجره نمایش داده می‌شود.\n\nاگر بررسی قابل شروع نباشد، به‌جای آن Disk Utility اجرا خواهد شد.</entry>
<entry lang="fa" key="MACOSX_REPAIR_FILESYS">پس از فشار دادن 'قبول'، یک پنجره Terminal باز می‌شود و تلاش می‌کند فایل سیستم حجم VeraCrypt انتخاب‌شده را با استفاده از 'diskutil' تعمیر کند. نتیجه در همان پنجره نمایش داده می‌شود.\n\nاگر تعمیر قابل شروع نباشد، به‌جای آن Disk Utility اجرا خواهد شد.</entry>
<entry lang="en" key="SYSENC_EFI_LOADER_NOT_TRUSTED_BY_SECUREBOOT">Warning: Secure Boot is enabled, but the Microsoft UEFI CA that signs the installed VeraCrypt EFI bootloader was not found in the firmware Secure Boot database (db). The firmware may refuse to start VeraCrypt at the next reboot, so Windows will not start until Secure Boot is disabled or the trusted certificates/loader set are repaired.\n\nBefore restarting this computer, do not disable or remove Microsoft Corporation UEFI CA 2011 unless the firmware db contains both Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023 and VeraCrypt has been repaired/reinstalled so the 2023-signed loader set is installed. Enable the required Microsoft certificates in the BIOS/UEFI settings if needed, then run VeraCrypt Repair/Reinstall. Make sure you have an up-to-date VeraCrypt Rescue Disk before restarting.</entry>
<entry lang="en" key="SYSENC_EFI_WINDOWS_LOADER_NOT_TRUSTED_BY_SECUREBOOT">Warning: Secure Boot is enabled, but the Microsoft CA that signs the Windows Boot Manager copy used by VeraCrypt (bootmgfw_ms.vc) was not found in the firmware Secure Boot database (db). After successful pre-boot authentication, the handoff to Windows may fail and the computer may return to the VeraCrypt password prompt.\n\nBefore restarting this computer, do not disable or revoke Microsoft Windows Production PCA 2011 unless Windows Boot Manager has migrated to a Windows UEFI CA 2023-signed version and the firmware db contains Windows UEFI CA 2023. Apply the Windows Secure Boot certificate updates, then run VeraCrypt Repair/Reinstall if needed. Make sure you have an up-to-date VeraCrypt Rescue Disk before restarting.</entry>
</localization>
<xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
<xs:element name="VeraCrypt">