Use generic-icon for .hc and .tc MIME types so GTK/Adwaita selects the
VeraCrypt icon from hicolor instead of its generic file icon.
Based on PR #1260 by Joey Riches, with generic-icon suggested by
Jertzukka.
Co-authored-by: Joey Riches <josephriches@gmail.com>
Co-authored-by: Jertzukka <Jertzukka@gmail.com>
Traverse menu items and submenus instead of scanning consecutive IDs, so
missing translations cannot block later commands.
Preserve item state and custom labels, and retain popup localization and
Homepage alignment.
The main menu is localized by looking up command IDs in the language
dictionary from 40001 upwards, stopping at the first ID without an
entry. An ID has an entry when its name in the embedded Resource.h
matches a string key.
40069 was defined as IDM_MOUNIT_NO_CACHE, while its string key is
IDM_MOUNT_NO_CACHE, so the loop stopped there. As a result,
IDM_REPAIR_EFI_BOOT_LOADER (40070) was never localized and appeared
in English in every language, although all translations include it.
Rename the define to match its string key. The Mount button menu item
that uses this ID already takes its text from GetString and is
unchanged.
The Pre-Boot check box, shown in the Benchmark dialog when KDF is
selected, appears in English in every language. LocalizeDialog
translates a control when its ID name matches a string key, and there
is no IDC_BENCHMARK_PREBOOT string. Its text was added with the check
box in 2016 as PRE-BOOT, which is not used anywhere. Every language
file includes it, and 40 of the 42 translate it.
Set the check box text from PRE-BOOT after the dialog is localized.
No language files change.
Wipe keyfile buffers before reporting errors and releasing storage.
Handle allocation failures during Windows token import.
Preserve EMV session caching to avoid repeated card resets and reads.
Clarify cache lifetimes and release token labels when dialogs close.
Fix reader ownership during EMV card moves.
Use the new signing identity and Keychain profiles.
Verify hardened runtime and packaged binaries before submission.
Stop on failures and isolate outputs to prevent stale uploads.
* Windows: flush shell notifications when dismounting with /q
* Windows: limit the /q notification flush to the command line dismount
ProcessExitsAfterCommand was set while parsing /q and stayed set when
the process went on as the background task (/q background, and
/q preferences, which is also used at logon). Later interactive
dismounts, automatic dismounts through DismountAll and the hotkeys then
flushed as well, which would also delay the cache wipe that the force
dismount and wipe hotkeys issue after DismountAll.
Set the flag only for the dismount requested on the command line and
clear it right after, whatever Silent is. Rename it to
FlushDriveRemovalNotifications, as /q doesn't necessarily end the
process.
Reword the comments: according to the documentation, SHCNF_FLUSH makes
SHChangeNotify return once the notification has been delivered, which
doesn't mean that Explorer has finished updating its display, and the
cause of the reported ghost drive letters hasn't been established.
Free the key-info buffer and owned crypto context on pre-KDF errors,
preserving borrowed contexts and avoiding uninitialized drain resources.
Inject every setup allocation and event failure to verify cleanup.
Record cloning, formatting and allocation failures without allocating, then
complete and drain the request before reporting an error. This prevents
worker loss and avoids treating incomplete cipher or KDF output as valid.
Test ordinary exceptions, capture failures and subsequent pool recovery.
Retain accepted callers and KDF workers until completion, and run later
requests synchronously. Clear joined threads and unwind partial startup
so serialized restarts do not retain stale workers.
Cover shutdown boundaries and startup failures with gated tests.
Serialize updates to the shared exception pointer and retain the first
reported error. Test concurrent failures through all three handlers,
exception cleanup and subsequent successful work.
Close admission and retain references for accepted requests, KDF workers
and submitters until they stop using pool resources. Run new work
synchronously while stopping, then join workers and release handles.
Test queued work, delayed requester wakeup, fallback and restart.
Join created workers and release allocated handles when startup fails before
the pool is published. Close worker handles on normal shutdown as well.
Test each startup allocation failure and subsequent restart.
Hold a requester reference until header parsing can no longer enqueue KDFs.
This prevents stale completion signals from allowing cleanup while workers
still use request-owned state.
Add bounded tests of the production pool and caller completion protocol.
Capture the parent before releasing a fragment slot on Windows and Unix.
This removes the completion code's dependency on the first-fragment slot
holding up the ring until the requester observes completion.
Use per-context software SHA-256/SHA-512 after a failed state save
without changing global dispatch. Return an error and clear Argon2's
output before its accelerated core can run.
Tests/response_apdu_test.cpp was not run by any workflow. Build and run
it in the Linux workflow before the packages are built, and start the
workflow when the test changes. Changes to the code it covers already
start it.
An empty language file made VeraCrypt access the first element of an
empty vector, and any language file without a language element crashed
it at startup, when LanguageStrings::Init took the first element of an
empty node list. A file with an unterminated tag made initialization
fail instead, so VeraCrypt could not start until the preferences file
was edited. Read the file only if it is not empty, and ignore a
language file that cannot be parsed or has no language element, keeping
the built-in English strings.
Also fall back when the optional language file cannot be opened or
read completely. Catch I/O failures at the resource loader, leaving
preference-loading errors outside the handler.
LoadFile read the file size with GetFileSize without its high-order
part, so a file of 4 GiB or more was loaded as if it were only as large
as its size modulo 4 GiB, without any error. Refuse such files with
ERROR_FILE_TOO_LARGE instead.
ApduProcessData sent GET RESPONSE for as long as the card answered
0x61XX, allowing an endless loop and unbounded response growth. Limit
each chain to 256 follow-up commands and erase the partial response
if the limit is exceeded.
PSE directory enumeration had a separate unbounded loop with an
eight-bit record counter. Read only records 1 through 254, stop on an
empty or unsuccessful response, and limit the accumulated directory
data to 254 short records before parsing. Malformed TLV responses
consume this budget too, so they cannot bypass either limit.
EMVToken::EMVCards keeps every EMV card that was read, together with
the ICC and issuer public key certificates and the CPLC data that make
up its keyfile, and keeps the card connected. Closing all security
token sessions, the option to close them after mounting and wiping the
cache on auto-dismount only closed PKCS#11 sessions, so this data
stayed in memory until VeraCrypt exited.
Add Token::CloseAllSessions, which also releases the cached cards so
that their data is erased and their connection closed, and use it
wherever all sessions are closed. This resolves the "TODO Use Token"
notes at these call sites on Windows.
Keep the EMV cache private and serialize reader enumeration, card reads,
and cache cleanup with the same mutex. Closing sessions waits for active
reads to release their local card references before erasing the cache,
so a read cannot race destruction or insert its card after cleanup.
PCSCException::Show on Windows was derived from the PKCS#11 version
but kept its trailing %s without the matching argument, so any PC/SC
error without a message of its own was formatted from a missing
argument. Remove the extra conversion.
Both platforms label these errors with PCSC_ERROR, which no language
file defined, so users saw a placeholder such as ?PCSC_ERROR? instead.
Append the English text to all language files as a fallback.
Unknown codes were printed in decimal after a 0x prefix. Print them in
hexadecimal, as Pkcs11Exception does.
Token::getTokenKeyfile returned null for a path that is neither a
PKCS#11 nor an EMV token path, and every caller dereferenced the
result. Keyfile application validates the path beforehand, but the
text-mode export does not, so entering an ordinary file path at the
--export-token-keyfile prompt crashed VeraCrypt. Throw
InvalidSecurityTokenKeyfilePath instead, which the user interfaces
already report.
Use a single file-length measurement for both the non-empty check
and the vector allocation in GUI and text token imports. Reject
lengths exceeding vector::max_size before converting to size_t,
while retaining the cleanup guard before reading.
EMV keyfile cleanup did not cover APDU response storage, temporary
copies, or transport buffers on exceptions. Wipe responses on clear,
replacement, destruction and growth, avoid redundant response and PAN
copies, and install transport cleanup guards before use.
Add standalone checks for erasure before release, aliasing, allocation
failures, exception unwinding and const TLV input.
BufferPtr::Erase() previously delegated to Zero()/memset even though
its current callers use it to wipe sensitive data. Expand burn()
directly in the inline Erase implementation, matching VeraCrypt's
established erasure design without adding an out-of-line wrapper.
Install vector-referencing cleanup guards before token keyfile reads
and fetches in the four GUI and text-mode import/export paths. This
ensures partially populated data is wiped when an operation throws
and avoids retaining a stale BufferPtr if the vector reallocates.
Reject empty token exports before accessing vector::front().
Memory::Zero(), Buffer::Erase(), and the existing password guards
remain unchanged.
Co-authored-by: Damian Rickard <damian@rickard.us>
Remove obsolete MFC prerequisites and replace outdated assembler images
with version checks. Clarify release configurations, Spectre libraries,
and signing instructions.
Verified the guide end-to-end on a clean Windows 11 + VS2022 Community
17.14 machine (Release|x64 and Release|Win32 both build with 0 errors).
Fixes for the issues found along the way:
- Recommend a current NASM release instead of 2.08 (2010); NASM 2.16.03
verified against all assembly sources. Fix the Path example for the
64-bit installer location.
- Simplify YASM setup: the build only invokes yasm.exe from the Path.
Drop the zip/vsyasm download and the YASMPATH system variable, which
nothing in the build references.
- Add a "Common build errors" section to Known Issues mapping the three
errors every default VS2022 install hits (MSB8040 Spectre libs, C1083
atlbase.h, MSB8066 exit 9009) to the components that fix them.
- Explain why the Release|Win32 pass is needed (Setup/Portable/COMReg
are only built by that configuration).
Addresses #1488.
Co-authored-by: 0xDarkMatter <0xDarkMatter@users.noreply.github.com>
Use the Windows SDK winres.h header in Driver.rc and its resource-editor
metadata. Remove the obsolete MFC include-path override from the legacy
driver build script.
Check wrapper type alignment in both test suites so incidental alignment
can't hide an empty CRYPTOPP_ALIGN_DATA, including in ASan builds.
Clarify that the compiler may fold the existing address checks.
The macro falls through to an empty definition for the MSVC bootloader build
(TC_WINDOWS_BOOT) and for compilers that are neither MSVC nor GCC/Clang. The
ks and ks2 members of CRYPTO_INFO are compiled into the bootloader and are
declared with it, so the caveat is reachable.
The macro expands to nothing for compilers that are neither MSVC nor
GCC/Clang, and the SIMD backends issue aligned loads against buffers declared
with it, so a silent expansion to nothing would fault at run time. Nothing
verified this so far.
Add TC_IS_ALIGNED next to the existing alignment constants and check both of
them from the platform self-test suites. The probe buffers stay below the
alignment under test because the ABI already aligns larger objects by itself,
which would make the check pass vacuously.
The check is skipped in the Windows driver: a failing self-test there reaches
TC_BUG_CHECK and would bugcheck the machine.
Marius KjærstadandGitHub
amail80andGitHub
Mounir IDRASSI
Aldo LatinoandGitHub
PatriccolluandGitHub
nkh0472andGitHub
MatthaiksandGitHub
Jonatan NybergandGitHub
Bernard LadenthinandGitHub