Update the FAQ section of the user guide to include TrueCrypt support information.

This reverts commit 154235d589222e3c31cda05aa53e73ab69a89a6e.

License.txt

@@ -0,0 +1,503 @@
+TrueCrypt License Version 3.0
+
+Software distributed under this license is distributed on an "AS
+IS" BASIS WITHOUT WARRANTIES OF ANY KIND. THE AUTHORS AND
+DISTRIBUTORS OF THE SOFTWARE DISCLAIM ANY LIABILITY. ANYONE WHO
+USES, COPIES, MODIFIES, OR (RE)DISTRIBUTES ANY PART OF THE
+SOFTWARE IS, BY SUCH ACTION(S), ACCEPTING AND AGREEING TO BE
+BOUND BY ALL TERMS AND CONDITIONS OF THIS LICENSE. IF YOU DO NOT
+ACCEPT THEM, DO NOT USE, COPY, MODIFY, NOR (RE)DISTRIBUTE THE
+SOFTWARE, NOR ANY PART(S) THEREOF.
+
+
+I. Definitions
+
+1. "This Product" means the work (including, but not limited to,
+source code, graphics, texts, and accompanying files) made
+available under and governed by this version of this license
+("License"), as may be indicated by, but is not limited to,
+copyright notice(s) attached to or included in the work.
+
+2. "You" means (and "Your" refers to) an individual or a legal
+entity (e.g., a non-profit organization, commercial
+organization, government agency, etc.) exercising permissions
+granted by this License.
+
+3. "Modification" means (and "modify" refers to) any alteration
+of This Product, including, but not limited to, addition to or
+deletion from the substance or structure of This Product,
+translation into another language, repackaging, alteration or
+removal of any file included with This Product, and addition of
+any new files to This Product.
+
+4. "Your Product" means This Product modified by You, or any
+work You derive from (or base on) any part of This Product. In
+addition, "Your Product" means any work in which You include any
+(modified or unmodified) portion of This Product. However, if
+the work in which you include it is an aggregate software
+distribution (such as an operating system distribution or a
+cover CD-ROM of a magazine) containing multiple separate
+products, then the term "Your Product" includes only those
+products (in the aggregate software distribution) that use,
+include, or depend on a modified or unmodified version of This
+Product (and the term "Your Product" does not include the whole
+aggregate software distribution). For the purposes of this
+License, a product suite consisting of two or more products is
+considered a single product (operating system distributions and
+cover media of magazines are not considered product suites).
+
+5. "Distribution" means (and "distribute" refers to), regardless
+of means or methods, conveyance, transfer, providing, or making
+available of This/Your Product or portions thereof to third
+parties (including, but not limited to, making This/Your
+Product, or portions thereof, available for download to third
+parties, whether or not any third party has downloaded the
+product, or any portion thereof, made available for download).
+
+
+
+II. Use, Copying, and Distribution of This Product
+
+1. Provided that You comply with all applicable terms and
+conditions of this License, You may make copies of This Product
+(unmodified) and distribute copies of This Product (unmodified)
+that are not included in another product forming Your Product
+(except as permitted under Chapter III). Note: For terms and
+conditions for copying and distribution of modified versions of
+This Product, see Chapter III.
+
+2. Provided that You comply with all applicable terms and
+conditions of this License, You may use This Product freely (see
+also Chapter III) on any number of computers/systems for non-
+commercial and/or commercial purposes.
+
+
+
+III. Modification, Derivation, and Inclusion in Other Products
+
+1. If all conditions specified in the following paragraphs in
+this Chapter (III) are met (for exceptions, see Section III.2)
+and if You comply with all other applicable terms and conditions
+of this License, You may modify This Product (thus forming Your
+Product), derive new works from This Product or portions thereof
+(thus forming Your Product), include This Product or portions
+thereof in another product (thus forming Your Product, unless
+defined otherwise in Chapter I), and You may use (for non-
+commercial and/or commercial purposes), copy, and/or distribute
+Your Product.
+
+    a. The name of Your Product (or of Your modified version of
+    This Product) must not contain the name TrueCrypt (for
+    example, the following names are not allowed: TrueCrypt,
+    TrueCrypt+, TrueCrypt Professional, iTrueCrypt, etc.) nor
+    any other names confusingly similar to the name TrueCrypt
+    (e.g., True-Crypt, True Crypt, TruKrypt, etc.)
+
+    All occurrences of the name TrueCrypt that could reasonably
+    be considered to identify Your Product must be removed from
+    Your Product and from any associated materials. Logo(s)
+    included in (or attached to) Your Product (and in/to
+    associated materials) must not incorporate and must not be
+    confusingly similar to any of the TrueCrypt logos
+    (including, but not limited to, the non-textual logo
+    consisting primarily of a key in stylized form) or
+    portion(s) thereof. All graphics contained in This Product
+    (logos, icons, etc.) must be removed from Your Product (or
+    from Your modified version of This Product) and from any
+    associated materials.
+
+    b. The following phrases must be removed from Your Product
+    and from any associated materials, except the text of this
+    License: "A TrueCrypt Foundation Release", "Released by
+    TrueCrypt Foundation", "This is a TrueCrypt Foundation
+    release."
+
+    c. Phrase "Based on TrueCrypt, freely available at
+    http://www.truecrypt.org/" must be displayed by Your Product
+    (if technically feasible) and contained in its
+    documentation. Alternatively, if This Product or its portion
+    You included in Your Product constitutes only a minor
+    portion of Your Product, phrase "Portions of this product
+    are based in part on TrueCrypt, freely available at
+    http://www.truecrypt.org/" may be displayed instead. In each
+    of the cases mentioned above in this paragraph,
+    "http://www.truecrypt.org/" must be a hyperlink (if
+    technically feasible) pointing to http://www.truecrypt.org/
+    and You may freely choose the location within the user
+    interface (if there is any) of Your Product (e.g., an
+    "About" window, etc.) and the way in which Your Product will
+    display the respective phrase.
+
+    Your Product (and any associated materials, e.g., the
+    documentation, the content of the official web site of Your
+    Product, etc.) must not present any Internet address
+    containing the domain name truecrypt.org (or any domain name
+    that forwards to the domain name truecrypt.org) in a manner
+    that might suggest that it is where information about Your
+    Product may be obtained or where bugs found in Your Product
+    may be reported or where support for Your Product may be
+    available or otherwise attempt to indicate that the domain
+    name truecrypt.org is associated with Your Product.
+
+    d. The complete source code of Your Product must be freely
+    and publicly available (for exceptions, see Section III.2)
+    at least until You cease to distribute Your Product. This
+    condition can be met in one or both of the following ways:
+    (i) You include the complete source code of Your Product
+    with every copy of Your Product that You make and distribute
+    and You make all such copies of Your Product available to
+    the general public free of charge, and/or (ii) You include
+    information (valid and correct at least until You cease to
+    distribute Your Product) about where the complete source
+    code of Your Product can be obtained free of charge (e.g.,
+    an Internet address) or for a reasonable reproduction fee
+    with every copy of Your Product that You make and distribute
+    and, if there is a web site officially associated with Your
+    Product, You include the aforementioned information about
+    the source code on a freely and publicly accessible web
+    page to which such web site links via an easily viewable
+    hyperlink (at least until You cease to distribute Your
+    Product).
+
+    The source code of Your Product must not be deliberately
+    obfuscated and it must not be in an intermediate form (e.g.,
+    the output of a preprocessor). Source code means the
+    preferred form in which a programmer would usually modify
+    the program.
+
+    Portions of the source code of Your Product not contained in
+    This Product (e.g., portions added by You in creating Your
+    Product, whether created by You or by third parties) must be
+    available under license(s) that (however, see also
+    Subsection III.1.e) allow(s) anyone to modify and derive new
+    works from the portions of the source code that are not
+    contained in This Product and to use, copy, and redistribute
+    such modifications and/or derivative works. The license(s)
+    must be perpetual, non-exclusive, royalty-free, no-charge,
+    and worldwide, and must not invalidate, weaken, restrict,
+    interpret, amend, modify, interfere with or otherwise affect
+    any part, term, provision, or clause of this License. The
+    text(s) of the license(s) must be included with every copy
+    of Your Product that You make and distribute.
+
+    e. You must not change the license terms of This Product in
+    any way (adding any new terms is considered changing the
+    license terms even if the original terms are retained),
+    which means, e.g., that no part of This Product may be put
+    under another license. You must keep intact all the legal
+    notices contained in the source code files. You must include
+    the following items with every copy of Your Product that You
+    make and distribute: a clear and conspicuous notice stating
+    that Your Product or portion(s) thereof is/are governed by
+    this version of the TrueCrypt License, a verbatim copy of
+    this version of the TrueCrypt License (as contained herein),
+    a clear and conspicuous notice containing information about
+    where the included copy of the License can be found, and an
+    appropriate copyright notice.
+
+
+2. You are not obligated to comply with Subsection III.1.d if
+Your Product is not distributed (i.e., Your Product is available
+only to You).
+
+
+
+IV. Disclaimer of Liability, Disclaimer of Warranty,
+Indemnification
+
+You expressly acknowledge and agree to the following:
+
+1. IN NO EVENT WILL ANY (CO)AUTHOR OF THIS PRODUCT, OR ANY
+APPLICABLE INTELLECTUAL-PROPERTY OWNER, OR ANY OTHER PARTY WHO
+MAY COPY AND/OR (RE)DISTRIBUTE THIS PRODUCT OR PORTIONS THEREOF,
+AS MAY BE PERMITTED HEREIN, BE LIABLE TO YOU OR TO ANY OTHER
+PARTY FOR ANY DAMAGES, INCLUDING, BUT NOT LIMITED TO, ANY
+DIRECT, INDIRECT, GENERAL, SPECIAL, INCIDENTAL, PUNITIVE,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+TO, CORRUPTION OR LOSS OF DATA, ANY LOSSES SUSTAINED BY YOU OR
+THIRD PARTIES, A FAILURE OF THIS PRODUCT TO OPERATE WITH ANY
+OTHER PRODUCT, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR
+BUSINESS INTERRUPTION), WHETHER IN CONTRACT, STRICT LIABILITY,
+TORT (INCLUDING, BUT NOT LIMITED TO, NEGLIGENCE) OR OTHERWISE,
+ARISING OUT OF THE USE, COPYING, MODIFICATION, OR
+(RE)DISTRIBUTION OF THIS PRODUCT (OR A PORTION THEREOF) OR OF
+YOUR PRODUCT (OR A PORTION THEREOF), OR INABILITY TO USE THIS
+PRODUCT (OR A PORTION THEREOF), EVEN IF SUCH DAMAGES (OR THE
+POSSIBILITY OF SUCH DAMAGES) ARE/WERE PREDICTABLE OR KNOWN TO
+ANY (CO)AUTHOR, INTELLECTUAL-PROPERTY OWNER, OR ANY OTHER PARTY.
+
+2. THIS PRODUCT IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
+KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING, BUT NOT
+LIMITED TO, THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THE ENTIRE RISK AS TO
+THE QUALITY AND PERFORMANCE OF THIS PRODUCT IS WITH YOU. SHOULD
+THIS PRODUCT PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL
+NECESSARY SERVICING, REPAIR, OR CORRECTION.
+
+3. THIS PRODUCT MAY INCORPORATE IMPLEMENTATIONS OF CRYPTOGRAPHIC
+ALGORITHMS THAT ARE REGULATED (E.G., SUBJECT TO EXPORT/IMPORT
+CONTROL REGULATIONS) OR ILLEGAL IN SOME COUNTRIES. IT IS SOLELY
+YOUR RESPONSIBILITY TO VERIFY THAT IT IS LEGAL TO IMPORT AND/OR
+(RE)EXPORT AND/OR USE THIS PRODUCT (OR PORTIONS THEREOF) IN
+COUNTRIES WHERE YOU INTEND TO USE IT AND/OR TO WHICH YOU INTEND
+TO IMPORT IT AND/OR FROM WHICH YOU INTEND TO EXPORT IT, AND IT
+IS SOLELY YOUR RESPONSIBILITY TO COMPLY WITH ANY APPLICABLE
+REGULATIONS, RESTRICTIONS, AND LAWS.
+
+4. YOU SHALL INDEMNIFY, DEFEND AND HOLD ALL (CO)AUTHORS OF THIS
+PRODUCT, AND APPLICABLE INTELLECTUAL-PROPERTY OWNERS, HARMLESS
+FROM AND AGAINST ANY AND ALL LIABILITY, DAMAGES, LOSSES,
+SETTLEMENTS, PENALTIES, FINES, COSTS, EXPENSES (INCLUDING
+REASONABLE ATTORNEYS' FEES), DEMANDS, CAUSES OF ACTION, CLAIMS,
+ACTIONS, PROCEEDINGS, AND SUITS, DIRECTLY RELATED TO OR ARISING
+OUT OF YOUR USE, INABILITY TO USE, COPYING, (RE)DISTRIBUTION,
+IMPORT AND/OR (RE)EXPORT OF THIS PRODUCT (OR PORTIONS THEREOF)
+AND/OR YOUR BREACH OF ANY TERM OF THIS LICENSE.
+
+
+
+V. Trademarks
+
+This License does not grant permission to use trademarks
+associated with (or applying to) This Product, except for fair
+use as defined by applicable law and except for use expressly
+permitted or required by this License. Any attempt otherwise to
+use trademarks associated with (or applying to) This Product
+automatically and immediately terminates Your rights under This
+License and may constitute trademark infringement (which may be
+prosecuted).
+
+
+
+VI. General Terms and Conditions, Miscellaneous Provisions
+
+1. ANYONE WHO USES AND/OR COPIES AND/OR MODIFIES AND/OR CREATES
+DERIVATIVE WORKS OF AND/OR (RE)DISTRIBUTES THIS PRODUCT, OR ANY
+PORTION(S) THEREOF, IS, BY SUCH ACTION(S), AGREEING TO BE BOUND
+BY AND ACCEPTING ALL TERMS AND CONDITIONS OF THIS LICENSE (AND
+THE RESPONSIBILITIES AND OBLIGATIONS CONTAINED IN THIS LICENSE).
+IF YOU DO NOT ACCEPT (AND AGREE TO BE BOUND BY) ALL TERMS AND
+CONDITIONS OF THIS LICENSE, DO NOT USE, COPY, MODIFY, CREATE
+DERIVATIVE WORKS OF, NOR (RE)DISTRIBUTE THIS PRODUCT, NOR ANY
+PORTION(S) THEREOF.
+
+2. YOU MAY NOT USE, MODIFY, COPY, CREATE DERIVATIVE WORKS OF,
+(RE)DISTRIBUTE, OR SUBLICENSE THIS PRODUCT, OR PORTION(S)
+THEREOF, EXCEPT AS EXPRESSLY PROVIDED IN THIS LICENSE (EVEN IF
+APPLICABLE LAW GIVES YOU MORE RIGHTS). ANY ATTEMPT (EVEN IF
+PERMITTED BY APPLICABLE LAW) OTHERWISE TO USE, MODIFY, COPY,
+CREATE DERIVATIVE WORKS OF, (RE)DISTRIBUTE, OR SUBLICENSE THIS
+PRODUCT, OR PORTION(S) THEREOF, AUTOMATICALLY AND IMMEDIATELY
+TERMINATES YOUR RIGHTS UNDER THIS LICENSE AND CAN CONSTITUTE
+COPYRIGHT INFRINGEMENT (WHICH MAY BE PROSECUTED). ANY CONDITIONS
+AND RESTRICTIONS CONTAINED IN THIS LICENSE ARE ALSO LIMITATIONS
+ON THE SCOPE OF THIS LICENSE AND ALSO DEFINE THE SCOPE OF YOUR
+RIGHTS UNDER THIS LICENSE. YOUR FAILURE TO COMPLY WITH THE TERMS
+AND CONDITIONS OF THIS LICENSE OR FAILURE TO PERFORM ANY
+APPLICABLE OBLIGATION IMPOSED BY THIS LICENSE AUTOMATICALLY AND
+IMMEDIATELY TERMINATES YOUR RIGHTS UNDER THIS LICENSE AND CAN
+CAUSE OR BE CONSIDERED COPYRIGHT INFRINGEMENT (WHICH MAY BE
+PROSECUTED). NOTHING IN THIS LICENSE SHALL IMPLY OR BE CONSTRUED
+AS A PROMISE, OBLIGATION, OR COVENANT NOT TO SUE FOR COPYRIGHT
+OR TRADEMARK INFRINGEMENT IF YOU DO NOT COMPLY WITH THE TERMS
+AND CONDITIONS OF THIS LICENSE.
+
+3. This License does not constitute or imply a waiver of any
+intellectual property rights except as may be otherwise
+expressly provided in this License. This License does not
+transfer, assign, or convey any intellectual property rights
+(e.g., it does not transfer ownership of copyrights or
+trademarks).
+
+4. Subject to the terms and conditions of this License, You may
+allow a third party to use Your copy of This Product (or a copy
+that You make and distribute, or Your Product) provided that the
+third party explicitly accepts and agrees to be bound by all
+terms and conditions of this License and the third party is not
+prohibited from using This Product (or portions thereof) by this
+License (see, e.g., Section VI.7) or by applicable law. However,
+You are not obligated to ensure that the third party accepts
+(and agrees to be bound by all terms of) this License if You
+distribute only the self-extracting package (containing This
+Product) that does not allow the user to install (nor extract)
+the files contained in the package until he or she accepts and
+agrees to be bound by all terms and conditions of this License.
+
+5. Without specific prior written permission from the authors of
+This Product (or from their common representative), You must not
+use the name of This Product, the names of the authors of This
+Product, or the names of the legal entities (or informal groups)
+of which the authors were/are members/employees, to endorse or
+promote Your Product or any work in which You include a modified
+or unmodified version of This Product, or to endorse or promote
+You or Your affiliates, or in a way that might suggest that Your
+Product (or any work in which You include a modified or
+unmodified version of This Product), You, or Your affiliates
+is/are endorsed by one or more authors of This Product, or in a
+way that might suggest that one or more authors of This Product
+is/are affiliated with You (or Your affiliates) or directly
+participated in the creation of Your Product or of any work in
+which You include a modified or unmodified version of This
+Product.
+
+6. IF YOU ARE NOT SURE WHETHER YOU UNDERSTAND ALL PARTS OF THIS
+LICENSE OR IF YOU ARE NOT SURE WHETHER YOU CAN COMPLY WITH ALL
+TERMS AND CONDITIONS OF THIS LICENSE, YOU MUST NOT USE, COPY,
+MODIFY, CREATE DERIVATIVE WORKS OF, NOR (RE)DISTRIBUTE THIS
+PRODUCT, NOR ANY PORTION(S) OF IT. YOU SHOULD CONSULT WITH A
+LAWYER.
+
+7. IF (IN RELEVANT CONTEXT) ANY PROVISION OF CHAPTER IV OF THIS
+LICENSE IS UNENFORCEABLE, INVALID, OR PROHIBITED UNDER
+APPLICABLE LAW IN YOUR JURISDICTION, YOU HAVE NO RIGHTS UNDER
+THIS LICENSE AND YOU MUST NOT USE, COPY, MODIFY, CREATE
+DERIVATIVE WORKS OF, NOR (RE)DISTRIBUTE THIS PRODUCT, NOR ANY
+PORTION(S) THEREOF.
+
+8. Except as otherwise provided in this License, if any
+provision of this License, or a portion thereof, is found to be
+invalid or unenforceable under applicable law, it shall not
+affect the validity or enforceability of the remainder of this
+License, and such invalid or unenforceable provision shall be
+construed to reflect the original intent of the provision and
+shall be enforced to the maximum extent permitted by applicable
+law so as to effect the original intent of the provision as
+closely as possible.
+
+____________________________________________________________
+
+
+Third-Party Licenses
+
+This Product contains components that were created by third
+parties and that are governed by third-party licenses, which are
+contained hereinafter (separated by lines consisting of
+underscores). Each of the third-party licenses applies only to
+(portions of) the source code file(s) in which the third-party
+license is contained or in which it is explicitly referenced,
+and to compiled or otherwise processed forms of such source
+code. None of the third-party licenses applies to This Product
+as a whole, even when it uses terms such as "product",
+"program", or any other equivalent terms/phrases. This Product
+as a whole is governed by the TrueCrypt License (see above).
+Some of the third-party components have been modified by the
+authors of This Product. Unless otherwise stated, such
+modifications and additions are governed by the TrueCrypt
+License (see above). Note: Unless otherwise stated, graphics and
+files that are not part of the source code are governed by the
+TrueCrypt License.
+
+____________________________________________________________
+
+License agreement for Encryption for the Masses.
+
+Copyright (C) 1998-2000 Paul Le Roux. All Rights Reserved.
+
+This product can be copied and distributed free of charge,
+including source code.
+
+You may modify this product and source code, and distribute such
+modifications, and you may derive new works based on this
+product, provided that:
+
+1. Any product which is simply derived from this product cannot
+be called E4M, or Encryption for the Masses.
+
+2. If you use any of the source code in your product, and your
+product is distributed with source code, you must include this
+notice with those portions of this source code that you use.
+
+Or,
+
+If your product is distributed in binary form only, you must
+display on any packaging, and marketing materials which
+reference your product, a notice which states:
+
+"This product uses components written by Paul Le Roux
+<pleroux@swprofessionals.com>"
+
+3. If you use any of the source code originally by Eric Young,
+you must in addition follow his terms and conditions.
+
+4. Nothing requires that you accept this License, as you have
+not signed it. However, nothing else grants you permission to
+modify or distribute the product or its derivative works.
+
+These actions are prohibited by law if you do not accept this
+License.
+
+5. If any of these license terms is found to be to broad in
+scope, and declared invalid by any court or legal process, you
+agree that all other terms shall not be so affected, and shall
+remain valid and enforceable.
+
+6. THIS PROGRAM IS DISTRIBUTED FREE OF CHARGE, THEREFORE THERE
+IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW. UNLESS OTHERWISE STATED THE PROGRAM IS PROVIDED
+"AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR
+IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE
+ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS
+WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE
+COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+7. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY
+MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE
+LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL,
+INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR
+INABILITY TO USE THE PROGRAM, INCLUDING BUT NOT LIMITED TO LOSS
+OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH
+ANY OTHER PROGRAMS, EVEN IF SUCH HOLDER OR OTHER PARTY HAD
+PREVIOUSLY BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+____________________________________________________________
+
+Copyright (c) 1998-2008, Brian Gladman, Worcester, UK.
+All rights reserved.
+
+LICENSE TERMS
+
+The free distribution and use of this software is allowed (with
+or without changes) provided that:
+
+ 1. source code distributions include the above copyright
+    notice, this list of conditions and the following
+    disclaimer;
+
+ 2. binary distributions include the above copyright notice,
+    this list of conditions and the following disclaimer in
+    their documentation;
+
+ 3. the name of the copyright holder is not used to endorse
+    products built using this software without specific written
+    permission.
+
+DISCLAIMER
+
+This software is provided 'as is' with no explicit or implied
+warranties in respect of its properties, including, but not
+limited to, correctness and/or fitness for purpose.
+____________________________________________________________
+
+Copyright (C) 2002-2004 Mark Adler, all rights reserved
+version 1.8, 9 Jan 2004
+
+This software is provided 'as-is', without any express or
+implied warranty.  In no event will the author be held liable
+for any damages arising from the use of this software.
+
+Permission is granted to anyone to use this software for any
+purpose, including commercial applications, and to alter it and
+redistribute it freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you
+   must not claim that you wrote the original software. If you
+   use this software in a product, an acknowledgment in the
+   product documentation would be appreciated but is not
+   required.
+2. Altered source versions must be plainly marked as such, and
+   must not be misrepresented as being the original software.
+3. This notice may not be removed or altered from any source
+   distribution.
+____________________________________________________________

README.md

@@ -0,0 +1,258 @@
+This archive contains the source code of VeraCrypt.
+It is based on original TrueCrypt 7.1a with security enhancements and modifications.
+
+
+Important
+=========
+
+You may use the source code contained in this archive only if you accept and
+agree to the license terms contained in the file 'License.txt', which is
+included in this archive.
+
+Note that the license specifies, for example, that a derived work must not be
+called 'TrueCrypt' or 'VeraCrypt'
+
+
+
+Contents
+========
+
+I. Windows
+	Requirements for Building VeraCrypt for Windows
+	Instructions for Building VeraCrypt for Windows
+	Instructions for Signing and Packaging VeraCrypt for Windows
+
+II. Linux and Mac OS X
+	Requirements for Building VeraCrypt for Linux and Mac OS X
+	Instructions for Building VeraCrypt for Linux and Mac OS X
+	Mac OS X specifics
+	
+III. FreeBSD and OpenSolaris
+
+IV. Third-Party Developers (Contributors)
+
+V. Legal Information
+
+VI. Further Information
+
+
+
+I. Windows
+==========
+
+Requirements for Building VeraCrypt for Windows:
+------------------------------------------------
+
+- Microsoft Visual C++ 2008 SP1 (Professional Edition or compatible)
+- Microsoft Visual C++ 1.52 (available from MSDN Subscriber Downloads)
+- Microsoft Windows SDK for Windows 7 (configured for Visual C++)
+- Microsoft Windows Driver Kit 7.1.0 (build 7600.16385.1)
+- RSA Security Inc. PKCS #11 Cryptographic Token Interface (Cryptoki) 2.20
+  header files (available at ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20)
+- NASM assembler 2.08 or compatible
+- gzip compressor
+
+IMPORTANT:
+
+The 64-bit editions of Windows Vista and later versions of Windows, and in
+some cases (e.g. playback of HD DVD content) also the 32-bit editions, do not
+allow the VeraCrypt driver to run without an appropriate digital signature.
+Therefore, all .sys files in official VeraCrypt binary packages are digitally
+signed with the digital certificate of the IDRIX, which was
+issued by Thawt certification authority. At the end of each official .exe and
+.sys file, there are embedded digital signatures and all related certificates
+(i.e. all certificates in the relevant certification chain, such as the
+certification authority certificates, CA-MS cross-certificate, and the
+IDRIX certificate). Keep this in mind if you compile VeraCrypt
+and compare your binaries with the official binaries. If your binaries are
+unsigned, the sizes of the official binaries will usually be approximately
+10 KB greater than sizes of your binaries (there may be further differences
+if you use a different version of the compiler, or if you install a different
+or no service pack for Visual Studio, or different hotfixes for it, or if you
+use different versions of the required SDKs).
+
+
+Instructions for Building VeraCrypt for Windows:
+------------------------------------------------
+
+1) Create an environment variable 'MSVC16_ROOT' pointing to the folder 'MSVC15'
+   extracted from the Visual C++ 1.52 self-extracting package.
+
+   Note: The 16-bit installer MSVC15\SETUP.EXE cannot be run on 64-bit Windows,
+   but it is actually not necessary to run it. You only need to extract the
+   folder 'MSVC15', which contains the 32-bit binaries required to build the
+   VeraCrypt Boot Loader.
+
+2) If you have installed the Windows Driver Development Kit in another
+   directory than '%SYSTEMDRIVE%\WinDDK', create an environment variable
+   'WINDDK_ROOT' pointing to the DDK installation directory.
+
+3) Copy the PKCS #11 header files to a standard include path or create an
+   environment variable 'PKCS11_INC' pointing to the directory where
+   the PKCS #11 header files are installed.
+
+4) Open the solution file 'VeraCrypt.sln' in Microsoft Visual Studio 2008.
+
+5) Select 'All' as the active solution configuration.
+
+6) Build the solution.
+
+7) If successful, there should be newly built VeraCrypt binaries in the
+   'Release' folder.
+
+Instructions for Signing VeraCrypt for Windows:
+------------------------------------------------
+
+The folder "Signing" contains a batch file (sign.bat) that will sign all 
+VeraCrypt components using a code signing certificate present on the 
+certificate store and also build the final installation setup.
+The batch file suppose that the code signing certificate is issued by Thawt.
+This is the case for IDRIX's certificate. If yours is issued by another CA, 
+then you should put the Root and Intermediate certificates in the "Signing" 
+folder and then modify sign.bat accordingly.
+
+
+II. Linux and Mac OS X
+======================
+
+Requirements for Building VeraCrypt for Linux and Mac OS X:
+-----------------------------------------------------------
+
+- GNU Make
+- GNU C++ Compiler 4.0 or compatible
+- Apple Xcode (Mac OS X only)
+- NASM assembler 2.08 or compatible (x86/x64 architecture only)
+- pkg-config
+- makeself (Linux only)
+- wxWidgets 3.0 shared library and header files installed or
+  wxWidgets 3.0 library source code (available at http://www.wxwidgets.org)
+- FUSE library and header files (available at http://fuse.sourceforge.net
+  and https://osxfuse.github.io/)
+- RSA Security Inc. PKCS #11 Cryptographic Token Interface (Cryptoki) 2.20
+  header files (available at ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20).
+  They are already included in the source tree under the directory PKCS11 but 
+  it is possible to override it using the environment variable 'PKCS11_INC'. 
+
+
+Instructions for Building VeraCrypt for Linux and Mac OS X:
+-----------------------------------------------------------
+
+1) Change the current directory to the root of the VeraCrypt source code.
+
+2) If you have no wxWidgets shared library installed, run the following
+   command to configure the wxWidgets static library for VeraCrypt and to
+   build it: 
+
+   $ make WXSTATIC=1 WX_ROOT=/usr/src/wxWidgets wxbuild
+
+   The variable WX_ROOT must point to the location of the source code of the
+   wxWidgets library. Output files will be placed in the './wxrelease/'
+   directory.
+
+3) To build VeraCrypt, run the following command:
+
+   $ make
+
+   or if you have no wxWidgets shared library installed:
+   
+   $ make WXSTATIC=1
+
+4) If successful, the VeraCrypt executable should be located in the directory
+   'Main'.
+
+By default, a universal executable supporting both graphical and text user
+interface is built. To build a console-only executable, which requires no GUI
+library, use the 'NOGUI' parameter:
+
+   $ make NOGUI=1 WXSTATIC=1 WX_ROOT=/usr/src/wxWidgets wxbuild
+   $ make NOGUI=1 WXSTATIC=1
+   
+
+Mac OS X specifics:
+-----------------------------------------------------------
+   
+Under MacOSX, the SDK for OSX 10.7 is used by default. To use another version
+of the SDK (e.i. 10.6), you can export the environment variable VC_OSX_TARGET :
+	
+	$ export VC_OSX_TARGET=10.6
+
+
+Before building under MacOSX, pkg-config must be installed if not yet available.
+Get it from http://pkgconfig.freedesktop.org/releases/pkg-config-0.28.tar.gz and
+compile using the following commands : 
+
+	$ ./configure --with-internal-glib
+	$ make
+	$ sudo make install
+
+After making sure pkg-config is available, download and install OSXFuse from
+https://osxfuse.github.io/ (MacFUSE compatibility layer must selected)
+
+The script build_veracrypt_macosx.sh available under "src/Build" performs the 
+full build of VeraCrypt including the creation of the installer pkg. It expects
+to find the wxWidgets 3.0.2 sources at the same level as where you put 
+VeraCrypt sources (e.i. if "src" path is "/Users/joe/Projects/VeraCrypt/src" 
+then wxWidgets should be at "/Users/joe/Projects/wxWidgets-wxWidgets-3.0.2")
+
+The build process uses Code Signing certificates whose ID is specified in
+src/Main/Main.make (lines 167 & 169). You'll have to modify these lines to put
+the ID of your Code Signing certificates or comment them if you don't have one.
+
+Because of incompatibility issues with OSXFUSE, the SDK 10.9 generates a
+VeraCrypt binary that has issues communicating with the OSXFUSE kernel extension.
+Thus, we recommend to use the SDK 10.8 or earlier for building VeraCrypt.
+
+
+
+III. FreeBSD and OpenSolaris
+============================
+
+FreeBSD and OpenSolaris are not yet supported.
+
+
+
+IV. Third-Party Developers (Contributors)
+=========================================
+
+If you intend to implement a feature, please contact us first to make sure:
+
+1) That the feature has not been implemented (we may have already implemented
+   it, but haven't released the code yet).
+2) That the feature is acceptable.
+3) Whether we need help of third-party developers with implementing the feature.
+
+Information on how to contact us can be found at:
+https://veracrypt.codeplex.com/
+
+
+
+V. Legal Information
+====================
+
+Copyright Information
+---------------------
+
+This software as a whole:
+Copyright (c) 2013-2015 IDRIX. All rights reserved.
+
+Portions of this software:
+Copyright (c) 2003-2012 TrueCrypt Developers Association. All rights reserved.
+Copyright (c) 1998-2000 Paul Le Roux. All rights reserved.
+Copyright (c) 1998-2008 Brian Gladman, Worcester, UK. All rights reserved.
+Copyright (c) 2002-2004 Mark Adler. All rights reserved.
+For more information, please see the legal notices attached to parts of the
+source code.
+
+Trademark Information
+---------------------
+
+Any trademarks contained in the source code, binaries, and/or in the 
+documentation, are the sole property of their respective owners.
+
+
+
+VI. Further Information
+=======================
+
+http://www.veracrypt.fr
+

src/Boot/Windows/Boot.vcproj

@@ -24,9 +24,9 @@
 			>
 			<Tool
 				Name="VCNMakeTool"
-				BuildCommandLine="md Release 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1&#x0D;&#x0A;&#x0D;&#x0A;md Release_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES&#x0D;&#x0A;&#x0D;&#x0A;md Release_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT&#x0D;&#x0A;&#x0D;&#x0A;md Release_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH&#x0D;&#x0A;&#x0D;&#x0A;md Rescue 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH RESCUE_DISK=1"
-				ReBuildCommandLine="del /q /s Release &gt;NUL:&#x0D;&#x0A;md Release 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_AES &gt;NUL:&#x0D;&#x0A;md Release_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_Serpent &gt;NUL:&#x0D;&#x0A;md Release_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_Twofish &gt;NUL:&#x0D;&#x0A;md Release_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue &gt;NUL:&#x0D;&#x0A;md Rescue 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_AES &gt;NUL:&#x0D;&#x0A;md Rescue_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_Serpent &gt;NUL:&#x0D;&#x0A;md Rescue_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_Twofish &gt;NUL:&#x0D;&#x0A;md Rescue_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH RESCUE_DISK=1"
-				CleanCommandLine="del /q /s Release Release_AES Release_Serpent Release_Twofish Rescue Rescue_AES Rescue_Serpent Rescue_Twofish &gt;NUL:"
+				BuildCommandLine="md Release 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1&#x0D;&#x0A;&#x0D;&#x0A;md Release_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;md Release_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES&#x0D;&#x0A;&#x0D;&#x0A;md Release_AES_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;md Release_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT&#x0D;&#x0A;&#x0D;&#x0A;md Release_Serpent_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;md Release_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH&#x0D;&#x0A;&#x0D;&#x0A;md Release_Twofish_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;md Rescue 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 RESCUE_DISK=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_AES_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES RESCUE_DISK=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_Serpent_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT RESCUE_DISK=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_Twofish_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH RESCUE_DISK=1 SINGLE_PRF=SHA2"
+				ReBuildCommandLine="del /q /s Release &gt;NUL:&#x0D;&#x0A;md Release 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_SHA2 &gt;NUL:&#x0D;&#x0A;md Release_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_AES &gt;NUL:&#x0D;&#x0A;md Release_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_AES_SHA2 &gt;NUL:&#x0D;&#x0A;md Release_AES_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_Serpent &gt;NUL:&#x0D;&#x0A;md Release_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_Serpent_SHA2 &gt;NUL:&#x0D;&#x0A;md Release_Serpent_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_Twofish &gt;NUL:&#x0D;&#x0A;md Release_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_Twofish_SHA2 &gt;NUL:&#x0D;&#x0A;md Release_Twofish_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue &gt;NUL:&#x0D;&#x0A;md Rescue 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_SHA2 &gt;NUL:&#x0D;&#x0A;md Rescue_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 RESCUE_DISK=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_AES &gt;NUL:&#x0D;&#x0A;md Rescue_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_AES_SHA2 &gt;NUL:&#x0D;&#x0A;md Rescue_AES_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES RESCUE_DISK=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_Serpent &gt;NUL:&#x0D;&#x0A;md Rescue_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_Serpent_SHA2 &gt;NUL:&#x0D;&#x0A;md Rescue_Serpent_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT RESCUE_DISK=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_Twofish &gt;NUL:&#x0D;&#x0A;md Rescue_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_Twofish_SHA2 &gt;NUL:&#x0D;&#x0A;md Rescue_Twofish_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH RESCUE_DISK=1 SINGLE_PRF=SHA2"
+				CleanCommandLine="del /q /s Release Release_AES Release_Serpent Release_Twofish Rescue Rescue_AES Rescue_Serpent Rescue_Twofish &gt;NUL:&#x0D;&#x0A;del /q /s Release_SHA2 Release_AES_SHA2 Release_Serpent_SHA2 Release_Twofish_SHA2 Rescue_SHA2 Rescue_AES_SHA2 Rescue_Serpent_SHA2 Rescue_Twofish_SHA2 &gt;NUL:&#x0D;&#x0A;"
 				Output="Release\BootLoader.com"
 				PreprocessorDefinitions="WIN32;NDEBUG"
 				IncludeSearchPath="&quot;$(SolutionDir)&quot;;&quot;$(SolutionDir)\Common&quot;;&quot;$(SolutionDir)\Crypto&quot;;&quot;$(MSVC16_ROOT)\Include&quot;"
@@ -164,6 +164,10 @@
 					RelativePath="..\..\Crypto\Serpent.c"
 					>
 				</File>
+				<File
+					RelativePath="..\..\Crypto\Sha2Small.c"
+					>
+				</File>
 				<File
 					RelativePath="..\..\Crypto\Twofish.c"
 					>

src/Boot/Windows/BootCommon.h

@@ -13,7 +13,7 @@
 #include "BootDefs.h"
 
 // The user will be advised to upgrade the rescue disk if upgrading from the following or any previous version
-#define TC_RESCUE_DISK_UPGRADE_NOTICE_MAX_VERSION 0x060a
+#define TC_RESCUE_DISK_UPGRADE_NOTICE_MAX_VERSION 0x010e
 
 #define TC_BOOT_LOADER_AREA_SIZE (TC_BOOT_LOADER_AREA_SECTOR_COUNT * TC_SECTOR_SIZE_BIOS)
 

src/Boot/Windows/BootEncryptedIo.cpp

@@ -74,7 +74,7 @@ BiosResult ReadEncryptedSectors (uint16 destSegment, uint16 destOffset, byte dri
 
 BiosResult WriteEncryptedSectors (uint16 sourceSegment, uint16 sourceOffset, byte drive, uint64 sector, uint16 sectorCount)
 {
-	BiosResult result;
+	BiosResult result = BiosResultSuccess;
 	AcquireSectorBuffer();
 	uint64 dataUnitNo;
 	uint64 writeOffset;

src/Boot/Windows/BootMain.cpp

@@ -584,7 +584,7 @@ static bool CopySystemPartitionToHiddenVolume (byte drive, byte &exitKey)
 	sectorOffset.HighPart = 0;
 
 	int fragmentSectorCount = 0x7f; // Maximum safe value supported by BIOS
-	int statCount;
+	int statCount = 0;
 
 	if (!CheckMemoryRequirements ())
 		goto err;
@@ -709,7 +709,7 @@ static void DecryptDrive (byte drive)
 	uint64 sector = EncryptedVirtualPartition.EndSector + 1;
 
 	int fragmentSectorCount = 0x7f; // Maximum safe value supported by BIOS
-	int statCount;
+	int statCount = 0;
 
 	bool skipBadSectors = false;
 
@@ -1081,7 +1081,7 @@ void main ()
 	// Check whether the user is not using the Rescue Disk to create a hidden system
 
 	if (ReadWriteMBR (false, BootDrive, true) == BiosResultSuccess
-		&& *(uint32 *) (SectorBuffer + 6) == 0x65757254
+		&& *(uint32 *) (SectorBuffer + 6) == 0x61726556
 		&& *(uint32 *) (SectorBuffer + 10) == 0x70797243
 		&& (SectorBuffer[TC_BOOT_SECTOR_CONFIG_OFFSET] & TC_BOOT_CFG_MASK_HIDDEN_OS_CREATION_PHASE) != TC_HIDDEN_OS_CREATION_PHASE_NONE)
 	{

src/Boot/Windows/BootSector.asm

@@ -134,6 +134,8 @@ checksum_ok:
 	push dx
 	
 	; Decompress boot loader
+	mov cx, word ptr [start + TC_BOOT_SECTOR_LOADER_LENGTH_OFFSET]
+	push cx																		; Compressed data size
 	push TC_BOOT_LOADER_COMPRESSED_BUFFER_OFFSET + TC_GZIP_HEADER_SIZE			; Compressed data
 	push TC_MAX_BOOT_LOADER_DECOMPRESSED_SIZE									; Output buffer size
 	push TC_BOOT_LOADER_DECOMPRESSOR_MEMORY_SIZE + TC_COM_EXECUTABLE_OFFSET		; Output buffer
@@ -145,7 +147,7 @@ checksum_ok:
 	retf
 decompressor_ret:
 
-	add sp, 6
+	add sp, 8
 	pop dx
 	
 	; Restore boot sector segment

src/Boot/Windows/Decompressor.c

@@ -1,410 +1,432 @@
-/*
-  puff.c
-  Copyright (C) 2002-2004 Mark Adler, all rights reserved
-  version 1.8, 9 Jan 2004
-
-  This software is provided 'as-is', without any express or implied
-  warranty.  In no event will the author be held liable for any damages
-  arising from the use of this software.
-
-  Permission is granted to anyone to use this software for any purpose,
-  including commercial applications, and to alter it and redistribute it
-  freely, subject to the following restrictions:
-
-  1. The origin of this software must not be misrepresented; you must not
-     claim that you wrote the original software. If you use this software
-     in a product, an acknowledgment in the product documentation would be
-     appreciated but is not required.
-  2. Altered source versions must be plainly marked as such, and must not be
-     misrepresented as being the original software.
-  3. This notice may not be removed or altered from any source distribution.
-
-  Mark Adler    madler@alumni.caltech.edu
-*/
-
-/* Adapted for TrueCrypt */
-
-
-#define local static            /* for local function definitions */
-#define NIL ((unsigned char *)0)        /* for no output option */
-
-/*
- * Maximums for allocations and loops.  It is not useful to change these --
- * they are fixed by the deflate format.
- */
-#define MAXBITS 15              /* maximum bits in a code */
-#define MAXLCODES 286           /* maximum number of literal/length codes */
-#define MAXDCODES 30            /* maximum number of distance codes */
-#define MAXCODES (MAXLCODES+MAXDCODES)  /* maximum codes lengths to read */
-#define FIXLCODES 288           /* number of fixed literal/length codes */
-
-/* input and output state */
-struct state {
-    /* output state */
-    unsigned char *out;         /* output buffer */
-    unsigned int outlen;       /* available space at out */
-    unsigned int outcnt;       /* bytes written to out so far */
-
-    /* input state */
-    unsigned char *in;          /* input buffer */
-    unsigned int incnt;        /* bytes read so far */
-    int bitbuf;                 /* bit buffer */
-    int bitcnt;                 /* number of bits in bit buffer */
-};
-
-
-local int bits(struct state *s, int need)
-{
-    long val;           /* bit accumulator (can use up to 20 bits) */
-
-    /* load at least need bits into val */
-    val = s->bitbuf;
-    while (s->bitcnt < need) {
-        val |= (long)(s->in[s->incnt++]) << s->bitcnt;  /* load eight bits */
-        s->bitcnt += 8;
-    }
-
-    /* drop need bits and update buffer, always zero to seven bits left */
-    s->bitbuf = (int)(val >> need);
-    s->bitcnt -= need;
-
-    /* return need bits, zeroing the bits above that */
-    return (int)(val & ((1L << need) - 1));
-}
-
-
-local int stored(struct state *s)
-{
-    unsigned len;       /* length of stored block */
-
-    /* discard leftover bits from current byte (assumes s->bitcnt < 8) */
-    s->bitbuf = 0;
-    s->bitcnt = 0;
-
-    /* get length and check against its one's complement */
-    len = s->in[s->incnt++];
-    len |= s->in[s->incnt++] << 8;
-    if (s->in[s->incnt++] != (~len & 0xff) ||
-        s->in[s->incnt++] != ((~len >> 8) & 0xff))
-        return -2;                              /* didn't match complement! */
-
-    /* copy len bytes from in to out */
-    if (s->out != NIL) {
-        if (s->outcnt + len > s->outlen)
-            return 1;                           /* not enough output space */
-        while (len--)
-            s->out[s->outcnt++] = s->in[s->incnt++];
-    }
-    else {                                      /* just scanning */
-        s->outcnt += len;
-        s->incnt += len;
-    }
-
-    /* done with a valid stored block */
-    return 0;
-}
-
-
-struct huffman {
-    short *count;       /* number of symbols of each length */
-    short *symbol;      /* canonically ordered symbols */
-};
-
-
-#ifdef SLOW
-local int decode(struct state *s, struct huffman *h)
-{
-    int len;            /* current number of bits in code */
-    int code;           /* len bits being decoded */
-    int first;          /* first code of length len */
-    int count;          /* number of codes of length len */
-    int index;          /* index of first code of length len in symbol table */
-
-    code = first = index = 0;
-    for (len = 1; len <= MAXBITS; len++) {
-        code |= bits(s, 1);             /* get next bit */
-        count = h->count[len];
-        if (code < first + count)       /* if length len, return symbol */
-            return h->symbol[index + (code - first)];
-        index += count;                 /* else update for next length */
-        first += count;
-        first <<= 1;
-        code <<= 1;
-    }
-    return -9;                          /* ran out of codes */
-}
-
-/*
- * A faster version of decode() for real applications of this code.   It's not
- * as readable, but it makes puff() twice as fast.  And it only makes the code
- * a few percent larger.
- */
-#else /* !SLOW */
-local int decode(struct state *s, struct huffman *h)
-{
-    int len;            /* current number of bits in code */
-    int code;           /* len bits being decoded */
-    int first;          /* first code of length len */
-    int count;          /* number of codes of length len */
-    int index;          /* index of first code of length len in symbol table */
-    int bitbuf;         /* bits from stream */
-    int left;           /* bits left in next or left to process */
-    short *next;        /* next number of codes */
-
-    bitbuf = s->bitbuf;
-    left = s->bitcnt;
-    code = first = index = 0;
-    len = 1;
-    next = h->count + 1;
-    while (1) {
-        while (left--) {
-            code |= bitbuf & 1;
-            bitbuf >>= 1;
-            count = *next++;
-            if (code < first + count) { /* if length len, return symbol */
-                s->bitbuf = bitbuf;
-                s->bitcnt = (s->bitcnt - len) & 7;
-                return h->symbol[index + (code - first)];
-            }
-            index += count;             /* else update for next length */
-            first += count;
-            first <<= 1;
-            code <<= 1;
-            len++;
-        }
-        left = (MAXBITS+1) - len;
-        if (left == 0) break;
-        bitbuf = s->in[s->incnt++];
-        if (left > 8) left = 8;
-    }
-    return -9;                          /* ran out of codes */
-}
-#endif /* SLOW */
-
-
-local int construct(struct huffman *h, short *length, int n)
-{
-    int symbol;         /* current symbol when stepping through length[] */
-    int len;            /* current length when stepping through h->count[] */
-    int left;           /* number of possible codes left of current length */
-    short offs[MAXBITS+1];      /* offsets in symbol table for each length */
-
-    /* count number of codes of each length */
-    for (len = 0; len <= MAXBITS; len++)
-        h->count[len] = 0;
-    for (symbol = 0; symbol < n; symbol++)
-        (h->count[length[symbol]])++;   /* assumes lengths are within bounds */
-    if (h->count[0] == n)               /* no codes! */
-        return 0;                       /* complete, but decode() will fail */
-
-    /* check for an over-subscribed or incomplete set of lengths */
-    left = 1;                           /* one possible code of zero length */
-    for (len = 1; len <= MAXBITS; len++) {
-        left <<= 1;                     /* one more bit, double codes left */
-        left -= h->count[len];          /* deduct count from possible codes */
-        if (left < 0) return left;      /* over-subscribed--return negative */
-    }                                   /* left > 0 means incomplete */
-
-    /* generate offsets into symbol table for each length for sorting */
-    offs[1] = 0;
-    for (len = 1; len < MAXBITS; len++)
-        offs[len + 1] = offs[len] + h->count[len];
-
-    /*
-     * put symbols in table sorted by length, by symbol order within each
-     * length
-     */
-    for (symbol = 0; symbol < n; symbol++)
-        if (length[symbol] != 0)
-            h->symbol[offs[length[symbol]]++] = symbol;
-
-    /* return zero for complete set, positive for incomplete set */
-    return left;
-}
-
-
-local int codes(struct state *s,
-                struct huffman *lencode,
-                struct huffman *distcode)
-{
-    int symbol;         /* decoded symbol */
-    int len;            /* length for copy */
-    unsigned dist;      /* distance for copy */
-    static const short lens[29] = { /* Size base for length codes 257..285 */
-        3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
-        35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
-    static const short lext[29] = { /* Extra bits for length codes 257..285 */
-        0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
-        3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
-    static const short dists[30] = { /* Offset base for distance codes 0..29 */
-        1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
-        257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
-        8193, 12289, 16385, 24577};
-    static const short dext[30] = { /* Extra bits for distance codes 0..29 */
-        0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
-        7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
-        12, 12, 13, 13};
-
-    /* decode literals and length/distance pairs */
-    do {
-        symbol = decode(s, lencode);
-        if (symbol < 0) return symbol;  /* invalid symbol */
-        if (symbol < 256) {             /* literal: symbol is the byte */
-            /* write out the literal */
-            if (s->out != NIL) {
-                if (s->outcnt == s->outlen) return 1;
-                s->out[s->outcnt] = symbol;
-            }
-            s->outcnt++;
-        }
-        else if (symbol > 256) {        /* length */
-            /* get and compute length */
-            symbol -= 257;
-            if (symbol >= 29) return -9;        /* invalid fixed code */
-            len = lens[symbol] + bits(s, lext[symbol]);
-
-            /* get and check distance */
-            symbol = decode(s, distcode);
-            if (symbol < 0) return symbol;      /* invalid symbol */
-            dist = dists[symbol] + bits(s, dext[symbol]);
-            if (dist > s->outcnt)
-                return -10;     /* distance too far back */
-
-            /* copy length bytes from distance bytes back */
-            if (s->out != NIL) {
-                if (s->outcnt + len > s->outlen) return 1;
-                while (len--) {
-                    s->out[s->outcnt] = s->out[s->outcnt - dist];
-                    s->outcnt++;
-                }
-            }
-            else
-                s->outcnt += len;
-        }
-    } while (symbol != 256);            /* end of block symbol */
-
-    /* done with a valid fixed or dynamic block */
-    return 0;
-}
-
-
-local int fixed(struct state *s)
-{
-    static int virgin = 1;
-    static short lencnt[MAXBITS+1], lensym[FIXLCODES];
-    static short distcnt[MAXBITS+1], distsym[MAXDCODES];
-    static struct huffman lencode = {lencnt, lensym};
-    static struct huffman distcode = {distcnt, distsym};
-
-    /* build fixed huffman tables if first call (may not be thread safe) */
-    if (virgin) {
-        int symbol;
-        short lengths[FIXLCODES];
-
-        /* literal/length table */
-        for (symbol = 0; symbol < 144; symbol++)
-            lengths[symbol] = 8;
-        for (; symbol < 256; symbol++)
-            lengths[symbol] = 9;
-        for (; symbol < 280; symbol++)
-            lengths[symbol] = 7;
-        for (; symbol < FIXLCODES; symbol++)
-            lengths[symbol] = 8;
-        construct(&lencode, lengths, FIXLCODES);
-
-        /* distance table */
-        for (symbol = 0; symbol < MAXDCODES; symbol++)
-            lengths[symbol] = 5;
-        construct(&distcode, lengths, MAXDCODES);
-
-        /* do this just once */
-        virgin = 0;
-    }
-
-    /* decode data until end-of-block code */
-    return codes(s, &lencode, &distcode);
-}
-
-
-local int dynamic(struct state *s)
-{
-    int nlen, ndist, ncode;             /* number of lengths in descriptor */
-    int index;                          /* index of lengths[] */
-    int err;                            /* construct() return value */
-    short lengths[MAXCODES];            /* descriptor code lengths */
-    short lencnt[MAXBITS+1], lensym[MAXLCODES];         /* lencode memory */
-    short distcnt[MAXBITS+1], distsym[MAXDCODES];       /* distcode memory */
-    struct huffman lencode = {lencnt, lensym};          /* length code */
-    struct huffman distcode = {distcnt, distsym};       /* distance code */
-    static const short order[19] =      /* permutation of code length codes */
-        {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
-
-    /* get number of lengths in each table, check lengths */
-    nlen = bits(s, 5) + 257;
-    ndist = bits(s, 5) + 1;
-    ncode = bits(s, 4) + 4;
-    if (nlen > MAXLCODES || ndist > MAXDCODES)
-        return -3;                      /* bad counts */
-
-    /* read code length code lengths (really), missing lengths are zero */
-    for (index = 0; index < ncode; index++)
-        lengths[order[index]] = bits(s, 3);
-    for (; index < 19; index++)
-        lengths[order[index]] = 0;
-
-    /* build huffman table for code lengths codes (use lencode temporarily) */
-    err = construct(&lencode, lengths, 19);
-    if (err != 0) return -4;            /* require complete code set here */
-
-    /* read length/literal and distance code length tables */
-    index = 0;
-    while (index < nlen + ndist) {
-        int symbol;             /* decoded value */
-        int len;                /* last length to repeat */
-
-        symbol = decode(s, &lencode);
-        if (symbol < 16)                /* length in 0..15 */
-            lengths[index++] = symbol;
-        else {                          /* repeat instruction */
-            len = 0;                    /* assume repeating zeros */
-            if (symbol == 16) {         /* repeat last length 3..6 times */
-                if (index == 0) return -5;      /* no last length! */
-                len = lengths[index - 1];       /* last length */
-                symbol = 3 + bits(s, 2);
-            }
-            else if (symbol == 17)      /* repeat zero 3..10 times */
-                symbol = 3 + bits(s, 3);
-            else                        /* == 18, repeat zero 11..138 times */
-                symbol = 11 + bits(s, 7);
-            if (index + symbol > nlen + ndist)
-                return -6;              /* too many lengths! */
-            while (symbol--)            /* repeat last or zero symbol times */
-                lengths[index++] = len;
-        }
-    }
-
-    /* build huffman table for literal/length codes */
-    err = construct(&lencode, lengths, nlen);
-    if (err < 0 || (err > 0 && nlen - lencode.count[0] != 1))
-        return -7;      /* only allow incomplete codes if just one code */
-
-    /* build huffman table for distance codes */
-    err = construct(&distcode, lengths + nlen, ndist);
-    if (err < 0 || (err > 0 && ndist - distcode.count[0] != 1))
-        return -8;      /* only allow incomplete codes if just one code */
-
-    /* decode data until end-of-block code */
-    return codes(s, &lencode, &distcode);
-}
-
-
-void _acrtused () { }
-
-// Decompress deflated data
+/*
+  puff.c
+  Copyright (C) 2002-2004 Mark Adler, all rights reserved
+  version 1.8, 9 Jan 2004
+
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the author be held liable for any damages
+  arising from the use of this software.
+
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+  Mark Adler    madler@alumni.caltech.edu
+*/
+
+/* Adapted for TrueCrypt */
+
+
+#define local static            /* for local function definitions */
+#define NIL ((unsigned char *)0)        /* for no output option */
+
+/*
+ * Maximums for allocations and loops.  It is not useful to change these --
+ * they are fixed by the deflate format.
+ */
+#define MAXBITS 15              /* maximum bits in a code */
+#define MAXLCODES 286           /* maximum number of literal/length codes */
+#define MAXDCODES 30            /* maximum number of distance codes */
+#define MAXCODES (MAXLCODES+MAXDCODES)  /* maximum codes lengths to read */
+#define FIXLCODES 288           /* number of fixed literal/length codes */
+
+/* input and output state */
+struct state {
+    /* output state */
+    unsigned char *out;         /* output buffer */
+    unsigned int outlen;       /* available space at out */
+    unsigned int outcnt;       /* bytes written to out so far */
+
+    /* input state */
+    unsigned char *in;          /* input buffer */
+    unsigned int inlen;			 /* available input at in */
+    unsigned int incnt;        /* bytes read so far */
+    int bitbuf;                 /* bit buffer */
+    int bitcnt;                 /* number of bits in bit buffer */
+};
+
+
+local int bits(struct state *s, int need)
+{
+    long val;           /* bit accumulator (can use up to 20 bits) */
+
+    /* load at least need bits into val */
+    val = s->bitbuf;
+    while (s->bitcnt < need) {
+        val |= (long)(s->in[s->incnt++]) << s->bitcnt;  /* load eight bits */
+        s->bitcnt += 8;
+    }
+
+    /* drop need bits and update buffer, always zero to seven bits left */
+    s->bitbuf = (int)(val >> need);
+    s->bitcnt -= need;
+
+    /* return need bits, zeroing the bits above that */
+    return (int)(val & ((1L << need) - 1));
+}
+
+
+local int stored(struct state *s)
+{
+    unsigned len;       /* length of stored block */
+
+    /* discard leftover bits from current byte (assumes s->bitcnt < 8) */
+    s->bitbuf = 0;
+    s->bitcnt = 0;
+
+    if (s->incnt + 4 > s->inlen)
+        return 2;                               /* not enough input */
+
+    /* get length and check against its one's complement */
+    len = s->in[s->incnt++];
+    len |= s->in[s->incnt++] << 8;
+    if (s->in[s->incnt++] != (~len & 0xff) ||
+        s->in[s->incnt++] != ((~len >> 8) & 0xff))
+        return -2;                              /* didn't match complement! */
+
+    if (s->incnt + len > s->inlen)
+        return 2;                               /* not enough input */
+
+    /* copy len bytes from in to out */
+    if (s->out != NIL) {
+        if (s->outcnt + len > s->outlen)
+            return 1;                           /* not enough output space */
+        while (len--)
+            s->out[s->outcnt++] = s->in[s->incnt++];
+    }
+    else {                                      /* just scanning */
+        s->outcnt += len;
+        s->incnt += len;
+    }
+
+    /* done with a valid stored block */
+    return 0;
+}
+
+
+struct huffman {
+    short *count;       /* number of symbols of each length */
+    short *symbol;      /* canonically ordered symbols */
+};
+
+/* reduce code size by using slow version of the decompressor */
+#define SLOW
+
+#ifdef SLOW
+local int decode(struct state *s, struct huffman *h)
+{
+    int len;            /* current number of bits in code */
+    int code;           /* len bits being decoded */
+    int first;          /* first code of length len */
+    int count;          /* number of codes of length len */
+    int index;          /* index of first code of length len in symbol table */
+
+    code = first = index = 0;
+    for (len = 1; len <= MAXBITS; len++) {
+        code |= bits(s, 1);             /* get next bit */
+        count = h->count[len];
+        if (code < first + count)       /* if length len, return symbol */
+            return h->symbol[index + (code - first)];
+        index += count;                 /* else update for next length */
+        first += count;
+        first <<= 1;
+        code <<= 1;
+    }
+    return -9;                          /* ran out of codes */
+}
+
+/*
+ * A faster version of decode() for real applications of this code.   It's not
+ * as readable, but it makes puff() twice as fast.  And it only makes the code
+ * a few percent larger.
+ */
+#else /* !SLOW */
+local int decode(struct state *s, struct huffman *h)
+{
+    int len;            /* current number of bits in code */
+    int code;           /* len bits being decoded */
+    int first;          /* first code of length len */
+    int count;          /* number of codes of length len */
+    int index;          /* index of first code of length len in symbol table */
+    int bitbuf;         /* bits from stream */
+    int left;           /* bits left in next or left to process */
+    short *next;        /* next number of codes */
+
+    bitbuf = s->bitbuf;
+    left = s->bitcnt;
+    code = first = index = 0;
+    len = 1;
+    next = h->count + 1;
+    while (1) {
+        while (left--) {
+            code |= bitbuf & 1;
+            bitbuf >>= 1;
+            count = *next++;
+            if (code < first + count) { /* if length len, return symbol */
+                s->bitbuf = bitbuf;
+                s->bitcnt = (s->bitcnt - len) & 7;
+                return h->symbol[index + (code - first)];
+            }
+            index += count;             /* else update for next length */
+            first += count;
+            first <<= 1;
+            code <<= 1;
+            len++;
+        }
+        left = (MAXBITS+1) - len;
+        if (left == 0) break;
+        bitbuf = s->in[s->incnt++];
+        if (left > 8) left = 8;
+    }
+    return -9;                          /* ran out of codes */
+}
+#endif /* SLOW */
+
+
+local int construct(struct huffman *h, short *length, int n)
+{
+    int symbol;         /* current symbol when stepping through length[] */
+    int len;            /* current length when stepping through h->count[] */
+    int left;           /* number of possible codes left of current length */
+    short offs[MAXBITS+1];      /* offsets in symbol table for each length */
+
+    /* count number of codes of each length */
+    for (len = 0; len <= MAXBITS; len++)
+        h->count[len] = 0;
+    for (symbol = 0; symbol < n; symbol++)
+        (h->count[length[symbol]])++;   /* assumes lengths are within bounds */
+    if (h->count[0] == n)               /* no codes! */
+        return 0;                       /* complete, but decode() will fail */
+
+    /* check for an over-subscribed or incomplete set of lengths */
+    left = 1;                           /* one possible code of zero length */
+    for (len = 1; len <= MAXBITS; len++) {
+        left <<= 1;                     /* one more bit, double codes left */
+        left -= h->count[len];          /* deduct count from possible codes */
+        if (left < 0) return left;      /* over-subscribed--return negative */
+    }                                   /* left > 0 means incomplete */
+
+    /* generate offsets into symbol table for each length for sorting */
+    offs[1] = 0;
+    for (len = 1; len < MAXBITS; len++)
+        offs[len + 1] = offs[len] + h->count[len];
+
+    /*
+     * put symbols in table sorted by length, by symbol order within each
+     * length
+     */
+    for (symbol = 0; symbol < n; symbol++)
+        if (length[symbol] != 0)
+            h->symbol[offs[length[symbol]]++] = symbol;
+
+    /* return zero for complete set, positive for incomplete set */
+    return left;
+}
+
+
+local int codes(struct state *s,
+                struct huffman *lencode,
+                struct huffman *distcode)
+{
+    int symbol;         /* decoded symbol */
+    int len;            /* length for copy */
+    unsigned dist;      /* distance for copy */
+    static const short lens[29] = { /* Size base for length codes 257..285 */
+        3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
+        35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
+    static const short lext[29] = { /* Extra bits for length codes 257..285 */
+        0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
+        3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
+    static const short dists[30] = { /* Offset base for distance codes 0..29 */
+        1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
+        257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
+        8193, 12289, 16385, 24577};
+    static const short dext[30] = { /* Extra bits for distance codes 0..29 */
+        0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
+        7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
+        12, 12, 13, 13};
+
+    /* decode literals and length/distance pairs */
+    do {
+        symbol = decode(s, lencode);
+        if (symbol < 0) return symbol;  /* invalid symbol */
+        if (symbol < 256) {             /* literal: symbol is the byte */
+            /* write out the literal */
+            if (s->out != NIL) {
+                if (s->outcnt == s->outlen) return 1;
+                s->out[s->outcnt] = symbol;
+            }
+            s->outcnt++;
+        }
+        else if (symbol > 256) {        /* length */
+            /* get and compute length */
+            symbol -= 257;
+            if (symbol >= 29) return -9;        /* invalid fixed code */
+            len = lens[symbol] + bits(s, lext[symbol]);
+
+            /* get and check distance */
+            symbol = decode(s, distcode);
+            if (symbol < 0) return symbol;          /* invalid symbol */
+            dist = dists[symbol] + bits(s, dext[symbol]);
+            if (dist > s->outcnt)
+                return -10;     /* distance too far back */
+
+            /* copy length bytes from distance bytes back */
+            if (s->out != NIL) {
+                if (s->outcnt + len > s->outlen) return 1;
+                while (len--) {
+                    s->out[s->outcnt] = s->out[s->outcnt - dist];
+                    s->outcnt++;
+                }
+            }
+            else
+                s->outcnt += len;
+        }
+    } while (symbol != 256);            /* end of block symbol */
+
+    /* done with a valid fixed or dynamic block */
+    return 0;
+}
+
+
+local int fixed(struct state *s)
+{
+    static int virgin = 1;
+    static short lencnt[MAXBITS+1], lensym[FIXLCODES];
+    static short distcnt[MAXBITS+1], distsym[MAXDCODES];
+    static struct huffman lencode = {lencnt, lensym};
+    static struct huffman distcode = {distcnt, distsym};
+
+    /* build fixed huffman tables if first call (may not be thread safe) */
+    if (virgin) {
+        int symbol;
+        short lengths[FIXLCODES];
+
+        /* literal/length table */
+        for (symbol = 0; symbol < 144; symbol++)
+            lengths[symbol] = 8;
+        for (; symbol < 256; symbol++)
+            lengths[symbol] = 9;
+        for (; symbol < 280; symbol++)
+            lengths[symbol] = 7;
+        for (; symbol < FIXLCODES; symbol++)
+            lengths[symbol] = 8;
+        construct(&lencode, lengths, FIXLCODES);
+
+        /* distance table */
+        for (symbol = 0; symbol < MAXDCODES; symbol++)
+            lengths[symbol] = 5;
+        construct(&distcode, lengths, MAXDCODES);
+
+        /* do this just once */
+        virgin = 0;
+    }
+
+    /* decode data until end-of-block code */
+    return codes(s, &lencode, &distcode);
+}
+
+
+local int dynamic(struct state *s)
+{
+    int nlen, ndist, ncode;             /* number of lengths in descriptor */
+    int index;                          /* index of lengths[] */
+    int err;                            /* construct() return value */
+    short lengths[MAXCODES];            /* descriptor code lengths */
+    short lencnt[MAXBITS+1], lensym[MAXLCODES];         /* lencode memory */
+    short distcnt[MAXBITS+1], distsym[MAXDCODES];       /* distcode memory */
+    struct huffman lencode = {lencnt, lensym};          /* length code */
+    struct huffman distcode = {distcnt, distsym};       /* distance code */
+    static const short order[19] =      /* permutation of code length codes */
+        {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
+
+    /* get number of lengths in each table, check lengths */
+    nlen = bits(s, 5) + 257;
+    ndist = bits(s, 5) + 1;
+    ncode = bits(s, 4) + 4;
+    if (nlen > MAXLCODES || ndist > MAXDCODES)
+        return -3;                      /* bad counts */
+
+    /* read code length code lengths (really), missing lengths are zero */
+    for (index = 0; index < ncode; index++)
+        lengths[order[index]] = bits(s, 3);
+    for (; index < 19; index++)
+        lengths[order[index]] = 0;
+
+    /* build huffman table for code lengths codes (use lencode temporarily) */
+    err = construct(&lencode, lengths, 19);
+    if (err != 0) return -4;            /* require complete code set here */
+
+    /* read length/literal and distance code length tables */
+    index = 0;
+    while (index < nlen + ndist) {
+        int symbol;             /* decoded value */
+        int len;                /* last length to repeat */
+
+        symbol = decode(s, &lencode);
+        if (symbol < 0)
+            return symbol;          /* invalid symbol */
+        if (symbol < 16)                /* length in 0..15 */
+            lengths[index++] = symbol;
+        else {                          /* repeat instruction */
+            len = 0;                    /* assume repeating zeros */
+            switch(symbol)
+            {
+               case 16: {         /* repeat last length 3..6 times */
+                  if (index == 0) return -5;      /* no last length! */
+                  len = lengths[index - 1];       /* last length */
+                  symbol = 3 + bits(s, 2);
+                  break;
+               }
+               case  17:      /* repeat zero 3..10 times */
+                  symbol = 3 + bits(s, 3);
+                  break;
+               default:                  /* == 18, repeat zero 11..138 times */
+                   symbol = 11 + bits(s, 7);
+                   break;
+             }
+            if ((index + symbol > nlen + ndist))
+                return -6;              /* too many lengths! */
+            while (symbol--)            /* repeat last or zero symbol times */
+                lengths[index++] = len;
+        }
+    }
+
+    /* check for end-of-block code -- there better be one! */
+    if (lengths[256] == 0)
+        return -9;
+
+    /* build huffman table for literal/length codes */
+    err = construct(&lencode, lengths, nlen);
+    if (err < 0 || (err > 0 && nlen - lencode.count[0] != 1))
+        return -7;      /* only allow incomplete codes if just one code */
+
+    /* build huffman table for distance codes */
+    err = construct(&distcode, lengths + nlen, ndist);
+    if (err < 0 || (err > 0 && ndist - distcode.count[0] != 1))
+        return -8;      /* only allow incomplete codes if just one code */
+
+    /* decode data until end-of-block code */
+    return codes(s, &lencode, &distcode);
+}
+
+
+void _acrtused () { }
+
+// Decompress deflated data
 int far main (
          unsigned char *dest,         /* pointer to destination pointer */
          unsigned int destlen,        /* amount of output space */
-         unsigned char *source)       /* pointer to source data pointer */
+         unsigned char *source,       /* pointer to source data pointer */
+         unsigned int sourcelen)
 {
     struct state s;             /* input/output state */
     int last, type;             /* block information */
@@ -417,6 +439,7 @@ int far main (
 
     /* initialize input state */
     s.in = source;
+    s.inlen = sourcelen;
     s.incnt = 0;
     s.bitbuf = 0;
     s.bitcnt = 0;
@@ -425,12 +448,24 @@ int far main (
 	do {
 		last = bits(&s, 1);         /* one if last block */
 		type = bits(&s, 2);         /* block type 0..3 */
-		err = type == 0 ? stored(&s) :
-			(type == 1 ? fixed(&s) :
-			(type == 2 ? dynamic(&s) :
-			-1));               /* type == 3, invalid */
+		switch(type)
+		{
+		case 0:
+			err = stored(&s);
+			break;
+		case 1:
+			err = fixed(&s);
+			break;
+		case 2:
+			err = dynamic(&s);
+			break;
+		default:
+			err = -1; /* type == 3, invalid */
+			break;
+		}
+
 		if (err != 0) break;        /* return with error */
 	} while (!last);
 
 	return err;
-}
+}

src/Boot/Windows/Makefile

@@ -39,6 +39,13 @@ OBJDIR = $(OBJDIR)_$(SINGLE_CIPHER)
 CFLAGS = $(CFLAGS) /D TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE /D TC_WINDOWS_BOOT_$(SINGLE_CIPHER)
 !endif
 
+!ifdef SINGLE_PRF
+OBJDIR = $(OBJDIR)_$(SINGLE_PRF)
+CFLAGS = $(CFLAGS) /D TC_WINDOWS_BOOT_$(SINGLE_PRF)
+!else
+CFLAGS = $(CFLAGS) /D TC_WINDOWS_BOOT_RIPEMD160
+!endif
+
 OUTDIR = $(OBJDIR)
 TARGETEXT = com
 TARGETS = $(OUTDIR)\BootDefs.i $(OUTDIR)\BootSector.bin $(OUTDIR)\Decompressor.com
@@ -72,7 +79,11 @@ OBJS = $(OBJS) $(OUTDIR)\Pkcs5.obj
 OBJS = $(OBJS) $(OUTDIR)\Volumes.obj
 OBJS = $(OBJS) $(OUTDIR)\Xts.obj
 
+!if "$(SINGLE_PRF)" == "SHA2"
+OBJS = $(OBJS) $(OUTDIR)\Sha2Small.obj
+!else
 OBJS = $(OBJS) $(OUTDIR)\Rmd160.obj
+!endif
 
 !if !DEFINED (SINGLE_CIPHER)
 OBJS = $(OBJS) $(OUTDIR)\AesSmall.obj

src/Build/Include/Makefile.inc

@@ -0,0 +1,65 @@
+#
+# Copyright (c) 2008 TrueCrypt Developers Association. All rights reserved.
+#
+# Governed by the TrueCrypt License 3.0 the full text of which is contained in
+# the file License.txt included in TrueCrypt binary and source code distribution
+# packages.
+#
+
+$(NAME): $(NAME).a
+
+clean:
+	@echo Cleaning $(NAME)
+	rm -f $(APPNAME) $(NAME).a $(OBJS) $(OBJSEX) $(OBJS:.o=.d) *.gch
+
+%.o: %.c
+	@echo Compiling $(<F)
+	$(CC) $(CFLAGS) -c $< -o $@
+
+%.o: %.cpp
+	@echo Compiling $(<F)
+	$(CXX) $(CXXFLAGS) -c $< -o $@
+
+ifeq "$(PLATFORM)" "MacOSX"
+%.o: %.asm
+	@echo Assembling $(<F)
+	$(AS) $(ASFLAGS) -f macho32 -o $@.32 $<
+	$(AS) $(ASFLAGS) -f macho64 -o $@.64 $<
+	lipo -create $@.32 $@.64 -output $@
+else
+%.o: %.asm
+	@echo Assembling $(<F)
+	$(AS) $(ASFLAGS) -o $@ $<
+endif
+
+# Precompiled headers
+%.h.gch: %.h
+	@echo Precompiling $(<F)
+	$(CXX) $(CXXFLAGS) -g0 -c $< || (rm -f $(<F).gch && exit 1)
+
+
+# Embedded files
+OD_BIN := od -v -t u1 -A n
+TR_SED_BIN := tr '\n' ' ' | tr -s ' ' ',' | sed -e 's/^,//g' -e 's/,$$/n/' | tr 'n' '\n'
+
+%.xml.h: %.xml
+	@echo Converting $(<F)
+	$(OD_BIN) $< | $(TR_SED_BIN) >$@
+
+%.txt.h: %.txt
+	@echo Converting $(<F)
+	$(OD_BIN) $< | $(TR_SED_BIN) >$@
+	
+%.bmp.h: %.bmp
+	@echo Converting $(<F)
+	$(OD_BIN) $< | $(TR_SED_BIN) >$@
+
+
+# Dependencies
+-include $(OBJS:.o=.d) $(OBJSEX:.oo=.d)
+
+
+$(NAME).a: $(OBJS) $(OBJSEX)
+	@echo Updating library $@
+	$(AR) $(AFLAGS) -rcu $@ $(OBJS) $(OBJSEX)
+	$(RANLIB) $@

src/Build/Resources/MacOSX/Info.plist.xml

@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist SYSTEM "file://localhost/System/Library/DTDs/PropertyList.dtd">
+<plist version="0.9">
+<dict>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+
+	<key>CFBundleIdentifier</key>
+	<string>org.idrix.VeraCrypt</string>
+
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+
+	<key>CFBundleExecutable</key>
+	<string>VeraCrypt</string>
+
+	<key>CFBundleIconFile</key>
+	<string>VeraCrypt.icns</string>
+
+	<key>CFBundleName</key>
+	<string>VeraCrypt</string>
+
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+
+	<key>CFBundleSignature</key>
+	<string>TRUE</string>
+
+	<key>CFBundleVersion</key>
+	<string>0</string>
+
+	<key>CFBundleShortVersionString</key>
+	<string>_VERSION_</string>
+
+	<key>CFBundleLongVersionString</key>
+	<string>VeraCrypt _VERSION_</string>
+
+	<key>LSRequiresCarbon</key>
+	<true/>
+
+	<key>CSResourcesFileMapped</key>
+	<true/>
+</dict>
+</plist>

src/Build/build_veracrypt_linux.sh

@@ -0,0 +1,29 @@
+# Absolute path to this script
+SCRIPT=$(readlink -f "$0")
+# Absolute path this script is in
+SCRIPTPATH=$(dirname "$SCRIPT")
+# source directory which contains the Makefile
+SOURCEPATH=$(readlink -f "$SCRIPTPATH/..")
+# directory where the VeraCrypt has been checked out
+PARENTDIR=$(readlink -f "$SCRIPTPATH/../../..")
+
+# Make sure only root can run our script
+if [ "$(id -u)" != "0" ]; then
+   echo "VeraCrypt must be built by root" 1>&2
+   exit 1
+fi
+
+# the sources of wxWidgets 3.0.2 must be extracted to the parent directory
+export WX_ROOT=$PARENTDIR/wxWidgets-3.0.2
+echo "Using wxWidgets sources in $WX_ROOT"
+
+# this will be the temporary wxWidgets directory
+export WX_BUILD_DIR=$PARENTDIR/wxBuild
+
+cd $SOURCEPATH
+
+echo "Building GUI version of VeraCrypt"
+make WXSTATIC=1 wxbuild && make WXSTATIC=1 clean && make WXSTATIC=1
+
+echo "Building console version of VeraCrypt"
+make WXSTATIC=1 NOGUI=1 wxbuild && make WXSTATIC=1 NOGUI=1 clean && make WXSTATIC=1 NOGUI=1

src/Build/build_veracrypt_macosx.sh

@@ -0,0 +1,24 @@
+# Absolute path this script is in
+SCRIPTPATH=$(cd "$(dirname "$0")"; pwd)
+# source directory which contains the Makefile
+SOURCEPATH=$(cd "$(dirname "$SCRIPTPATH/../.")"; pwd)
+# directory where the VeraCrypt project has been checked out
+PARENTDIR=$(cd "$(dirname "$SCRIPTPATH/../../../.")"; pwd)
+
+# the sources of wxWidgets 3.0.2 must be extracted to the parent directory
+export WX_ROOT=$PARENTDIR/wxWidgets-3.0.2
+echo "Using wxWidgets sources in $WX_ROOT"
+
+# this will be the temporary wxWidgets directory
+export WX_BUILD_DIR=$PARENTDIR/wxBuild
+
+# define the SDK version to use. We use 10.6 by default
+export VC_OSX_TARGET=10.6
+echo "Using MacOSX SDK $VC_OSX_TARGET"
+
+
+cd $SOURCEPATH
+
+echo "Building VeraCrypt"
+make WXSTATIC=1 wxbuild && make WXSTATIC=1 clean && make WXSTATIC=1
+

src/Common/Apidrvr.h

@@ -100,6 +100,9 @@ typedef struct
 	Password ProtectedHidVolPassword;	/* Password to the hidden volume to be protected against overwriting */
 	BOOL UseBackupHeader;
 	BOOL RecoveryMode;
+	int pkcs5_prf;
+	int ProtectedHidVolPkcs5Prf;
+	BOOL bTrueCryptMode;
 } MOUNT_STRUCT;
 
 typedef struct
@@ -117,6 +120,7 @@ typedef struct
 	unsigned __int64 diskLength[26];
 	int ea[26];
 	int volumeType[26];	/* Volume type (e.g. PROP_VOL_TYPE_OUTER, PROP_VOL_TYPE_OUTER_VOL_WRITE_PREVENTED, etc.) */
+	BOOL truecryptMode[26];
 } MOUNT_LIST_STRUCT;
 
 typedef struct
@@ -133,10 +137,6 @@ typedef struct
 	BOOL readOnly;
 	BOOL removable;
 	BOOL partitionInInactiveSysEncScope;
-#if 0
-	unsigned __int64 volumeCreationTime;	// Deprecated in v6.0
-	unsigned __int64 headerCreationTime;	// Deprecated in v6.0
-#endif
 	uint32 volumeHeaderFlags;
 	unsigned __int64 totalBytesRead;
 	unsigned __int64 totalBytesWritten;
@@ -239,12 +239,14 @@ typedef struct
 typedef struct
 {
 	Password VolumePassword;
+	int pkcs5_prf;
 } ReopenBootVolumeHeaderRequest;
 
 
 typedef struct
 {
 	char BootEncryptionAlgorithmName[256];
+	char BootPrfAlgorithmName[256];
 } GetBootEncryptionAlgorithmNameRequest;
 
 typedef struct

src/Common/BaseCom.cpp

@@ -15,7 +15,7 @@
 #include "Dlgcode.h"
 #include "Registry.h"
 
-using namespace TrueCrypt;
+using namespace VeraCrypt;
 
 HRESULT CreateElevatedComObject (HWND hwnd, REFGUID guid, REFIID iid, void **ppv)
 {
@@ -48,7 +48,7 @@ BOOL ComGetInstanceBase (HWND hWnd, REFCLSID clsid, REFIID iid, void **tcServer)
 		r = CoCreateInstance (clsid, NULL, CLSCTX_LOCAL_SERVER, iid, tcServer) == S_OK;
 
 	if (!r)
-		Error ("UAC_INIT_ERROR");
+		Error ("UAC_INIT_ERROR", hWnd);
 
 	return r;
 }
@@ -83,9 +83,8 @@ DWORD BaseCom::CallDriver (DWORD ioctl, BSTR input, BSTR *output)
 
 DWORD BaseCom::CopyFile (BSTR sourceFile, BSTR destinationFile)
 {
-	USES_CONVERSION;
 
-	if (!::CopyFile (CW2A (sourceFile), CW2A (destinationFile), FALSE))
+	if (!::CopyFileW (sourceFile, destinationFile, FALSE))
 		return GetLastError();
 
 	return ERROR_SUCCESS;
@@ -94,9 +93,8 @@ DWORD BaseCom::CopyFile (BSTR sourceFile, BSTR destinationFile)
 
 DWORD BaseCom::DeleteFile (BSTR file)
 {
-	USES_CONVERSION;
 
-	if (!::DeleteFile (CW2A (file)))
+	if (!::DeleteFileW (file))
 		return GetLastError();
 
 	return ERROR_SUCCESS;
@@ -112,10 +110,15 @@ BOOL BaseCom::IsPagingFileActive (BOOL checkNonWindowsPartitionsOnly)
 DWORD BaseCom::ReadWriteFile (BOOL write, BOOL device, BSTR filePath, BSTR *bufferBstr, unsigned __int64 offset, unsigned __int32 size, DWORD *sizeDone)
 {
 	USES_CONVERSION;
+	CW2A szFilePathA(filePath);
+	if (!szFilePathA.m_psz)
+	{
+		return ERROR_NOT_ENOUGH_MEMORY;
+	}
 
 	try
 	{
-		auto_ptr <File> file (device ? new Device (string (CW2A (filePath)), !write) : new File (string (CW2A (filePath)), !write));
+		auto_ptr <File> file (device ? new Device (string (szFilePathA.m_psz), !write) : new File (string (szFilePathA.m_psz), !write));
 		file->SeekAt (offset);
 
 		if (write)
@@ -223,8 +226,7 @@ DWORD BaseCom::SetDriverServiceStartType (DWORD startType)
 
 DWORD BaseCom::WriteLocalMachineRegistryDwordValue (BSTR keyPath, BSTR valueName, DWORD value)
 {
-	USES_CONVERSION;
-	if (!::WriteLocalMachineRegistryDword (CW2A (keyPath), CW2A (valueName), value))
+	if (!::WriteLocalMachineRegistryDwordW (keyPath, valueName, value))
 		return GetLastError();
 
 	return ERROR_SUCCESS;

src/Common/BootEncryption.cpp

@@ -32,7 +32,9 @@
 #include "Mount/MainCom.h"
 #endif
 
-namespace TrueCrypt
+#include <Strsafe.h>
+
+namespace VeraCrypt
 {
 #if !defined (SETUP)
 
@@ -373,8 +375,16 @@ namespace TrueCrypt
 		RescueIsoImage (nullptr),
 		RescueVolumeHeaderValid (false),
 		SelectedEncryptionAlgorithmId (0),
+		SelectedPrfAlgorithmId (0),
 		VolumeHeaderValid (false)
 	{
+      HiddenOSCandidatePartition.IsGPT = FALSE;
+      HiddenOSCandidatePartition.Number = (size_t) -1;
+      DriveConfig.DriveNumber = -1;
+      DriveConfig.ExtraBootPartitionPresent = false;
+      DriveConfig.SystemLoaderPresent = false;
+      DriveConfig.InitialUnallocatedSpace = 0;
+      DriveConfig.TotalUnallocatedSpace = 0;
 		Elevator::AddReference();
 	}
 
@@ -597,7 +607,7 @@ namespace TrueCrypt
 		GetSystemDriveConfiguration();
 
 		ProbeRealDriveSizeRequest request;
-		_snwprintf (request.DeviceName, array_capacity (request.DeviceName), L"%hs", DriveConfig.DrivePartition.DevicePath.c_str());
+		StringCbPrintfW (request.DeviceName, sizeof (request.DeviceName), L"%hs", DriveConfig.DrivePartition.DevicePath.c_str());
 		
 		CallDriver (TC_IOCTL_PROBE_REAL_DRIVE_SIZE, &request, sizeof (request), &request, sizeof (request));
 		DriveConfig.DrivePartition.Info.PartitionLength = request.RealDriveSize;
@@ -626,7 +636,7 @@ namespace TrueCrypt
 			partPath << "\\Device\\Harddisk" << driveNumber << "\\Partition" << partNumber;
 
 			DISK_PARTITION_INFO_STRUCT diskPartInfo;
-			_snwprintf (diskPartInfo.deviceName, array_capacity (diskPartInfo.deviceName), L"%hs", partPath.str().c_str());
+			StringCbPrintfW (diskPartInfo.deviceName, sizeof (diskPartInfo.deviceName), L"%hs", partPath.str().c_str());
 
 			try
 			{
@@ -656,7 +666,7 @@ namespace TrueCrypt
 
 			// Volume ID
 			wchar_t volumePath[TC_MAX_PATH];
-			if (ResolveSymbolicLink ((wchar_t *) ws.str().c_str(), volumePath))
+			if (ResolveSymbolicLink ((wchar_t *) ws.str().c_str(), volumePath, sizeof(volumePath)))
 			{
 				wchar_t volumeName[TC_MAX_PATH];
 				HANDLE fh = FindFirstVolumeW (volumeName, array_capacity (volumeName));
@@ -735,8 +745,8 @@ namespace TrueCrypt
 			memset (&openTestStruct, 0, sizeof (openTestStruct));
 			DWORD dwResult;
 
-			strcpy ((char *) &openTestStruct.wszFileName[0], devicePath);
-			ToUNICODE ((char *) &openTestStruct.wszFileName[0]);
+			StringCbCopyA ((char *) &openTestStruct.wszFileName[0], sizeof(openTestStruct.wszFileName),devicePath);
+			ToUNICODE ((char *) &openTestStruct.wszFileName[0], sizeof(openTestStruct.wszFileName));
 
 			openTestStruct.bDetectTCBootLoader = TRUE;
 
@@ -837,7 +847,7 @@ namespace TrueCrypt
 	bool BootEncryption::SystemDriveIsDynamic ()
 	{
 		GetSystemDriveConfigurationRequest request;
-		_snwprintf (request.DevicePath, array_capacity (request.DevicePath), L"%hs", GetSystemDriveConfiguration().DeviceKernelPath.c_str());
+		StringCbPrintfW (request.DevicePath, sizeof (request.DevicePath), L"%hs", GetSystemDriveConfiguration().DeviceKernelPath.c_str());
 
 		CallDriver (TC_IOCTL_GET_SYSTEM_DRIVE_CONFIG, &request, sizeof (request), &request, sizeof (request));
 		return request.DriveIsDynamic ? true : false;
@@ -966,11 +976,16 @@ namespace TrueCrypt
 		ZeroMemory (buffer, bufferSize);
 
 		int ea = 0;
+		int pkcs5_prf = 0;
 		if (GetStatus().DriveMounted)
 		{
 			try
 			{
 				GetBootEncryptionAlgorithmNameRequest request;
+				// since we added new field to GetBootEncryptionAlgorithmNameRequest since version 1.0f
+				// we zero all the structure so that if we are talking to an older driver, the field
+				// BootPrfAlgorithmName will be an empty string
+				ZeroMemory(&request, sizeof(request));
 				CallDriver (TC_IOCTL_GET_BOOT_ENCRYPTION_ALGORITHM_NAME, NULL, 0, &request, sizeof (request));
 
 				if (_stricmp (request.BootEncryptionAlgorithmName, "AES") == 0)
@@ -979,6 +994,13 @@ namespace TrueCrypt
 					ea = SERPENT;
 				else if (_stricmp (request.BootEncryptionAlgorithmName, "Twofish") == 0)
 					ea = TWOFISH;
+
+				if (_stricmp(request.BootPrfAlgorithmName, "SHA-256") == 0)
+					pkcs5_prf = SHA256;
+				else if (_stricmp(request.BootPrfAlgorithmName, "RIPEMD-160") == 0)
+					pkcs5_prf = RIPEMD160;
+				else if (strlen(request.BootPrfAlgorithmName) == 0) // case of version < 1.0f
+					pkcs5_prf = RIPEMD160;
 			}
 			catch (...)
 			{
@@ -987,36 +1009,77 @@ namespace TrueCrypt
 					VOLUME_PROPERTIES_STRUCT properties;
 					GetVolumeProperties (&properties);
 					ea = properties.ea;
+					pkcs5_prf = properties.pkcs5;
 				}
 				catch (...) { }
 			}
 		}
 		else
 		{
-			if (SelectedEncryptionAlgorithmId == 0)
+			if (SelectedEncryptionAlgorithmId == 0 || SelectedPrfAlgorithmId == 0)
 				throw ParameterIncorrect (SRC_POS);
 
 			ea = SelectedEncryptionAlgorithmId;
+			pkcs5_prf = SelectedPrfAlgorithmId;
 		}
 
-		int bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR : IDR_BOOT_SECTOR;
-		int bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER : IDR_BOOT_LOADER;
+		// Only RIPEMD160 and SHA-256 are supported for boot loader
+		if (pkcs5_prf != RIPEMD160 && pkcs5_prf != SHA256)
+			throw ParameterIncorrect (SRC_POS);
+
+		int bootSectorId = 0;
+		int bootLoaderId = 0;
+
+		if (pkcs5_prf == SHA256)
+		{
+			bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_SHA2 : IDR_BOOT_SECTOR_SHA2;
+			bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_SHA2 : IDR_BOOT_LOADER_SHA2;
+		}
+		else
+		{
+			bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR : IDR_BOOT_SECTOR;
+			bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER : IDR_BOOT_LOADER;
+		}
 
 		switch (ea)
 		{
 		case AES:
-			bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_AES : IDR_BOOT_SECTOR_AES;
-			bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_AES : IDR_BOOT_LOADER_AES;
+			if (pkcs5_prf == SHA256)
+			{
+				bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_AES_SHA2 : IDR_BOOT_SECTOR_AES_SHA2;
+				bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_AES_SHA2 : IDR_BOOT_LOADER_AES_SHA2;
+			}
+			else
+			{
+				bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_AES : IDR_BOOT_SECTOR_AES;
+				bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_AES : IDR_BOOT_LOADER_AES;
+			}
 			break;
 
 		case SERPENT:
-			bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_SERPENT : IDR_BOOT_SECTOR_SERPENT;
-			bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_SERPENT : IDR_BOOT_LOADER_SERPENT;
+			if (pkcs5_prf == SHA256)
+			{
+				bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_SERPENT_SHA2 : IDR_BOOT_SECTOR_SERPENT_SHA2;
+				bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_SERPENT_SHA2 : IDR_BOOT_LOADER_SERPENT_SHA2;
+			}
+			else
+			{
+				bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_SERPENT : IDR_BOOT_SECTOR_SERPENT;
+				bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_SERPENT : IDR_BOOT_LOADER_SERPENT;
+			}
 			break;
 
 		case TWOFISH:
-			bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_TWOFISH : IDR_BOOT_SECTOR_TWOFISH;
-			bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_TWOFISH : IDR_BOOT_LOADER_TWOFISH;
+			if (pkcs5_prf == SHA256)
+			{
+				bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_TWOFISH_SHA2 : IDR_BOOT_SECTOR_TWOFISH_SHA2;
+				bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_TWOFISH_SHA2 : IDR_BOOT_LOADER_TWOFISH_SHA2;
+			}
+			else
+			{
+				bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_TWOFISH : IDR_BOOT_SECTOR_TWOFISH;
+				bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_TWOFISH : IDR_BOOT_LOADER_TWOFISH;
+			}
 			break;
 		}
 
@@ -1075,7 +1138,7 @@ namespace TrueCrypt
 
 			buffer[TC_BOOT_SECTOR_CONFIG_OFFSET] |= TC_BOOT_CFG_FLAG_BACKUP_LOADER_AVAILABLE;
 		}
-		else if (!rescueDisk && bootLoaderId != IDR_BOOT_LOADER)
+		else if (!rescueDisk && bootLoaderId != IDR_BOOT_LOADER && bootLoaderId != IDR_BOOT_LOADER_SHA2)
 		{
 			throw ParameterIncorrect (SRC_POS);
 		}
@@ -1088,7 +1151,7 @@ namespace TrueCrypt
 			throw ParameterIncorrect (SRC_POS);
 
 		GetSystemDriveConfigurationRequest request;
-		_snwprintf (request.DevicePath, array_capacity (request.DevicePath), L"%hs", GetSystemDriveConfiguration().DeviceKernelPath.c_str());
+		StringCbPrintfW (request.DevicePath, sizeof (request.DevicePath), L"%hs", GetSystemDriveConfiguration().DeviceKernelPath.c_str());
 
 		try
 		{
@@ -1227,9 +1290,12 @@ namespace TrueCrypt
 		if (Randinit() != ERR_SUCCESS)
 			throw ParameterIncorrect (SRC_POS);
 
+		/* force the display of the random enriching dialog */
+		SetRandomPoolEnrichedByUserStatus (FALSE);
+
 		UserEnrichRandomPool (ParentWindow);
 
-		if (!RandgetBytes (request.WipeKey, sizeof (request.WipeKey), TRUE))
+		if (!RandgetBytes (ParentWindow, request.WipeKey, sizeof (request.WipeKey), TRUE))
 			throw ParameterIncorrect (SRC_POS);
 
 		CallDriver (TC_IOCTL_START_DECOY_SYSTEM_WIPE, &request, sizeof (request), NULL, 0);
@@ -1282,7 +1348,7 @@ namespace TrueCrypt
 #endif
 
 		byte randData[PRAND_DISK_WIPE_PASSES];
-		if (!RandgetBytes (randData, sizeof (randData), FALSE))
+		if (!RandgetBytes (ParentWindow, randData, sizeof (randData), FALSE))
 			throw ParameterIncorrect (SRC_POS);
 
 		for (int wipePass = 0; wipePass < PRAND_DISK_WIPE_PASSES; wipePass++)
@@ -1395,8 +1461,10 @@ namespace TrueCrypt
 		memset (image, 0, RescueIsoImageSize);
 
 		// Primary volume descriptor
-		strcpy ((char *)image + 0x8000, "\001CD001\001");
-		strcpy ((char *)image + 0x7fff + 41, "VeraCrypt Rescue Disk           ");
+		const char* szPrimVolDesc = "\001CD001\001";
+		const char* szPrimVolLabel = "VeraCrypt Rescue Disk           ";
+		memcpy (image + 0x8000, szPrimVolDesc, strlen(szPrimVolDesc) + 1);
+		memcpy (image + 0x7fff + 41, szPrimVolLabel, strlen(szPrimVolLabel) + 1);
 		*(uint32 *) (image + 0x7fff + 81) = RescueIsoImageSize / 2048;
 		*(uint32 *) (image + 0x7fff + 85) = BE32 (RescueIsoImageSize / 2048);
 		image[0x7fff + 121] = 1;
@@ -1413,11 +1481,13 @@ namespace TrueCrypt
 		image[0x7fff + 159] = 0x18;
 
 		// Boot record volume descriptor
-		strcpy ((char *)image + 0x8801, "CD001\001EL TORITO SPECIFICATION");
+		const char* szBootRecDesc = "CD001\001EL TORITO SPECIFICATION";
+		memcpy (image + 0x8801, szBootRecDesc, strlen(szBootRecDesc) + 1);
 		image[0x8800 + 0x47] = 0x19;
 
 		// Volume descriptor set terminator
-		strcpy ((char *)image + 0x9000, "\377CD001\001");
+		const char* szVolDescTerm = "\377CD001\001";
+		memcpy (image + 0x9000, szVolDescTerm, strlen(szVolDescTerm) + 1);
 
 		// Path table
 		image[0xA000 + 0] = 1;
@@ -1487,7 +1557,7 @@ namespace TrueCrypt
 		catch (Exception &e)
 		{
 			e.Show (ParentWindow);
-			Warning ("SYS_LOADER_UNAVAILABLE_FOR_RESCUE_DISK");
+			Warning ("SYS_LOADER_UNAVAILABLE_FOR_RESCUE_DISK", ParentWindow);
 		}
 		
 		// Boot loader backup
@@ -1561,14 +1631,14 @@ namespace TrueCrypt
 		if (!IsRandomNumberGeneratorStarted())
 			throw ParameterIncorrect (SRC_POS);
 
-		throw_sys_if (CreateVolumeHeaderInMemory (TRUE, (char *) VolumeHeader, ea, mode, password, pkcs5, NULL, &cryptoInfo,
+		throw_sys_if (CreateVolumeHeaderInMemory (ParentWindow, TRUE, (char *) VolumeHeader, ea, mode, password, pkcs5, NULL, &cryptoInfo,
 			volumeSize, 0, encryptedAreaStart, 0, TC_SYSENC_KEYSCOPE_MIN_REQ_PROG_VERSION, TC_HEADER_FLAG_ENCRYPTED_SYSTEM, TC_SECTOR_SIZE_BIOS, FALSE) != 0);
 
 		finally_do_arg (PCRYPTO_INFO*, &cryptoInfo, { crypto_close (*finally_arg); });
 
 		// Initial rescue disk assumes encryption of the drive has been completed (EncryptedAreaLength == volumeSize)
 		memcpy (RescueVolumeHeader, VolumeHeader, sizeof (RescueVolumeHeader));
-		ReadVolumeHeader (TRUE, (char *) RescueVolumeHeader, password, NULL, cryptoInfo);
+		ReadVolumeHeader (TRUE, (char *) RescueVolumeHeader, password, pkcs5, FALSE, NULL, cryptoInfo);
 
 		DecryptBuffer (RescueVolumeHeader + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, cryptoInfo);
 
@@ -1638,7 +1708,7 @@ namespace TrueCrypt
 		{
 			if (memcmp (bootLoaderBuf + i, TC_APP_NAME, strlen (TC_APP_NAME)) == 0)
 			{
-				if (AskWarnNoYes ("TC_BOOT_LOADER_ALREADY_INSTALLED") == IDNO)
+				if (AskWarnNoYes ("TC_BOOT_LOADER_ALREADY_INSTALLED", ParentWindow) == IDNO)
 					throw UserAbort (SRC_POS);
 				return;
 			}
@@ -1715,7 +1785,7 @@ namespace TrueCrypt
 			DWORD size = sizeof (regKeyBuf) - strSize;
 
 			// SetupInstallFromInfSection() does not support prepending of values so we have to modify the registry directly
-			strncpy ((char *) regKeyBuf, filter.c_str(), sizeof (regKeyBuf));
+			StringCbCopyA ((char *) regKeyBuf, sizeof(regKeyBuf), filter.c_str());
 
 			if (RegQueryValueEx (regKey, filterReg.c_str(), NULL, NULL, regKeyBuf + strSize, &size) != ERROR_SUCCESS)
 				size = 1;
@@ -1904,7 +1974,7 @@ namespace TrueCrypt
 		{
 			static bool confirmed = false;
 
-			if (!confirmed && AskWarnNoYes ("WINDOWS_NOT_ON_BOOT_DRIVE_ERROR") == IDNO)
+			if (!confirmed && AskWarnNoYes ("WINDOWS_NOT_ON_BOOT_DRIVE_ERROR", ParentWindow) == IDNO)
 				throw UserAbort (SRC_POS);
 
 			confirmed = true;
@@ -1952,7 +2022,7 @@ namespace TrueCrypt
 				+ GetString ("LEAKS_OUTSIDE_SYSPART_UNIVERSAL_EXPLANATION")
 				+ L"\n\n\n"
 				+ GetString ("RESTRICT_PAGING_FILES_TO_SYS_PARTITION")
-				).c_str()) == IDYES)
+				).c_str(), ParentWindow) == IDYES)
 			{
 				RestrictPagingFilesToSystemPartition();
 				RestartComputer();
@@ -2047,11 +2117,11 @@ namespace TrueCrypt
 	}
 
 
-	int BootEncryption::ChangePassword (Password *oldPassword, Password *newPassword, int pkcs5)
+	int BootEncryption::ChangePassword (Password *oldPassword, int old_pkcs5,Password *newPassword, int pkcs5, int wipePassCount, HWND hwndDlg)
 	{
 		BootEncryptionStatus encStatus = GetStatus();
 
-		if (encStatus.SetupInProgress)
+		if (encStatus.SetupInProgress || (wipePassCount <= 0))
 			throw ParameterIncorrect (SRC_POS);
 
 		SystemDriveConfiguration config = GetSystemDriveConfiguration ();
@@ -2089,12 +2159,12 @@ namespace TrueCrypt
 
 		PCRYPTO_INFO cryptoInfo = NULL;
 		
-		int status = ReadVolumeHeader (!encStatus.HiddenSystem, header, oldPassword, &cryptoInfo, NULL);
+		int status = ReadVolumeHeader (!encStatus.HiddenSystem, header, oldPassword, old_pkcs5, FALSE, &cryptoInfo, NULL);
 		finally_do_arg (PCRYPTO_INFO, cryptoInfo, { if (finally_arg) crypto_close (finally_arg); });
 
 		if (status != 0)
 		{
-			handleError (ParentWindow, status);
+			handleError (hwndDlg, status);
 			return status;
 		}
 
@@ -2108,11 +2178,14 @@ namespace TrueCrypt
 		throw_sys_if (Randinit () != 0);
 		finally_do ({ RandStop (FALSE); });
 
+		/* force the display of the random enriching dialog */
+		SetRandomPoolEnrichedByUserStatus (FALSE);
+
 		NormalCursor();
-		UserEnrichRandomPool (ParentWindow);
+		UserEnrichRandomPool (hwndDlg);
 		WaitCursor();
 
-		/* The header will be re-encrypted PRAND_DISK_WIPE_PASSES times to prevent adversaries from using 
+		/* The header will be re-encrypted wipePassCount times to prevent adversaries from using 
 		techniques such as magnetic force microscopy or magnetic force scanning tunnelling microscopy
 		to recover the overwritten header. According to Peter Gutmann, data should be overwritten 22
 		times (ideally, 35 times) using non-random patterns and pseudorandom data. However, as users might
@@ -2132,11 +2205,11 @@ namespace TrueCrypt
 			BOOL backupHeader = FALSE;
 			while (TRUE)
 			{
-				for (int wipePass = 0; wipePass < PRAND_DISK_WIPE_PASSES; wipePass++)
+				for (int wipePass = 0; wipePass < wipePassCount; wipePass++)
 				{
 					PCRYPTO_INFO tmpCryptoInfo = NULL;
 
-					status = CreateVolumeHeaderInMemory (!encStatus.HiddenSystem,
+					status = CreateVolumeHeaderInMemory (hwndDlg, !encStatus.HiddenSystem,
 						header,
 						cryptoInfo->ea,
 						cryptoInfo->mode,
@@ -2151,14 +2224,14 @@ namespace TrueCrypt
 						cryptoInfo->RequiredProgramVersion,
 						cryptoInfo->HeaderFlags | TC_HEADER_FLAG_ENCRYPTED_SYSTEM,
 						cryptoInfo->SectorSize,
-						wipePass < PRAND_DISK_WIPE_PASSES - 1);
+						wipePass < wipePassCount - 1);
 
 					if (tmpCryptoInfo)
 						crypto_close (tmpCryptoInfo);
 
 					if (status != 0)
 					{
-						handleError (ParentWindow, status);
+						handleError (hwndDlg, status);
 						return status;
 					}
 
@@ -2176,7 +2249,7 @@ namespace TrueCrypt
 		}
 		catch (Exception &e)
 		{
-			e.Show (ParentWindow);
+			e.Show (hwndDlg);
 			result = ERR_OS_ERROR;
 		}
 
@@ -2184,6 +2257,7 @@ namespace TrueCrypt
 		{
 			ReopenBootVolumeHeaderRequest reopenRequest;
 			reopenRequest.VolumePassword = *newPassword;
+			reopenRequest.pkcs5_prf = cryptoInfo->pkcs5;
 			finally_do_arg (ReopenBootVolumeHeaderRequest*, &reopenRequest, { burn (finally_arg, sizeof (*finally_arg)); });
 
 			CallDriver (TC_IOCTL_REOPEN_BOOT_VOLUME_HEADER, &reopenRequest, sizeof (reopenRequest));
@@ -2240,6 +2314,7 @@ namespace TrueCrypt
 		BackupSystemLoader();
 
 		SelectedEncryptionAlgorithmId = ea;
+		SelectedPrfAlgorithmId = pkcs5;
 	}
 
 
@@ -2271,7 +2346,7 @@ namespace TrueCrypt
 				if (e.ErrorCode != ERROR_CRC)
 				{
 					e.Show (ParentWindow);
-					Error ("WHOLE_DRIVE_ENCRYPTION_PREVENTED_BY_DRIVERS");
+					Error ("WHOLE_DRIVE_ENCRYPTION_PREVENTED_BY_DRIVERS", ParentWindow);
 					throw UserAbort (SRC_POS);
 				}
 			}
@@ -2294,6 +2369,7 @@ namespace TrueCrypt
 		}
 
 		SelectedEncryptionAlgorithmId = ea;
+		SelectedPrfAlgorithmId = pkcs5;
 		CreateVolumeHeader (volumeSize, encryptedAreaStart, &password, ea, mode, pkcs5);
 		
 		if (!rescueIsoImagePath.empty())
@@ -2311,7 +2387,7 @@ namespace TrueCrypt
 	void BootEncryption::RestrictPagingFilesToSystemPartition ()
 	{
 		char pagingFiles[128];
-		strncpy (pagingFiles, "X:\\pagefile.sys 0 0", sizeof (pagingFiles));
+		StringCbCopyA (pagingFiles, sizeof(pagingFiles), "X:\\pagefile.sys 0 0");
 		pagingFiles[0] = GetWindowsDirectory()[0];
 
 		throw_sys_if (!WriteLocalMachineRegistryMultiString ("System\\CurrentControlSet\\Control\\Session Manager\\Memory Management", "PagingFiles", pagingFiles, strlen (pagingFiles) + 2));

src/Common/BootEncryption.h

@@ -17,12 +17,12 @@
 
 using namespace std;
 
-namespace TrueCrypt
+namespace VeraCrypt
 {
 	class File
 	{
 	public:
-		File () : FileOpen (false) { }
+		File () : Elevated (false), FileOpen (false), FilePointerPosition(0), Handle(NULL), IsDevice(false) { }
 		File (string path, bool readOnly = false, bool create = false);
 		~File () { Close(); }
 
@@ -141,7 +141,7 @@ namespace TrueCrypt
 		void AbortSetup ();
 		void AbortSetupWait ();
 		void CallDriver (DWORD ioctl, void *input = nullptr, DWORD inputSize = 0, void *output = nullptr, DWORD outputSize = 0);
-		int ChangePassword (Password *oldPassword, Password *newPassword, int pkcs5);
+		int ChangePassword (Password *oldPassword, int old_pkcs5, Password *newPassword, int pkcs5, int wipePassCount, HWND hwndDlg);
 		void CheckDecoyOSWipeResult ();
 		void CheckEncryptionSetupResult ();
 		void CheckRequirements ();
@@ -215,6 +215,7 @@ namespace TrueCrypt
 		HWND ParentWindow;
 		SystemDriveConfiguration DriveConfig;
 		int SelectedEncryptionAlgorithmId;
+		int SelectedPrfAlgorithmId;
 		Partition HiddenOSCandidatePartition;
 		byte *RescueIsoImage;
 		byte RescueVolumeHeader[TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE];

src/Common/Cache.c

@@ -21,7 +21,7 @@ Password CachedPasswords[CACHE_SIZE];
 int cacheEmpty = 1;
 static int nPasswordIdx = 0;
 
-int ReadVolumeHeaderWCache (BOOL bBoot, BOOL bCache, char *header, Password *password, PCRYPTO_INFO *retInfo)
+int ReadVolumeHeaderWCache (BOOL bBoot, BOOL bCache, char *header, Password *password, int pkcs5_prf, BOOL truecryptMode, PCRYPTO_INFO *retInfo)
 {
 	int nReturnCode = ERR_PASSWORD_WRONG;
 	int i;
@@ -29,7 +29,7 @@ int ReadVolumeHeaderWCache (BOOL bBoot, BOOL bCache, char *header, Password *pas
 	/* Attempt to recognize volume using mount password */
 	if (password->Length > 0)
 	{
-		nReturnCode = ReadVolumeHeader (bBoot, header, password, retInfo, NULL);
+		nReturnCode = ReadVolumeHeader (bBoot, header, password, pkcs5_prf, truecryptMode, retInfo, NULL);
 
 		/* Save mount passwords back into cache if asked to do so */
 		if (bCache && (nReturnCode == 0 || nReturnCode == ERR_CIPHER_INIT_WEAK_KEY))
@@ -59,7 +59,7 @@ int ReadVolumeHeaderWCache (BOOL bBoot, BOOL bCache, char *header, Password *pas
 		{
 			if (CachedPasswords[i].Length > 0)
 			{
-				nReturnCode = ReadVolumeHeader (bBoot, header, &CachedPasswords[i], retInfo, NULL);
+				nReturnCode = ReadVolumeHeader (bBoot, header, &CachedPasswords[i], pkcs5_prf, truecryptMode, retInfo, NULL);
 
 				if (nReturnCode != ERR_PASSWORD_WRONG)
 					break;

src/Common/Cache.h

@@ -19,5 +19,5 @@
 extern int cacheEmpty;
 
 void AddPasswordToCache (Password *password);
-int ReadVolumeHeaderWCache (BOOL bBoot, BOOL bCache, char *header, Password *password, PCRYPTO_INFO *retInfo);
+int ReadVolumeHeaderWCache (BOOL bBoot, BOOL bCache, char *header, Password *password, int pkcs5_prf, BOOL truecryptMode, PCRYPTO_INFO *retInfo);
 void WipeCache (void);

src/Common/Cmdline.c

@@ -20,6 +20,7 @@
 #include "Apidrvr.h"
 #include "Dlgcode.h"
 #include "Language.h"
+#include <Strsafe.h>
 
 /* Except in response to the WM_INITDIALOG message, the dialog box procedure
    should return nonzero if it processes the message, and zero if it does
@@ -44,17 +45,19 @@ BOOL CALLBACK CommandHelpDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM
 
 		*tmp = 0;
 
-		strcpy (tmp, "Command line options:\n\n");
+		StringCbCopyA (tmp, 8192, "Command line options:\n\n");
 		for (i = 0; i < as->arg_cnt; i ++)
 		{
 			if (!as->args[i].Internal)
 			{
-				sprintf(tmp2, "%s\t%s\n", as->args[i].short_name, as->args[i].long_name);
-				strcat(tmp,tmp2);
+				StringCchPrintf(tmp2, MAX_PATH * 2, "%s\t%s\n", as->args[i].short_name, as->args[i].long_name);
+				StringCchCat(tmp, 8192, tmp2);
 			}
 		}
 
 		SetWindowText (GetDlgItem (hwndDlg, IDC_COMMANDHELP_TEXT), (char*) tmp);
+		
+		TCfree(tmp);
 		return 1;
 		}
 
@@ -218,7 +221,7 @@ int GetArgumentValue (char **lpszCommandLineArgs, int nArgPos, int *nArgIdx,
 	{
 		/* Handles the case of no space between parameter code and
 		   value */
-		strncpy (lpszValue, &lpszCommandLineArgs[*nArgIdx][nArgPos], nValueSize);
+		StringCbCopyA (lpszValue, nValueSize, &lpszCommandLineArgs[*nArgIdx][nArgPos]);
 		lpszValue[nValueSize - 1] = 0;
 		return HAS_ARGUMENT;
 	}
@@ -229,7 +232,7 @@ int GetArgumentValue (char **lpszCommandLineArgs, int nArgPos, int *nArgIdx,
 		{
 			/* Handles the case of space between parameter code
 			   and value */
-			strncpy (lpszValue, &lpszCommandLineArgs[*nArgIdx + 1][x], nValueSize);
+			StringCbCopyA (lpszValue, nValueSize, &lpszCommandLineArgs[*nArgIdx + 1][x]);
 			lpszValue[nValueSize - 1] = 0;
 			(*nArgIdx)++;
 			return HAS_ARGUMENT;

src/Common/Common.h

@@ -43,7 +43,6 @@ enum
 {
 	TC_VOLUME_TYPE_NORMAL = 0,
 	TC_VOLUME_TYPE_HIDDEN,
-	TC_VOLUME_TYPE_HIDDEN_LEGACY,
 	TC_VOLUME_TYPE_COUNT
 };
 
@@ -76,6 +75,7 @@ typedef struct
 	Password ProtectedHidVolPassword;	/* Password of hidden volume to protect against overwriting */
 	BOOL UseBackupHeader;
 	BOOL RecoveryMode;
+	int ProtectedHidVolPkcs5Prf;
 } MountOptions;
 
 #endif

src/Common/Common.rc

@@ -65,7 +65,7 @@ BEGIN
     PUSHBUTTON      "Cancel",IDCANCEL,248,190,50,14
 END
 
-IDD_MOUNT_OPTIONS DIALOGEX 0, 0, 277, 172
+IDD_MOUNT_OPTIONS DIALOGEX 0, 0, 277, 204
 STYLE DS_SETFONT | DS_MODALFRAME | DS_FIXEDSYS | DS_CENTER | WS_POPUP | WS_CAPTION | WS_SYSMENU
 CAPTION "VeraCrypt - Mount Options"
 FONT 8, "MS Shell Dlg", 400, 0, 0x1
@@ -78,16 +78,18 @@ BEGIN
     CONTROL         "&Protect hidden volume against damage caused by writing to outer volume",IDC_PROTECT_HIDDEN_VOL,
                     "Button",BS_AUTOCHECKBOX | WS_TABSTOP,16,86,252,10
     EDITTEXT        IDC_PASSWORD_PROT_HIDVOL,112,104,151,14,ES_PASSWORD | ES_AUTOHSCROLL
-    CONTROL         "&Display password",IDC_SHOW_PASSWORD_MO,"Button",BS_AUTOCHECKBOX | WS_TABSTOP,112,123,90,10
-    CONTROL         "U&se keyfiles",IDC_KEYFILES_ENABLE_HIDVOL_PROT,"Button",BS_AUTOCHECKBOX | WS_TABSTOP,112,136,90,10
-    PUSHBUTTON      "&Keyfiles...",IDC_KEYFILES_HIDVOL_PROT,203,125,60,14
-    LTEXT           "What is hidden volume protection?",IDC_LINK_HIDVOL_PROTECTION_INFO,16,151,247,10,SS_NOTIFY
+    CONTROL         "&Display password",IDC_SHOW_PASSWORD_MO,"Button",BS_AUTOCHECKBOX | WS_TABSTOP,112,146,90,10
+    CONTROL         "U&se keyfiles",IDC_KEYFILES_ENABLE_HIDVOL_PROT,"Button",BS_AUTOCHECKBOX | WS_TABSTOP,112,159,90,10
+    PUSHBUTTON      "&Keyfiles...",IDC_KEYFILES_HIDVOL_PROT,203,148,60,14
+    LTEXT           "What is hidden volume protection?",IDC_LINK_HIDVOL_PROTECTION_INFO,16,174,247,10,SS_NOTIFY
     DEFPUSHBUTTON   "OK",IDOK,211,7,60,14
     PUSHBUTTON      "Cancel",IDCANCEL,211,24,60,14
     RTEXT           "P&assword to hidden volume:\n(if empty, cache is used)",IDT_HIDDEN_PROT_PASSWD,15,103,91,17,0,WS_EX_RIGHT
-    GROUPBOX        "Hidden Volume Protection",IDT_HIDDEN_VOL_PROTECTION,6,72,265,95
+    GROUPBOX        "Hidden Volume Protection",IDT_HIDDEN_VOL_PROTECTION,6,72,265,120
     CONTROL         "Use backup header embedded in &volume if available",IDC_USE_EMBEDDED_HEADER_BAK,
                     "Button",BS_AUTOCHECKBOX | WS_TABSTOP,12,39,257,11
+    COMBOBOX        IDC_PKCS5_PRF_ID,112,125,91,90,CBS_DROPDOWNLIST | WS_TABSTOP
+    RTEXT           "PKCS-5 PRF:",IDT_PKCS5_PRF,15,126,91,17
 END
 
 IDD_KEYFILES DIALOGEX 0, 0, 345, 237
@@ -194,20 +196,28 @@ BEGIN
     CONTROL         "",IDC_INFO_BOX_TEXT,"RichEdit20A",ES_MULTILINE | ES_READONLY | ES_NUMBER | WS_BORDER | WS_VSCROLL | WS_TABSTOP,5,6,361,188
 END
 
-IDD_KEYFILE_GENERATOR DIALOGEX 0, 0, 308, 270
+IDD_KEYFILE_GENERATOR DIALOGEX 0, 0, 308, 325
 STYLE DS_SETFONT | DS_MODALFRAME | DS_FIXEDSYS | DS_CENTER | WS_POPUP | WS_CAPTION | WS_SYSMENU
 CAPTION "VeraCrypt - Keyfile Generator"
 FONT 8, "MS Shell Dlg", 400, 0, 0x1
 BEGIN
     DEFPUSHBUTTON   "Close",IDCLOSE,237,10,59,14
     COMBOBOX        IDC_PRF_ID,79,49,91,90,CBS_DROPDOWNLIST | WS_TABSTOP
-    PUSHBUTTON      "Generate and Save Keyfile...",IDC_GENERATE_AND_SAVE_KEYFILE,89,248,131,14
+    PUSHBUTTON      "Generate and Save Keyfile...",IDC_GENERATE_AND_SAVE_KEYFILE,92,302,141,14
     LTEXT           "IMPORTANT: Move your mouse as randomly as possible within this window. The longer you move it, the better. This significantly increases the cryptographic strength of the keyfile.",IDT_KEYFILE_GENERATOR_NOTE,11,5,213,33
     CONTROL         "",IDC_STATIC,"Static",SS_ETCHEDHORZ,1,40,307,1,WS_EX_STATICEDGE
     RTEXT           "Mixing PRF:",IDT_PRF,6,51,67,10,SS_CENTERIMAGE
     GROUPBOX        "Current Pool Content",IDT_POOL_CONTENTS,6,70,296,170
     CONTROL         "",IDC_POOL_CONTENTS,"Static",SS_LEFTNOWORDWRAP | WS_GROUP,16,83,282,148,WS_EX_TRANSPARENT
     CONTROL         "Display pool content",IDC_DISPLAY_POOL_CONTENTS,"Button",BS_AUTOCHECKBOX | WS_TABSTOP,191,51,111,10
+    LTEXT           "Number of keyfiles:",IDT_NUMBER_KEYFILES,9,247,75,8
+    EDITTEXT        IDC_NUMBER_KEYFILES,92,244,51,14,ES_RIGHT | ES_AUTOHSCROLL | ES_NUMBER
+    LTEXT           "Keyfiles base name:",IDT_KEYFILES_BASE_NAME,9,287,75,8
+    EDITTEXT        IDC_KEYFILES_BASE_NAME,92,284,141,14,ES_AUTOHSCROLL
+    LTEXT           "Keyfiles size (in Bytes):",IDT_KEYFILES_SIZE,9,266,75,8
+    EDITTEXT        IDC_KEYFILES_SIZE,92,264,51,14,ES_RIGHT | ES_AUTOHSCROLL | ES_NUMBER
+    CONTROL         "Random size ( 64 <-> 1048576 )",IDC_KEYFILES_RANDOM_SIZE,
+                    "Button",BS_AUTOCHECKBOX | WS_TABSTOP,149,266,140,10
 END
 
 IDD_MULTI_CHOICE_DLG DIALOGEX 0, 0, 167, 322
@@ -299,6 +309,16 @@ BEGIN
     LTEXT           "Please wait. This process may take a long time...",IDT_STATIC_MODELESS_WAIT_DLG_INFO,9,8,274,9
 END
 
+IDD_STATIC_MODAL_WAIT_DLG DIALOGEX 0, 0, 292, 74
+STYLE DS_SYSMODAL | DS_SETFONT | DS_MODALFRAME | DS_SETFOREGROUND | DS_FIXEDSYS | DS_CENTER | WS_POPUP | WS_CAPTION
+EXSTYLE WS_EX_TOPMOST
+CAPTION "VeraCrypt"
+FONT 8, "MS Shell Dlg", 0, 0, 0x0
+BEGIN
+    CTEXT           "Please wait...\nThis process may take a long time and VeraCrypt may become unresponsive.",IDT_STATIC_MODAL_WAIT_DLG_INFO,9,11,274,33
+    CONTROL         "",IDC_WAIT_PROGRESS_BAR,"msctls_progress32",WS_BORDER,7,49,278,14
+END
+
 
 /////////////////////////////////////////////////////////////////////////////
 //
@@ -325,7 +345,7 @@ BEGIN
     BEGIN
         LEFTMARGIN, 7
         TOPMARGIN, 7
-        BOTTOMMARGIN, 166
+        BOTTOMMARGIN, 198
     END
 
     IDD_KEYFILES, DIALOG
@@ -373,7 +393,7 @@ BEGIN
         LEFTMARGIN, 7
         RIGHTMARGIN, 299
         TOPMARGIN, 7
-        BOTTOMMARGIN, 266
+        BOTTOMMARGIN, 321
     END
 
     IDD_MULTI_CHOICE_DLG, DIALOG
@@ -431,6 +451,14 @@ BEGIN
         TOPMARGIN, 7
         BOTTOMMARGIN, 35
     END
+
+    IDD_STATIC_MODAL_WAIT_DLG, DIALOG
+    BEGIN
+        LEFTMARGIN, 7
+        RIGHTMARGIN, 285
+        TOPMARGIN, 7
+        BOTTOMMARGIN, 67
+    END
 END
 #endif    // APSTUDIO_INVOKED
 
@@ -449,6 +477,17 @@ IDR_BOOT_LOADER         BIN                     "..\\Boot\\Windows\\Release\\Boo
 IDR_BOOT_LOADER_AES     BIN                     "..\\Boot\\Windows\\Release_AES\\BootLoader.com.gz"
 IDR_BOOT_LOADER_SERPENT BIN                     "..\\Boot\\Windows\\Release_Serpent\\BootLoader.com.gz"
 IDR_BOOT_LOADER_TWOFISH BIN                     "..\\Boot\\Windows\\Release_Twofish\\BootLoader.com.gz"
+
+IDR_BOOT_SECTOR_SHA2    BIN                     "..\\Boot\\Windows\\Release_SHA2\\BootSector.bin"
+IDR_BOOT_SECTOR_AES_SHA2 BIN                     "..\\Boot\\Windows\\Release_AES_SHA2\\BootSector.bin"
+IDR_BOOT_SECTOR_SERPENT_SHA2 BIN                     "..\\Boot\\Windows\\Release_Serpent_SHA2\\BootSector.bin"
+IDR_BOOT_SECTOR_TWOFISH_SHA2 BIN                     "..\\Boot\\Windows\\Release_Twofish_SHA2\\BootSector.bin"
+IDR_BOOT_LOADER_SHA2    BIN                     "..\\Boot\\Windows\\Release_SHA2\\BootLoader.com.gz"
+IDR_BOOT_LOADER_AES_SHA2 BIN                     "..\\Boot\\Windows\\Release_AES_SHA2\\BootLoader.com.gz"
+IDR_BOOT_LOADER_SERPENT_SHA2 BIN                     "..\\Boot\\Windows\\Release_Serpent_SHA2\\BootLoader.com.gz"
+IDR_BOOT_LOADER_TWOFISH_SHA2 BIN                     "..\\Boot\\Windows\\Release_Twofish_SHA2\\BootLoader.com.gz"
+
+
 IDR_RESCUE_BOOT_SECTOR  BIN                     "..\\Boot\\Windows\\Rescue\\BootSector.bin"
 IDR_RESCUE_BOOT_SECTOR_AES BIN                     "..\\Boot\\Windows\\Rescue_AES\\BootSector.bin"
 IDR_RESCUE_BOOT_SECTOR_SERPENT BIN                     "..\\Boot\\Windows\\Rescue_Serpent\\BootSector.bin"
@@ -458,6 +497,15 @@ IDR_RESCUE_LOADER_AES   BIN                     "..\\Boot\\Windows\\Rescue_AES\\
 IDR_RESCUE_LOADER_SERPENT BIN                     "..\\Boot\\Windows\\Rescue_Serpent\\BootLoader.com.gz"
 IDR_RESCUE_LOADER_TWOFISH BIN                     "..\\Boot\\Windows\\Rescue_Twofish\\BootLoader.com.gz"
 
+IDR_RESCUE_BOOT_SECTOR_SHA2 BIN                     "..\\Boot\\Windows\\Rescue_SHA2\\BootSector.bin"
+IDR_RESCUE_BOOT_SECTOR_AES_SHA2 BIN                     "..\\Boot\\Windows\\Rescue_AES_SHA2\\BootSector.bin"
+IDR_RESCUE_BOOT_SECTOR_SERPENT_SHA2 BIN                     "..\\Boot\\Windows\\Rescue_Serpent_SHA2\\BootSector.bin"
+IDR_RESCUE_BOOT_SECTOR_TWOFISH_SHA2 BIN                     "..\\Boot\\Windows\\Rescue_Twofish_SHA2\\BootSector.bin"
+IDR_RESCUE_LOADER_SHA2  BIN                     "..\\Boot\\Windows\\Rescue_SHA2\\BootLoader.com.gz"
+IDR_RESCUE_LOADER_AES_SHA2 BIN                     "..\\Boot\\Windows\\Rescue_AES_SHA2\\BootLoader.com.gz"
+IDR_RESCUE_LOADER_SERPENT_SHA2 BIN                     "..\\Boot\\Windows\\Rescue_Serpent_SHA2\\BootLoader.com.gz"
+IDR_RESCUE_LOADER_TWOFISH_SHA2 BIN                     "..\\Boot\\Windows\\Rescue_Twofish_SHA2\\BootLoader.com.gz"
+
 /////////////////////////////////////////////////////////////////////////////
 //
 // XML

src/Common/Crypto.h

@@ -42,21 +42,16 @@ extern "C" {
 // Size of the volume header area containing concatenated master key(s) and secondary key(s) (XTS mode)
 #define MASTER_KEYDATA_SIZE			256
 
-// Size of the deprecated volume header item containing either an IV seed (CBC mode) or tweak key (LRW mode)
-#define LEGACY_VOL_IV_SIZE			32
-
 // The first PRF to try when mounting
 #define FIRST_PRF_ID		1	
 
 // Hash algorithms (pseudorandom functions). 
 enum
 {
-	RIPEMD160 = FIRST_PRF_ID,
-#ifndef TC_WINDOWS_BOOT
-	SHA512,
+	SHA512 = FIRST_PRF_ID,
 	WHIRLPOOL,
-	SHA1,				// Deprecated/legacy
-#endif
+	SHA256,
+	RIPEMD160,
 	HASH_ENUM_END_ID
 };
 
@@ -66,8 +61,8 @@ enum
 #define RIPEMD160_BLOCKSIZE		64
 #define RIPEMD160_DIGESTSIZE	20
 
-#define SHA1_BLOCKSIZE			64	
-#define SHA1_DIGESTSIZE			20
+#define SHA256_BLOCKSIZE		64
+#define SHA256_DIGESTSIZE		32
 
 #define SHA512_BLOCKSIZE		128
 #define SHA512_DIGESTSIZE		64
@@ -78,7 +73,7 @@ enum
 #define MAX_DIGESTSIZE			WHIRLPOOL_DIGESTSIZE
 
 #define DEFAULT_HASH_ALGORITHM			FIRST_PRF_ID
-#define DEFAULT_HASH_ALGORITHM_BOOT		RIPEMD160
+#define DEFAULT_HASH_ALGORITHM_BOOT		SHA256
 
 // The mode of operation used for newly created volumes and first to try when mounting
 #define FIRST_MODE_OF_OPERATION_ID		1
@@ -89,12 +84,6 @@ enum
 	/* If you add/remove a mode, update the following: GetMaxPkcs5OutSize(), EAInitMode() */
 
 	XTS = FIRST_MODE_OF_OPERATION_ID,
-#ifndef TC_WINDOWS_BOOT
-	LRW,		// Deprecated/legacy
-	CBC,		// Deprecated/legacy
-	OUTER_CBC,	// Deprecated/legacy
-	INNER_CBC,	// Deprecated/legacy
-#endif
 	MODE_ENUM_END_ID
 };
 
@@ -115,12 +104,7 @@ enum
 	NONE = 0,
 	AES,
 	SERPENT,			
-	TWOFISH,			
-#ifndef TC_WINDOWS_BOOT
-	BLOWFISH,		// Deprecated/legacy
-	CAST,			// Deprecated/legacy
-	TRIPLEDES		// Deprecated/legacy
-#endif
+	TWOFISH
 };
 
 typedef struct
@@ -177,6 +161,9 @@ typedef struct
 #	define PRAND_DISK_WIPE_PASSES	256
 #endif
 
+/* specific value for volume header wipe used only when drive is fully wiped. */
+#define PRAND_HEADER_WIPE_PASSES	3
+
 #if !defined (TC_WINDOWS_BOOT) || defined (TC_WINDOWS_BOOT_AES)
 #	include "Aes.h"
 #else
@@ -184,15 +171,11 @@ typedef struct
 #endif
 
 #include "Aes_hw_cpu.h"
-#include "Blowfish.h"
-#include "Cast.h"
-#include "Des.h"
 #include "Serpent.h"
 #include "Twofish.h"
 
 #include "Rmd160.h"
 #ifndef TC_WINDOWS_BOOT
-#	include "Sha1.h"
 #	include "Sha2.h"
 #	include "Whirlpool.h"
 #endif
@@ -213,6 +196,7 @@ typedef struct CRYPTO_INFO_t
 {
 	int ea;									/* Encryption algorithm ID */
 	int mode;								/* Mode of operation (e.g., XTS) */
+	int pkcs5;								/* PRF algorithm */
 	unsigned __int8 ks[MAX_EXPANDED_KEY];	/* Primary key schedule (if it is a cascade, it conatins multiple concatenated keys) */
 	unsigned __int8 ks2[MAX_EXPANDED_KEY];	/* Secondary key schedule (if cascade, multiple concatenated) for XTS mode. */
 
@@ -226,8 +210,8 @@ typedef struct CRYPTO_INFO_t
 	unsigned __int8 master_keydata[MASTER_KEYDATA_SIZE];	/* This holds the volume header area containing concatenated master key(s) and secondary key(s) (XTS mode). For LRW (deprecated/legacy), it contains the tweak key before the master key(s). For CBC (deprecated/legacy), it contains the IV seed before the master key(s). */
 	unsigned __int8 k2[MASTER_KEYDATA_SIZE];				/* For XTS, this contains the secondary key (if cascade, multiple concatenated). For LRW (deprecated/legacy), it contains the tweak key. For CBC (deprecated/legacy), it contains the IV seed. */
 	unsigned __int8 salt[PKCS5_SALT_SIZE];
-	int noIterations;
-	int pkcs5;
+	int noIterations;	
+	BOOL bTrueCryptMode;
 
 	uint64 volume_creation_time;	// Legacy
 	uint64 header_creation_time;	// Legacy
@@ -261,6 +245,23 @@ typedef struct CRYPTO_INFO_t
 
 } CRYPTO_INFO, *PCRYPTO_INFO;
 
+#ifdef _WIN32
+
+#pragma pack (push)
+#pragma pack(1)
+
+typedef struct BOOT_CRYPTO_HEADER_t
+{
+	__int16 ea;									/* Encryption algorithm ID */
+	__int16 mode;								/* Mode of operation (e.g., XTS) */
+	__int16 pkcs5;								/* PRF algorithm */
+
+} BOOT_CRYPTO_HEADER, *PBOOT_CRYPTO_HEADER;
+
+#pragma pack (pop)
+
+#endif
+
 PCRYPTO_INFO crypto_open (void);
 void crypto_loadkey (PKEY_INFO keyInfo, char *lpszUserKey, int nUserKeyLen);
 void crypto_close (PCRYPTO_INFO cryptoInfo);
@@ -269,10 +270,18 @@ int CipherGetBlockSize (int cipher);
 int CipherGetKeySize (int cipher);
 int CipherGetKeyScheduleSize (int cipher);
 BOOL CipherSupportsIntraDataUnitParallelization (int cipher);
+
+#ifndef TC_WINDOWS_BOOT
+const
+#endif
 char * CipherGetName (int cipher);
 
 int CipherInit (int cipher, unsigned char *key, unsigned char *ks);
+#ifndef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
 int EAInit (int ea, unsigned char *key, unsigned char *ks);
+#else
+int EAInit (unsigned char *key, unsigned char *ks);
+#endif
 BOOL EAInitMode (PCRYPTO_INFO ci);
 void EncipherBlock(int cipher, void *data, void *ks);
 void DecipherBlock(int cipher, void *data, void *ks);
@@ -284,7 +293,7 @@ void DecipherBlocks (int cipher, void *dataPtr, void *ks, size_t blockCount);
 int EAGetFirst ();
 int EAGetCount (void);
 int EAGetNext (int previousEA);
-char * EAGetName (char *buf, int ea);
+char * EAGetName (char *buf, int ea, int guiDisplay);
 int EAGetByName (char *name);
 int EAGetKeySize (int ea);
 int EAGetFirstMode (int ea);
@@ -302,10 +311,20 @@ int EAGetPreviousCipher (int ea, int previousCipherId);
 int EAIsFormatEnabled (int ea);
 BOOL EAIsModeSupported (int ea, int testedMode);
 
-char *HashGetName (int hash_algo_id);
-BOOL HashIsDeprecated (int hashId);
 
+#ifndef TC_WINDOWS_BOOT
+const
+#endif
+char *HashGetName (int hash_algo_id);
+
+#ifndef TC_WINDOWS_BOOT
+Hash *HashGet (int id);
+void HashGetName2 (char *buf, int hashId);
+BOOL HashIsDeprecated (int hashId);
+BOOL HashForSystemEncryption (int hashId);
 int GetMaxPkcs5OutSize (void);
+#endif
+
 
 void EncryptDataUnits (unsigned __int8 *buf, const UINT64_STRUCT *structUnitNo, uint32 nbrUnits, PCRYPTO_INFO ci);
 void EncryptDataUnitsCurrentThread (unsigned __int8 *buf, const UINT64_STRUCT *structUnitNo, TC_LARGEST_COMPILER_UINT nbrUnits, PCRYPTO_INFO ci);
@@ -313,13 +332,6 @@ void DecryptDataUnits (unsigned __int8 *buf, const UINT64_STRUCT *structUnitNo,
 void DecryptDataUnitsCurrentThread (unsigned __int8 *buf, const UINT64_STRUCT *structUnitNo, TC_LARGEST_COMPILER_UINT nbrUnits, PCRYPTO_INFO ci);
 void EncryptBuffer (unsigned __int8 *buf, TC_LARGEST_COMPILER_UINT len, PCRYPTO_INFO cryptoInfo);
 void DecryptBuffer (unsigned __int8 *buf, TC_LARGEST_COMPILER_UINT len, PCRYPTO_INFO cryptoInfo);
-#ifndef TC_NO_COMPILER_INT64
-void EncryptBufferLRW128 (byte *buffer, uint64 length, uint64 blockIndex, PCRYPTO_INFO cryptoInfo);
-void DecryptBufferLRW128 (byte *buffer, uint64 length, uint64 blockIndex, PCRYPTO_INFO cryptoInfo);
-void EncryptBufferLRW64 (byte *buffer, uint64 length, uint64 blockIndex, PCRYPTO_INFO cryptoInfo);
-void DecryptBufferLRW64 (byte *buffer, uint64 length, uint64 blockIndex, PCRYPTO_INFO cryptoInfo);
-uint64 DataUnit2LRWIndex (uint64 dataUnit, int blockSize, PCRYPTO_INFO ci);
-#endif	// #ifndef TC_NO_COMPILER_INT64
 
 BOOL IsAesHwCpuSupported ();
 void EnableHwEncryption (BOOL enable);

src/Common/Dlgcode.h

@@ -218,13 +218,13 @@ typedef struct
 #define YES_NO MB_YESNO
 
 #define	ISO_BURNER_TOOL "isoburn.exe"
-#define PRINT_TOOL "notepad"
+#define PRINT_TOOL "notepad.exe"
 
 void cleanup ( void );
 void LowerCaseCopy ( char *lpszDest , const char *lpszSource );
-void UpperCaseCopy ( char *lpszDest , const char *lpszSource );
-void CreateFullVolumePath ( char *lpszDiskFile , const char *lpszFileName , BOOL *bDevice );
-int FakeDosNameForDevice ( const char *lpszDiskFile , char *lpszDosDevice , char *lpszCFDevice , BOOL bNameOnly );
+void UpperCaseCopy ( char *lpszDest , size_t cbDest, const char *lpszSource );
+void CreateFullVolumePath ( char *lpszDiskFile , size_t cbDiskFile, const char *lpszFileName , BOOL *bDevice );
+int FakeDosNameForDevice ( const char *lpszDiskFile , char *lpszDosDevice , size_t cbDosDevice, char *lpszCFDevice , size_t cbCFDevice, BOOL bNameOnly );
 int RemoveFakeDosName ( char *lpszDiskFile , char *lpszDosDevice );
 void AbortProcess ( char *stringId );
 void AbortProcessSilent ( void );
@@ -242,8 +242,8 @@ void CloseStaticModelessWaitDlg (void);
 BOOL IsButtonChecked ( HWND hButton );
 void CheckButton ( HWND hButton );
 void LeftPadString (char *szTmp, int len, int targetLen, char filler);
-void ToSBCS ( LPWSTR lpszText );
-void ToUNICODE ( char *lpszText );
+void ToSBCS ( LPWSTR lpszText, size_t cbSize );
+void ToUNICODE ( char *lpszText , size_t cbSize);
 void InitDialog ( HWND hwndDlg );
 void ProcessPaintMessages (HWND hwnd, int maxMessagesToProcess);
 HDC CreateMemBitmap ( HINSTANCE hInstance , HWND hwnd , char *resource );
@@ -259,7 +259,7 @@ void HandCursor ();
 void AddComboPair (HWND hComboBox, const char *lpszItem, int value);
 void AddComboPairW (HWND hComboBox, const wchar_t *lpszItem, int value);
 void SelectAlgo ( HWND hComboBox , int *nCipher );
-void PopulateWipeModeCombo (HWND hComboBox, BOOL bNA, BOOL bInPlaceEncryption);
+void PopulateWipeModeCombo (HWND hComboBox, BOOL bNA, BOOL bInPlaceEncryption, BOOL bHeaderWipe);
 wchar_t *GetWipeModeName (WipeAlgorithmId modeId);
 wchar_t *GetPathType (const char *path, BOOL bUpperCase, BOOL *bIsPartition);
 LRESULT CALLBACK CustomDlgProc ( HWND hwnd , UINT uMsg , WPARAM wParam , LPARAM lParam );
@@ -285,7 +285,7 @@ BOOL LoadSysEncSettings (HWND hwndDlg);
 int LoadNonSysInPlaceEncSettings (WipeAlgorithmId *wipeAlgorithm);
 void RemoveNonSysInPlaceEncNotifications (void);
 void SavePostInstallTasksSettings (int command);
-void DoPostInstallTasks (void);
+void DoPostInstallTasks (HWND hwndDlg);
 void InitOSVersionInfo ();
 void InitApp ( HINSTANCE hInstance, char *lpszCommandLine );
 void InitHelpFileName (void);
@@ -293,7 +293,7 @@ BOOL OpenDevice (const char *lpszPath, OPEN_TEST_STRUCT *driver, BOOL detectFile
 void NotifyDriverOfPortableMode (void);
 int GetAvailableFixedDisks ( HWND hComboBox , char *lpszRootPath );
 int GetAvailableRemovables ( HWND hComboBox , char *lpszRootPath );
-int IsSystemDevicePath (char *path, HWND hwndDlg, BOOL bReliableRequired);
+int IsSystemDevicePath (const char *path, HWND hwndDlg, BOOL bReliableRequired);
 BOOL CALLBACK RawDevicesDlgProc ( HWND hwndDlg , UINT msg , WPARAM wParam , LPARAM lParam );
 BOOL TextInfoDialogBox (int nID);
 BOOL CALLBACK TextInfoDialogBoxDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam);
@@ -309,7 +309,7 @@ void ResetCurrentDirectory ();
 BOOL BrowseFiles (HWND hwndDlg, char *stringId, char *lpszFileName, BOOL keepHistory, BOOL saveMode, wchar_t *browseFilter);
 BOOL BrowseDirectories (HWND hWnd, char *lpszTitle, char *dirName);
 void handleError ( HWND hwndDlg , int code );
-BOOL CheckFileStreamWriteErrors (FILE *file, const char *fileName);
+BOOL CheckFileStreamWriteErrors (HWND hwndDlg, FILE *file, const char *fileName);
 void LocalizeDialog ( HWND hwnd, char *stringId );
 void OpenVolumeExplorerWindow (int driveNo);
 static BOOL CALLBACK CloseVolumeExplorerWindowsEnum( HWND hwnd, LPARAM driveNo);
@@ -325,7 +325,7 @@ BOOL IsDriveAvailable (int driveNo);
 BOOL IsDeviceMounted (char *deviceName);
 int DriverUnmountVolume (HWND hwndDlg, int nDosDriveNo, BOOL forced);
 void BroadcastDeviceChange (WPARAM message, int nDosDriveNo, DWORD driveMap);
-int MountVolume (HWND hwndDlg, int driveNo, char *volumePath, Password *password, BOOL cachePassword, BOOL sharedAccess,  const MountOptions* const mountOptions, BOOL quiet, BOOL bReportWrongPassword);
+int MountVolume (HWND hwndDlg, int driveNo, char *volumePath, Password *password, int pkcs5, BOOL truecryptMode, BOOL cachePassword, BOOL sharedAccess,  const MountOptions* const mountOptions, BOOL quiet, BOOL bReportWrongPassword);
 BOOL UnmountVolume (HWND hwndDlg , int nDosDriveNo, BOOL forceUnmount);
 BOOL IsPasswordCacheEmpty (void);
 BOOL IsMountedVolume (const char *volname);
@@ -333,7 +333,7 @@ int GetMountedVolumeDriveNo (char *volname);
 BOOL IsAdmin (void);
 BOOL IsBuiltInAdmin ();
 BOOL IsUacSupported ();
-BOOL ResolveSymbolicLink (const wchar_t *symLinkName, PWSTR targetName);
+BOOL ResolveSymbolicLink (const wchar_t *symLinkName, PWSTR targetName, size_t cbTargetName);
 int GetDiskDeviceDriveLetter (PWSTR deviceName);
 int FileSystemAppearsEmpty (const char *devicePath);
 __int64 GetStatsFreeSpaceOnPartition (const char *devicePath, float *percent, __int64 *occupiedBytes, BOOL silent);
@@ -346,7 +346,7 @@ BOOL TCCopyFile (char *sourceFileName, char *destinationFile);
 BOOL SaveBufferToFile (const char *inputBuffer, const char *destinationFile, DWORD inputLength, BOOL bAppend);
 BOOL TCFlushFile (FILE *f);
 BOOL PrintHardCopyTextUTF16 (wchar_t *text, char *title, int byteLen);
-void GetSpeedString (unsigned __int64 speed, wchar_t *str);
+void GetSpeedString (unsigned __int64 speed, wchar_t *str, size_t cbStr);
 BOOL IsNonInstallMode ();
 BOOL DriverUnload ();
 LRESULT SetCheckBox (HWND hwndDlg, int dlgItem, BOOL state);
@@ -362,7 +362,7 @@ LRESULT ListSubItemSet (HWND list, int index, int subIndex, char *string);
 LRESULT ListSubItemSetW (HWND list, int index, int subIndex, wchar_t *string);
 BOOL GetMountList (MOUNT_LIST_STRUCT *list);
 int GetDriverRefCount ();
-void GetSizeString (unsigned __int64 size, wchar_t *str);
+void GetSizeString (unsigned __int64 size, wchar_t *str, size_t cbStr);
 __int64 GetFileSize64 (const char *path);
 BOOL LoadInt16 (char *filePath, int *result, __int64 fileOffset);
 BOOL LoadInt32 (char *filePath, unsigned __int32 *result, __int64 fileOffset);
@@ -374,38 +374,38 @@ char *GetProgramConfigPath (char *fileName);
 char GetSystemDriveLetter (void);
 void OpenPageHelp (HWND hwndDlg, int nPage);
 void TaskBarIconDisplayBalloonTooltip (HWND hwnd, wchar_t *headline, wchar_t *text, BOOL warning);
-void InfoBalloon (char *headingStringId, char *textStringId);
-void InfoBalloonDirect (wchar_t *headingString, wchar_t *textString);
-void WarningBalloon (char *headingStringId, char *textStringId);
-void WarningBalloonDirect (wchar_t *headingString, wchar_t *textString);
-int Info (char *stringId);
-int InfoTopMost (char *stringId);
-int InfoDirect (const wchar_t *msg);
-int Warning (char *stringId);
-int WarningTopMost (char *stringId);
-int WarningDirect (const wchar_t *warnMsg);
-int Error (char *stringId);
-int ErrorDirect (const wchar_t *errMsg);
-int ErrorTopMost (char *stringId);
-int AskYesNo (char *stringId);
-int AskYesNoString (const wchar_t *str);
-int AskYesNoTopmost (char *stringId);
-int AskNoYes (char *stringId);
-int AskOkCancel (char *stringId);
-int AskWarnYesNo (char *stringId);
-int AskWarnYesNoString (const wchar_t *string);
-int AskWarnYesNoTopmost (char *stringId);
-int AskWarnYesNoStringTopmost (const wchar_t *string);
-int AskWarnNoYes (char *stringId);
-int AskWarnNoYesString (const wchar_t *string);
-int AskWarnNoYesTopmost (char *stringId);
-int AskWarnOkCancel (char *stringId);
-int AskWarnCancelOk (char *stringId);
-int AskErrYesNo (char *stringId);
-int AskErrNoYes (char *stringId);
-int AskMultiChoice (void *strings[], BOOL bBold);
+void InfoBalloon (char *headingStringId, char *textStringId, HWND hwnd);
+void InfoBalloonDirect (wchar_t *headingString, wchar_t *textString, HWND hwnd);
+void WarningBalloon (char *headingStringId, char *textStringId, HWND hwnd);
+void WarningBalloonDirect (wchar_t *headingString, wchar_t *textString, HWND hwnd);
+int Info (char *stringId, HWND hwnd);
+int InfoTopMost (char *stringId, HWND hwnd);
+int InfoDirect (const wchar_t *msg, HWND hwnd);
+int Warning (char *stringId, HWND hwnd);
+int WarningTopMost (char *stringId, HWND hwnd);
+int WarningDirect (const wchar_t *warnMsg, HWND hwnd);
+int Error (char *stringId, HWND hwnd);
+int ErrorDirect (const wchar_t *errMsg, HWND hwnd);
+int ErrorTopMost (char *stringId, HWND hwnd);
+int AskYesNo (char *stringId, HWND hwnd);
+int AskYesNoString (const wchar_t *str, HWND hwnd);
+int AskYesNoTopmost (char *stringId, HWND hwnd);
+int AskNoYes (char *stringId, HWND hwnd);
+int AskOkCancel (char *stringId, HWND hwnd);
+int AskWarnYesNo (char *stringId, HWND hwnd);
+int AskWarnYesNoString (const wchar_t *string, HWND hwnd);
+int AskWarnYesNoTopmost (char *stringId, HWND hwnd);
+int AskWarnYesNoStringTopmost (const wchar_t *string, HWND hwnd);
+int AskWarnNoYes (char *stringId, HWND hwnd);
+int AskWarnNoYesString (const wchar_t *string, HWND hwnd);
+int AskWarnNoYesTopmost (char *stringId, HWND hwnd);
+int AskWarnOkCancel (char *stringId, HWND hwnd);
+int AskWarnCancelOk (char *stringId, HWND hwnd);
+int AskErrYesNo (char *stringId, HWND hwnd);
+int AskErrNoYes (char *stringId, HWND hwnd);
+int AskMultiChoice (void *strings[], BOOL bBold, HWND hwnd);
 BOOL ConfigWriteBegin ();
-BOOL ConfigWriteEnd ();
+BOOL ConfigWriteEnd (HWND hwnd);
 BOOL ConfigWriteString (char *configKey, char *configValue);
 BOOL ConfigWriteInt (char *configKey, int configValue);
 int ConfigReadInt (char *configKey, int defaultValue);
@@ -423,14 +423,14 @@ BOOL EnableWow64FsRedirection (BOOL enable);
 BOOL RestartComputer (void);
 void Applink (char *dest, BOOL bSendOS, char *extraOutput);
 char *RelativePath2Absolute (char *szFileName);
-void HandleDriveNotReadyError ();
+void HandleDriveNotReadyError (HWND hwnd);
 BOOL CALLBACK CloseTCWindowsEnum( HWND hwnd, LPARAM lParam);
 BOOL CALLBACK FindTCWindowEnum (HWND hwnd, LPARAM lParam);
 BYTE *MapResource (char *resourceType, int resourceId, PDWORD size);
 void InconsistencyResolved (char *msg);
 void ReportUnexpectedState (char *techInfo);
-BOOL SelectMultipleFiles (HWND hwndDlg, char *stringId, char *lpszFileName, BOOL keepHistory);
-BOOL SelectMultipleFilesNext (char *lpszFileName);
+BOOL SelectMultipleFiles (HWND hwndDlg, const char *stringId, char *lpszFileName, size_t cbFileName, BOOL keepHistory);
+BOOL SelectMultipleFilesNext (char *lpszFileName, size_t cbFileName);
 void OpenOnlineHelp ();
 BOOL GetPartitionInfo (const char *deviceName, PPARTITION_INFORMATION rpartInfo);
 BOOL GetDeviceInfo (const char *deviceName, DISK_PARTITION_INFO_STRUCT *info);
@@ -447,24 +447,24 @@ void ToBootPwdField (HWND hwndDlg, UINT ctrlId);
 void AccommodateTextField (HWND hwndDlg, UINT ctrlId, BOOL bFirstUpdate, HFONT hFont);
 BOOL GetDriveLabel (int driveNo, wchar_t *label, int labelSize);
 BOOL DoDriverInstall (HWND hwndDlg);
-int OpenVolume (OpenVolumeContext *context, const char *volumePath, Password *password, BOOL write, BOOL preserveTimestamps, BOOL useBackupHeader);
+int OpenVolume (OpenVolumeContext *context, const char *volumePath, Password *password, int pkcs5_prf, BOOL truecryptMode, BOOL write, BOOL preserveTimestamps, BOOL useBackupHeader);
 void CloseVolume (OpenVolumeContext *context);
-int ReEncryptVolumeHeader (char *buffer, BOOL bBoot, CRYPTO_INFO *cryptoInfo, Password *password, BOOL wipeMode);
+int ReEncryptVolumeHeader (HWND hwndDlg, char *buffer, BOOL bBoot, CRYPTO_INFO *cryptoInfo, Password *password, BOOL wipeMode);
 BOOL IsPagingFileActive (BOOL checkNonWindowsPartitionsOnly);
 BOOL IsPagingFileWildcardActive ();
 BOOL DisablePagingFile ();
 BOOL CALLBACK SecurityTokenPasswordDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam);
 BOOL CALLBACK SecurityTokenKeyfileDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam);
-BOOL InitSecurityTokenLibrary ();
+BOOL InitSecurityTokenLibrary (HWND hwndDlg);
 BOOL FileHasReadOnlyAttribute (const char *path);
 BOOL IsFileOnReadOnlyFilesystem (const char *path);
-void CheckFilesystem (int driveNo, BOOL fixErrors);
+void CheckFilesystem (HWND hwndDlg, int driveNo, BOOL fixErrors);
 BOOL BufferContainsString (const byte *buffer, size_t bufferSize, const char *str);
-int AskNonSysInPlaceEncryptionResume ();
+int AskNonSysInPlaceEncryptionResume (HWND hwndDlg);
 BOOL RemoveDeviceWriteProtection (HWND hwndDlg, char *devicePath);
 void EnableElevatedCursorChange (HWND parent);
 BOOL DisableFileCompression (HANDLE file);
-BOOL VolumePathExists (char *volumePath);
+BOOL VolumePathExists (const char *volumePath);
 BOOL IsWindowsIsoBurnerAvailable ();
 BOOL LaunchWindowsIsoBurner (HWND hwnd, const char *isoPath);
 BOOL IsApplicationInstalled (const char *appName);
@@ -487,7 +487,8 @@ struct HostDevice
 		IsVirtualPartition (false),
 		HasUnencryptedFilesystem (false),
 		Removable (false),
-		Size (0)
+		Size (0),
+		SystemNumber((uint32) -1)
 	{
 	}
 
@@ -527,6 +528,10 @@ std::string HarddiskVolumePathToPartitionPath (const std::string &harddiskVolume
 std::string FindLatestFileOrDirectory (const std::string &directory, const char *namePattern, bool findDirectory, bool findFile);
 std::string GetUserFriendlyVersionString (int version);
 
+// Display a wait dialog while calling the provided callback with the given parameter
+typedef void (CALLBACK* WaitThreadProc)(void* pArg, HWND hWaitDlg);
+void ShowWaitDialog(HWND hwnd, BOOL bUseHwndAsParent, WaitThreadProc callback, void* pArg);
+
 #endif // __cplusplus
 
 #endif // TC_HEADER_DLGCODE

src/Common/EncryptionThreadPool.c

@@ -159,7 +159,7 @@ static TC_THREAD_PROC EncryptionThreadProc (void *threadArg)
 			switch (workItem->KeyDerivation.Pkcs5Prf)
 			{
 			case RIPEMD160:
-				derive_key_ripemd160 (TRUE, workItem->KeyDerivation.Password, workItem->KeyDerivation.PasswordLength, workItem->KeyDerivation.Salt, PKCS5_SALT_SIZE,
+				derive_key_ripemd160 (workItem->KeyDerivation.Password, workItem->KeyDerivation.PasswordLength, workItem->KeyDerivation.Salt, PKCS5_SALT_SIZE,
 					workItem->KeyDerivation.IterationCount, workItem->KeyDerivation.DerivedKey, GetMaxPkcs5OutSize());
 				break;
 
@@ -173,8 +173,8 @@ static TC_THREAD_PROC EncryptionThreadProc (void *threadArg)
 					workItem->KeyDerivation.IterationCount, workItem->KeyDerivation.DerivedKey, GetMaxPkcs5OutSize());
 				break;
 
-			case SHA1:
-				derive_key_sha1 (workItem->KeyDerivation.Password, workItem->KeyDerivation.PasswordLength, workItem->KeyDerivation.Salt, PKCS5_SALT_SIZE,
+			case SHA256:
+				derive_key_sha256 (workItem->KeyDerivation.Password, workItem->KeyDerivation.PasswordLength, workItem->KeyDerivation.Salt, PKCS5_SALT_SIZE,
 					workItem->KeyDerivation.IterationCount, workItem->KeyDerivation.DerivedKey, GetMaxPkcs5OutSize());
 				break;
 

src/Common/Exception.h

@@ -12,7 +12,7 @@
 #include "Platform/PlatformBase.h"
 #include "Dlgcode.h"
 
-namespace TrueCrypt
+namespace VeraCrypt
 {
 	struct Exception
 	{
@@ -35,14 +35,14 @@ namespace TrueCrypt
 	struct ErrorException : public Exception
 	{
 		ErrorException (char *langId) : ErrLangId (langId) { }
-		ErrorException (const wstring &errMsg) : ErrMsg (errMsg) { }
+		ErrorException (const wstring &errMsg) : ErrLangId(NULL), ErrMsg (errMsg) { }
 
 		void Show (HWND parent) const
 		{
 			if (ErrMsg.empty())
-				::Error (ErrLangId);
+				::Error (ErrLangId? ErrLangId : "", parent);
 			else
-				::ErrorDirect (ErrMsg.c_str());
+				::ErrorDirect (ErrMsg.c_str(), parent);
 		}
 
 		char *ErrLangId;
@@ -65,7 +65,7 @@ namespace TrueCrypt
 	struct TimeOut : public Exception
 	{
 		TimeOut (const char *srcPos) { }
-		void Show (HWND parent) const { ErrorDirect (L"Timeout"); }
+		void Show (HWND parent) const { ErrorDirect (L"Timeout", parent); }
 	};
 
 	struct UserAbort : public Exception

src/Common/Fat.c

@@ -253,7 +253,7 @@ static void PutFSInfo (unsigned char *sector, fatparams *ft)
 
 
 int
-FormatFat (unsigned __int64 startSector, fatparams * ft, void * dev, PCRYPTO_INFO cryptoInfo, BOOL quickFormat)
+FormatFat (void* hwndDlgPtr, unsigned __int64 startSector, fatparams * ft, void * dev, PCRYPTO_INFO cryptoInfo, BOOL quickFormat)
 {
 	int write_buf_cnt = 0;
 	char sector[TC_MAX_VOLUME_SECTOR_SIZE], *write_buf;
@@ -261,6 +261,7 @@ FormatFat (unsigned __int64 startSector, fatparams * ft, void * dev, PCRYPTO_INF
 	int x, n;
 	int retVal;
 	char temporaryKey[MASTER_KEYDATA_SIZE];
+	HWND hwndDlg = (HWND) hwndDlgPtr;
 
 	LARGE_INTEGER startOffset;
 	LARGE_INTEGER newOffset;
@@ -281,7 +282,7 @@ FormatFat (unsigned __int64 startSector, fatparams * ft, void * dev, PCRYPTO_INF
 
 	memset (sector, 0, ft->sector_size);
 
-	RandgetBytes (ft->volume_id, sizeof (ft->volume_id), FALSE);
+	RandgetBytes (hwndDlg, ft->volume_id, sizeof (ft->volume_id), FALSE);
 
 	PutBoot (ft, (unsigned char *) sector);
 	if (WriteSector (dev, sector, write_buf, &write_buf_cnt, &nSecNo,
@@ -399,11 +400,11 @@ FormatFat (unsigned __int64 startSector, fatparams * ft, void * dev, PCRYPTO_INF
 		within the volume). */
 
 		// Temporary master key
-		if (!RandgetBytes (temporaryKey, EAGetKeySize (cryptoInfo->ea), FALSE))
+		if (!RandgetBytes (hwndDlg, temporaryKey, EAGetKeySize (cryptoInfo->ea), FALSE))
 			goto fail;
 
 		// Temporary secondary key (XTS mode)
-		if (!RandgetBytes (cryptoInfo->k2, sizeof cryptoInfo->k2, FALSE))		
+		if (!RandgetBytes (hwndDlg, cryptoInfo->k2, sizeof cryptoInfo->k2, FALSE))		
 			goto fail;
 
 		retVal = EAInit (cryptoInfo->ea, temporaryKey, cryptoInfo->ks);

src/Common/Fat.h

@@ -64,4 +64,4 @@ struct msdos_boot_sector
 
 void GetFatParams ( fatparams *ft );
 void PutBoot ( fatparams *ft , unsigned char *boot );
-int FormatFat (unsigned __int64 startSector, fatparams * ft, void * dev, PCRYPTO_INFO cryptoInfo, BOOL quickFormat);
+int FormatFat (void* hwndDlg, unsigned __int64 startSector, fatparams * ft, void * dev, PCRYPTO_INFO cryptoInfo, BOOL quickFormat);

src/Common/Format.c

@@ -29,6 +29,8 @@
 #include "Format/FormatCom.h"
 #include "Format/Tcformat.h"
 
+#include <Strsafe.h>
+
 int FormatWriteBufferSize = 1024 * 1024;
 static uint32 FormatSectorSize = 0;
 
@@ -91,6 +93,7 @@ int TCFormatVolume (volatile FORMAT_VOL_PARAMETERS *volParams)
 	uint64 dataOffset, dataAreaSize;
 	LARGE_INTEGER offset;
 	BOOL bFailedRequiredDASD = FALSE;
+	HWND hwndDlg = volParams->hwndDlg;
 
 	FormatSectorSize = volParams->sectorSize;
 
@@ -98,7 +101,7 @@ int TCFormatVolume (volatile FORMAT_VOL_PARAMETERS *volParams)
 		|| FormatSectorSize > TC_MAX_VOLUME_SECTOR_SIZE
 		|| FormatSectorSize % ENCRYPTION_DATA_UNIT_SIZE != 0)
 	{
-		Error ("SECTOR_SIZE_UNSUPPORTED");
+		Error ("SECTOR_SIZE_UNSUPPORTED", hwndDlg);
 		return ERR_DONT_REPORT; 
 	}
 
@@ -129,15 +132,15 @@ int TCFormatVolume (volatile FORMAT_VOL_PARAMETERS *volParams)
 
 	if (volParams->bDevice)
 	{
-		strcpy ((char *)deviceName, volParams->volumePath);
-		ToUNICODE ((char *)deviceName);
+		StringCbCopyA ((char *)deviceName, sizeof(deviceName), volParams->volumePath);
+		ToUNICODE ((char *)deviceName, sizeof(deviceName));
 
 		driveLetter = GetDiskDeviceDriveLetter (deviceName);
 	}
 
 	VirtualLock (header, sizeof (header));
 
-	nStatus = CreateVolumeHeaderInMemory (FALSE,
+	nStatus = CreateVolumeHeaderInMemory (hwndDlg, FALSE,
 				     header,
 				     volParams->ea,
 					 FIRST_MODE_OF_OPERATION_ID,
@@ -170,14 +173,14 @@ begin_format:
 		DWORD dwResult;
 		int nPass;
 
-		if (FakeDosNameForDevice (volParams->volumePath, dosDev, devName, FALSE) != 0)
+		if (FakeDosNameForDevice (volParams->volumePath, dosDev, sizeof(dosDev), devName, sizeof(devName), FALSE) != 0)
 			return ERR_OS_ERROR;
 
 		if (IsDeviceMounted (devName))
 		{
 			if ((dev = DismountDrive (devName, volParams->volumePath)) == INVALID_HANDLE_VALUE)
 			{
-				Error ("FORMAT_CANT_DISMOUNT_FILESYS");
+				Error ("FORMAT_CANT_DISMOUNT_FILESYS", hwndDlg);
 				nStatus = ERR_DONT_REPORT; 
 				goto error;
 			}
@@ -283,7 +286,7 @@ begin_format:
 				else
 				{
 					handleWin32Error (volParams->hwndDlg);
-					Error ("CANT_ACCESS_VOL");
+					Error ("CANT_ACCESS_VOL", hwndDlg);
 					nStatus = ERR_DONT_REPORT; 
 					goto error;
 				}
@@ -315,7 +318,7 @@ begin_format:
 
 		if (DeviceIoControl (dev, FSCTL_IS_VOLUME_MOUNTED, NULL, 0, NULL, 0, &dwResult, NULL))
 		{
-			Error ("FORMAT_CANT_DISMOUNT_FILESYS");
+			Error ("FORMAT_CANT_DISMOUNT_FILESYS", hwndDlg);
 			nStatus = ERR_DONT_REPORT; 
 			goto error;
 		}
@@ -472,7 +475,7 @@ begin_format:
 			goto error;
 		}
 
-		nStatus = FormatNoFs (startSector, num_sectors, dev, cryptoInfo, volParams->quickFormat);
+		nStatus = FormatNoFs (hwndDlg, startSector, num_sectors, dev, cryptoInfo, volParams->quickFormat);
 
 		if (volParams->bDevice)
 			StopFormatWriteThread();
@@ -505,7 +508,7 @@ begin_format:
 			goto error;
 		}
 
-		nStatus = FormatFat (startSector, &ft, (void *) dev, cryptoInfo, volParams->quickFormat);
+		nStatus = FormatFat (hwndDlg, startSector, &ft, (void *) dev, cryptoInfo, volParams->quickFormat);
 
 		if (volParams->bDevice)
 			StopFormatWriteThread();
@@ -529,7 +532,7 @@ begin_format:
 		goto error;
 	}
 
-	nStatus = CreateVolumeHeaderInMemory (FALSE,
+	nStatus = CreateVolumeHeaderInMemory (hwndDlg, FALSE,
 		header,
 		volParams->ea,
 		FIRST_MODE_OF_OPERATION_ID,
@@ -555,7 +558,7 @@ begin_format:
 	// Fill reserved header sectors (including the backup header area) with random data
 	if (!volParams->hiddenVol)
 	{
-		nStatus = WriteRandomDataToReservedHeaderAreas (dev, cryptoInfo, dataAreaSize, FALSE, FALSE);
+		nStatus = WriteRandomDataToReservedHeaderAreas (hwndDlg, dev, cryptoInfo, dataAreaSize, FALSE, FALSE);
 
 		if (nStatus != ERR_SUCCESS)
 			goto error;
@@ -621,7 +624,7 @@ error:
 		mountOptions.PartitionInInactiveSysEncScope = FALSE;
 		mountOptions.UseBackupHeader = FALSE;
 
-		if (MountVolume (volParams->hwndDlg, driveNo, volParams->volumePath, volParams->password, FALSE, TRUE, &mountOptions, FALSE, TRUE) < 1)
+		if (MountVolume (volParams->hwndDlg, driveNo, volParams->volumePath, volParams->password, volParams->pkcs5, FALSE, FALSE, TRUE, &mountOptions, FALSE, TRUE) < 1)
 		{
 			MessageBoxW (volParams->hwndDlg, GetString ("CANT_MOUNT_VOLUME"), lpszTitle, ICON_HAND);
 			MessageBoxW (volParams->hwndDlg, GetString ("FORMAT_NTFS_STOP"), lpszTitle, ICON_HAND);
@@ -641,7 +644,7 @@ error:
 
 			if (dataAreaSize <= TC_MAX_FAT_SECTOR_COUNT * FormatSectorSize)
 			{
-				if (AskErrYesNo ("FORMAT_NTFS_FAILED_ASK_FAT") == IDYES)
+				if (AskErrYesNo ("FORMAT_NTFS_FAILED_ASK_FAT", hwndDlg) == IDYES)
 				{
 					// NTFS format failed and the user wants to try FAT format immediately
 					volParams->fileSystem = FILESYS_FAT;
@@ -652,7 +655,7 @@ error:
 				}
 			}
 			else
-				Error ("FORMAT_NTFS_FAILED");
+				Error ("FORMAT_NTFS_FAILED", hwndDlg);
 
 			nStatus = ERR_DONT_REPORT;
 			goto fv_end;
@@ -675,7 +678,7 @@ fv_end:
 }
 
 
-int FormatNoFs (unsigned __int64 startSector, __int64 num_sectors, void * dev, PCRYPTO_INFO cryptoInfo, BOOL quickFormat)
+int FormatNoFs (HWND hwndDlg, unsigned __int64 startSector, __int64 num_sectors, void * dev, PCRYPTO_INFO cryptoInfo, BOOL quickFormat)
 {
 	int write_buf_cnt = 0;
 	char sector[TC_MAX_VOLUME_SECTOR_SIZE], *write_buf;
@@ -717,11 +720,11 @@ int FormatNoFs (unsigned __int64 startSector, __int64 num_sectors, void * dev, P
 		deniability of hidden volumes. */
 
 		// Temporary master key
-		if (!RandgetBytes (temporaryKey, EAGetKeySize (cryptoInfo->ea), FALSE))
+		if (!RandgetBytes (hwndDlg, temporaryKey, EAGetKeySize (cryptoInfo->ea), FALSE))
 			goto fail;
 
 		// Temporary secondary key (XTS mode)
-		if (!RandgetBytes (cryptoInfo->k2, sizeof cryptoInfo->k2, FALSE))
+		if (!RandgetBytes (hwndDlg, cryptoInfo->k2, sizeof cryptoInfo->k2, FALSE))
 			goto fail;
 
 		retVal = EAInit (cryptoInfo->ea, temporaryKey, cryptoInfo->ks);
@@ -795,10 +798,20 @@ BOOLEAN __stdcall FormatExCallback (int command, DWORD subCommand, PVOID paramet
 
 BOOL FormatNtfs (int driveNo, int clusterSize)
 {
+	char dllPath[MAX_PATH] = {0};
 	WCHAR dir[8] = { (WCHAR) driveNo + 'A', 0 };
 	PFORMATEX FormatEx;
-	HMODULE hModule = LoadLibrary ("fmifs.dll");
+	HMODULE hModule;
 	int i;
+	
+	if (GetSystemDirectory (dllPath, MAX_PATH))
+	{
+		StringCbCatA(dllPath, sizeof(dllPath), "\\fmifs.dll");
+	}
+	else
+		StringCbCopyA(dllPath, sizeof(dllPath), "C:\\Windows\\System32\\fmifs.dll");
+	
+	hModule = LoadLibrary (dllPath);
 
 	if (hModule == NULL)
 		return FALSE;
@@ -809,7 +822,7 @@ BOOL FormatNtfs (int driveNo, int clusterSize)
 		return FALSE;
 	}
 
-	wcscat (dir, L":\\");
+	StringCbCatW (dir, sizeof(dir), L":\\");
 
 	FormatExResult = FALSE;
 

src/Common/Format.h

@@ -51,7 +51,7 @@ extern int FormatWriteBufferSize;
 int TCFormatVolume (volatile FORMAT_VOL_PARAMETERS *volParams);
 BOOL FormatNtfs (int driveNo, int clusterSize);
 uint64 GetVolumeDataAreaSize (BOOL hiddenVolume, uint64 volumeSize);
-int FormatNoFs (unsigned __int64 startSector, __int64 num_sectors, void *dev, PCRYPTO_INFO cryptoInfo, BOOL quickFormat);
+int FormatNoFs (HWND hwndDlg, unsigned __int64 startSector, __int64 num_sectors, void *dev, PCRYPTO_INFO cryptoInfo, BOOL quickFormat);
 BOOL WriteSector ( void *dev , char *sector , char *write_buf , int *write_buf_cnt , __int64 *nSecNo , PCRYPTO_INFO cryptoInfo );
 BOOL FlushFormatWriteBuffer (void *dev, char *write_buf, int *write_buf_cnt, __int64 *nSecNo, PCRYPTO_INFO cryptoInfo);
 static BOOL StartFormatWriteThread ();

src/Common/GfMul.c

@@ -651,43 +651,6 @@ int Gf128Tab64Init (unsigned __int8 *a, GfCtx *ctx)
 	return TRUE;
 }
 
-int Gf64TabInit (unsigned __int8 *a, GfCtx *ctx)
-{
-	/* Deprecated/legacy */
-
-	GfCtx4k64 *ctx4k;
-	unsigned __int8 am[8];
-	int i, j;
-
-	ctx4k = (GfCtx4k64 *) TCalloc (sizeof (GfCtx4k64));
-	if (!ctx4k)
-		return FALSE;
-
-	memcpy (am, a, 8);
-	MirrorBits64 (am);
-    compile_4k_table64 (am, ctx4k);
-
-	/* Convert LSB-first table to MSB-first */
-	for (i = 0; i < 16; i++) 
-	{
-		for (j = 0; j < 16; j++) 
-		{
-			int jm = 0;
-			jm |= (j & 0x1) << 3;
-			jm |= (j & 0x2) << 1;
-			jm |= (j & 0x4) >> 1;
-			jm |= (j & 0x8) >> 3;
-
-			memcpy (&ctx->gf_t64[i][jm], (unsigned char *)&ctx4k->gf_t4k[15-i][j], 8);
-			MirrorBits64 ((unsigned char *)&ctx->gf_t64[i][jm]);
-		}
-	}
-
-	burn (ctx4k,sizeof (*ctx4k));
-	burn (am, sizeof (am));
-	TCfree (ctx4k);
-	return TRUE;
-}
 
 #define xor_8kt64(i)   \
     xor_block_aligned(r, ctx->gf_t128[i + i][a[i] & 15]); \
@@ -718,36 +681,6 @@ void Gf128MulBy64Tab (unsigned __int8 a[8], unsigned __int8 p[16], GfCtx *ctx)
     move_block_aligned(p, r);
 }
 
-#define xor_8k64(i)   \
-    xor_block_aligned64(r, ctx->gf_t64[i + i][a[i] & 15]); \
-    xor_block_aligned64(r, ctx->gf_t64[i + i + 1][a[i] >> 4])
-
-/* Multiply two 64-bit numbers in the finite field GF(2^64) */
-void Gf64MulTab (unsigned char a[8], unsigned char p[8], GfCtx *ctx)
-{  
-	/* Deprecated/legacy */
-
-	unsigned __int32 r[CBLK_LEN8 >> 2];
-
-	move_block_aligned64(r, ctx->gf_t64[7*2][a[7] & 15]);
-    xor_block_aligned64(r,  ctx->gf_t64[7*2+1][a[7] >> 4]);
-
-	if (*(unsigned __int16 *)a)
-	{
-		xor_8k64(0);
-		xor_8k64(1);
-	}
-	if (a[2])
-	{
-		xor_8k64(2);
-	}
-	xor_8k64(3);
-    xor_8k64(4);
-	xor_8k64(5);
-	xor_8k64(6);
-
-    move_block_aligned64(p, r);
-}
 
 
 /* Basic algorithms for testing of optimized algorithms */
@@ -793,48 +726,6 @@ static void GfMul128Basic (unsigned __int8 *a, unsigned __int8 *b, unsigned __in
 	}
 }
 
-static void xor64 (uint64 *a, uint64 *b)
-{
-	*a ^= *b;
-}
-
-static void shl64 (unsigned __int8 *a)
-{
-	int i, x = 0, xx;
-	for (i = 7; i >= 0; i--)
-	{
-		xx = (a[i] & 0x80) >> 7;
-		a[i] = (char) ((a[i] << 1) | x);
-		x = xx;
-	}
-}
-
-static void GfMul64Basic (unsigned __int8 *a, unsigned __int8 *b, unsigned __int8* p)
-{
-	/* Deprecated/legacy */
-
-	int i;
-	unsigned __int8 la[8];
-	memcpy (la, a, 8);
-	memset (p, 0, 8);
-
-	for (i = 0; i < 64; i++)
-	{
-		if (IsBitSet64 (i, b))
-			xor64 ((uint64 *)p, (uint64 *)la);
-
-		if (la[0] & 0x80)
-		{
-			shl64 (la);
-			la[7] ^= 0x1b;
-		}
-		else
-		{
-			shl64 (la);
-		}
-	}
-}
-
 
 BOOL GfMulSelfTest ()
 {
@@ -849,23 +740,6 @@ BOOL GfMulSelfTest ()
 	if (!gfCtx)
 		return FALSE;
 
-	/* GF(2^64) - deprecated/legacy */
-	for (i = 0; i < 0x100; i++)
-	{
-		for (j = 0; j < 8; j++)
-		{
-			a[j] = (unsigned __int8) i;
-			b[j] = a[j] ^ 0xff;
-		}
-
-		GfMul64Basic (a, b, p1);
-	
-		Gf64TabInit (a, gfCtx);
-		Gf64MulTab (b, p2, gfCtx);
-
-		if (memcmp (p1, p2, 8) != 0)
-			result = FALSE;
-	}
 
 	/* GF(2^128) */
 	for (i = 0; i < 0x100; i++)

src/Common/GfMul.h

@@ -63,8 +63,6 @@ void GfMul128 (void *a, const void* b);
 void GfMul128Tab(unsigned char a[16], GfCtx8k *ctx);
 int Gf128Tab64Init (unsigned __int8 *a, GfCtx *ctx);
 void Gf128MulBy64Tab (unsigned __int8 a[8], unsigned __int8 p[16], GfCtx *ctx);
-int Gf64TabInit (unsigned __int8 *a, GfCtx *ctx);
-void Gf64MulTab (unsigned char a[8], unsigned char p[8], GfCtx *ctx);
 void MirrorBits128 (unsigned __int8 *a);
 void MirrorBits64 (unsigned __int8 *a);
 BOOL GfMulSelfTest ();

src/Common/Keyfiles.c

@@ -23,11 +23,12 @@
 #include "Platform/Finally.h"
 #include "Platform/ForEach.h"
 
-using namespace TrueCrypt;
+#include <Strsafe.h>
+
+using namespace VeraCrypt;
 
 #define stat _stat
 #define S_IFDIR _S_IFDIR
-#define snprintf _snprintf
 
 
 BOOL HiddenFilesPresentInKeyfilePath = FALSE;
@@ -97,13 +98,16 @@ void KeyFileRemoveAll (KeyFile **firstKeyFile)
 
 KeyFile *KeyFileClone (KeyFile *keyFile)
 {
-	KeyFile *clone;
+	KeyFile *clone = NULL;
 
 	if (keyFile == NULL) return NULL;
 
 	clone = (KeyFile *) malloc (sizeof (KeyFile));
-	strcpy (clone->FileName, keyFile->FileName);
-	clone->Next = NULL;
+	if (clone)
+	{
+		StringCbCopyA (clone->FileName, sizeof(clone->FileName), keyFile->FileName);
+		clone->Next = NULL;
+	}
 	return clone;
 }
 
@@ -214,7 +218,7 @@ close:
 }
 
 
-BOOL KeyFilesApply (Password *password, KeyFile *firstKeyFile)
+BOOL KeyFilesApply (HWND hwndDlg, Password *password, KeyFile *firstKeyFile)
 {
 	BOOL status = TRUE;
 	KeyFile kfSubStruct;
@@ -248,8 +252,8 @@ BOOL KeyFilesApply (Password *password, KeyFile *firstKeyFile)
 				if (keyfileData.empty())
 				{
 					SetLastError (ERROR_HANDLE_EOF); 
-					handleWin32Error (MainDlg);
-					Error ("ERR_PROCESS_KEYFILE");
+					handleWin32Error (hwndDlg);
+					Error ("ERR_PROCESS_KEYFILE", hwndDlg);
 					status = FALSE;
 					continue;
 				}
@@ -287,8 +291,8 @@ BOOL KeyFilesApply (Password *password, KeyFile *firstKeyFile)
 		// Determine whether it's a path or a file
 		if (stat (kf->FileName, &statStruct) != 0)
 		{
-			handleWin32Error (MainDlg);
-			Error ("ERR_PROCESS_KEYFILE");
+			handleWin32Error (hwndDlg);
+			Error ("ERR_PROCESS_KEYFILE", hwndDlg);
 			status = FALSE;
 			continue;
 		}
@@ -298,11 +302,11 @@ BOOL KeyFilesApply (Password *password, KeyFile *firstKeyFile)
 			/* Find and process all keyfiles in the directory */
 			int keyfileCount = 0;
 
-			snprintf (searchPath, sizeof (searchPath), "%s\\*.*", kf->FileName);
+			StringCbPrintfA (searchPath, sizeof (searchPath), "%s\\*.*", kf->FileName);
 			if ((searchHandle = _findfirst (searchPath, &fBuf)) == -1)
 			{
-				handleWin32Error (MainDlg);
-				Error ("ERR_PROCESS_KEYFILE_PATH");
+				handleWin32Error (hwndDlg);
+				Error ("ERR_PROCESS_KEYFILE_PATH", hwndDlg);
 				status = FALSE;
 				continue;
 			}
@@ -311,7 +315,7 @@ BOOL KeyFilesApply (Password *password, KeyFile *firstKeyFile)
 			{
 				WIN32_FILE_ATTRIBUTE_DATA fileAttributes;
 
-				snprintf (kfSub->FileName, sizeof(kfSub->FileName), "%s%c%s", kf->FileName,
+				StringCbPrintfA (kfSub->FileName, sizeof(kfSub->FileName), "%s%c%s", kf->FileName,
 					'\\',
 					fBuf.name
 					);
@@ -319,8 +323,8 @@ BOOL KeyFilesApply (Password *password, KeyFile *firstKeyFile)
 				// Determine whether it's a path or a file
 				if (stat (kfSub->FileName, &statStruct) != 0)
 				{
-					handleWin32Error (MainDlg);
-					Error ("ERR_PROCESS_KEYFILE");
+					handleWin32Error (hwndDlg);
+					Error ("ERR_PROCESS_KEYFILE", hwndDlg);
 					status = FALSE;
 					continue;
 				}
@@ -343,8 +347,8 @@ BOOL KeyFilesApply (Password *password, KeyFile *firstKeyFile)
 				// Apply keyfile to the pool
 				if (!KeyFileProcess (keyPool, kfSub))
 				{
-					handleWin32Error (MainDlg);
-					Error ("ERR_PROCESS_KEYFILE");
+					handleWin32Error (hwndDlg);
+					Error ("ERR_PROCESS_KEYFILE", hwndDlg);
 					status = FALSE;
 				}
 
@@ -355,15 +359,15 @@ BOOL KeyFilesApply (Password *password, KeyFile *firstKeyFile)
 
 			if (keyfileCount == 0)
 			{
-				ErrorDirect ((wstring (GetString ("ERR_KEYFILE_PATH_EMPTY")) + L"\n\n" + SingleStringToWide (kf->FileName)).c_str());
+				ErrorDirect ((wstring (GetString ("ERR_KEYFILE_PATH_EMPTY")) + L"\n\n" + SingleStringToWide (kf->FileName)).c_str(), hwndDlg);
 				status = FALSE;
 			}
 		}
 		// Apply keyfile to the pool
 		else if (!KeyFileProcess (keyPool, kf))
 		{
-			handleWin32Error (MainDlg);
-			Error ("ERR_PROCESS_KEYFILE");
+			handleWin32Error (hwndDlg);
+			Error ("ERR_PROCESS_KEYFILE", hwndDlg);
 			status = FALSE;
 		}
 	}
@@ -462,18 +466,21 @@ BOOL CALLBACK KeyFilesDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 		if (lw == IDC_KEYADD)
 		{
 			KeyFile *kf = (KeyFile *) malloc (sizeof (KeyFile));
-			if (SelectMultipleFiles (hwndDlg, "SELECT_KEYFILE", kf->FileName, bHistory))
+			if (kf)
 			{
-				do
+				if (SelectMultipleFiles (hwndDlg, "SELECT_KEYFILE", kf->FileName, sizeof(kf->FileName),bHistory))
 				{
-					param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
-					LoadKeyList (hwndDlg, param->FirstKeyFile);
+					do
+					{
+						param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
+						LoadKeyList (hwndDlg, param->FirstKeyFile);
 
-					kf = (KeyFile *) malloc (sizeof (KeyFile));
-				} while (SelectMultipleFilesNext (kf->FileName));
+						kf = (KeyFile *) malloc (sizeof (KeyFile));
+					} while (SelectMultipleFilesNext (kf->FileName, sizeof(kf->FileName)));
+				}
+
+				free (kf);
 			}
-
-			free (kf);
 			return 1;
 		}
 
@@ -501,10 +508,13 @@ BOOL CALLBACK KeyFilesDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 				foreach (const SecurityTokenKeyfilePath &keyPath, selectedTokenKeyfiles)
 				{
 					KeyFile *kf = (KeyFile *) malloc (sizeof (KeyFile));
-					strcpy_s (kf->FileName, sizeof (kf->FileName), WideToSingleString (keyPath).c_str());
+					if (kf)
+					{
+						strcpy_s (kf->FileName, sizeof (kf->FileName), WideToSingleString (keyPath).c_str());
 
-					param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
-					LoadKeyList (hwndDlg, param->FirstKeyFile);
+						param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
+						LoadKeyList (hwndDlg, param->FirstKeyFile);
+					}
 				}
 			}
 
@@ -547,6 +557,7 @@ BOOL CALLBACK KeyFilesDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 		if (lw == IDC_LINK_KEYFILES_INFO)
 		{
 			Applink ("keyfiles", TRUE, "");
+			return 1;
 		}
 
 		if (lw == IDOK)
@@ -564,6 +575,7 @@ BOOL CALLBACK KeyFilesDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 			EndDialog (hwndDlg, IDCLOSE);
 			return 1;
 		}
+		break;
 
 	case WM_DROPFILES:
 		{
@@ -574,9 +586,12 @@ BOOL CALLBACK KeyFilesDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 			while (count-- > 0)
 			{
 				KeyFile *kf = (KeyFile *) malloc (sizeof (KeyFile));
-				DragQueryFile (hdrop, i++, kf->FileName, sizeof (kf->FileName));
-				param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
-				LoadKeyList (hwndDlg, param->FirstKeyFile);
+				if (kf)
+				{
+					DragQueryFile (hdrop, i++, kf->FileName, sizeof (kf->FileName));
+					param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
+					LoadKeyList (hwndDlg, param->FirstKeyFile);
+				}
 			}
 
 			DragFinish (hdrop);
@@ -614,6 +629,8 @@ BOOL CALLBACK KeyFilesDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 BOOL KeyfilesPopupMenu (HWND hwndDlg, POINT popupPosition, KeyFilesDlgParam *param)
 {
 	HMENU popup = CreatePopupMenu ();
+	if (!popup)
+		return FALSE;
 	int sel;
 	BOOL status = FALSE;
 
@@ -628,35 +645,40 @@ BOOL KeyfilesPopupMenu (HWND hwndDlg, POINT popupPosition, KeyFilesDlgParam *par
 	case IDM_KEYFILES_POPUP_ADD_FILES:
 		{
 			KeyFile *kf = (KeyFile *) malloc (sizeof (KeyFile));
-			if (SelectMultipleFiles (hwndDlg, "SELECT_KEYFILE", kf->FileName, bHistory))
+			if (kf)
 			{
-				do
+				if (SelectMultipleFiles (hwndDlg, "SELECT_KEYFILE", kf->FileName, sizeof(kf->FileName),bHistory))
 				{
-					param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
-					kf = (KeyFile *) malloc (sizeof (KeyFile));
-				} while (SelectMultipleFilesNext (kf->FileName));
+					do
+					{
+						param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
+						kf = (KeyFile *) malloc (sizeof (KeyFile));
+					} while (SelectMultipleFilesNext (kf->FileName, sizeof(kf->FileName)));
 
-				param->EnableKeyFiles = TRUE;
-				status = TRUE;
+					param->EnableKeyFiles = TRUE;
+					status = TRUE;
+				}
+
+				free (kf);
 			}
-
-			free (kf);
 		}
 		break;
 
 	case IDM_KEYFILES_POPUP_ADD_DIR:
 		{
 			KeyFile *kf = (KeyFile *) malloc (sizeof (KeyFile));
-
-			if (BrowseDirectories (hwndDlg,"SELECT_KEYFILE_PATH", kf->FileName))
+			if (kf)
 			{
-				param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
-				param->EnableKeyFiles = TRUE;
-				status = TRUE;
-			}
-			else
-			{
-				free (kf);
+				if (BrowseDirectories (hwndDlg,"SELECT_KEYFILE_PATH", kf->FileName))
+				{
+					param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
+					param->EnableKeyFiles = TRUE;
+					status = TRUE;
+				}
+				else
+				{
+					free (kf);
+				}
 			}
 		}
 		break;
@@ -669,11 +691,14 @@ BOOL KeyfilesPopupMenu (HWND hwndDlg, POINT popupPosition, KeyFilesDlgParam *par
 				foreach (const SecurityTokenKeyfilePath &keyPath, selectedTokenKeyfiles)
 				{
 					KeyFile *kf = (KeyFile *) malloc (sizeof (KeyFile));
-					strcpy_s (kf->FileName, sizeof (kf->FileName), WideToSingleString (keyPath).c_str());
+					if (kf)
+					{
+						strcpy_s (kf->FileName, sizeof (kf->FileName), WideToSingleString (keyPath).c_str());
 
-					param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
-					param->EnableKeyFiles = TRUE;
-					status = TRUE;
+						param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
+						param->EnableKeyFiles = TRUE;
+						status = TRUE;
+					}
 				}
 			}
 		}

src/Common/Keyfiles.h

@@ -20,7 +20,7 @@ extern "C" {
 
 typedef struct KeyFileStruct
 {
-	char FileName[MAX_PATH];
+	char FileName[MAX_PATH + 1];
 	struct KeyFileStruct *Next;
 } KeyFile;
 
@@ -34,7 +34,7 @@ KeyFile *KeyFileAdd (KeyFile *firstKeyFile, KeyFile *keyFile);
 void KeyFileRemoveAll (KeyFile **firstKeyFile);
 KeyFile *KeyFileClone (KeyFile *keyFile);
 KeyFile *KeyFileCloneAll (KeyFile *firstKeyFile);
-BOOL KeyFilesApply (Password *password, KeyFile *firstKeyFile);
+BOOL KeyFilesApply (HWND hwndDlg, Password *password, KeyFile *firstKeyFile);
 
 BOOL CALLBACK KeyFilesDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam);
 BOOL KeyfilesPopupMenu (HWND hwndDlg, POINT popupPosition, KeyFilesDlgParam *dialogParam);

src/Common/Language.c

@@ -26,6 +26,8 @@
 #include "../Setup/Resource.h"
 #endif
 
+#include <Strsafe.h>
+
 BOOL LocalizationActive;
 int LocalizationSerialNo;
 
@@ -68,8 +70,9 @@ static char *MapNextLanguageFile ()
 		GetModuleFileNameW (NULL, f, sizeof (f) / sizeof (f[0]));
 		t = wcsrchr (f, L'\\');
 		if (t == NULL) return NULL;
-
-		wcscpy (t, L"\\Language*.xml");
+		
+		*t = 0;
+		StringCbCatW (f, sizeof(f), L"\\Language*.xml");
 
 		LanguageFileFindHandle = FindFirstFileW (f, &find);
 	}
@@ -88,14 +91,29 @@ static char *MapNextLanguageFile ()
 
 	GetModuleFileNameW (NULL, f, sizeof (f) / sizeof(f[0]));
 	t = wcsrchr (f, L'\\');
-	wcscpy (t + 1, find.cFileName);
+	if (t == NULL)
+	{
+		free(LanguageFileBuffer);
+		return NULL;
+	}
+
+	t[1] = 0;
+	StringCbCatW (f, sizeof(f),find.cFileName);
 
 	file = CreateFileW (f, GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, NULL);
-	if (file == INVALID_HANDLE_VALUE) return NULL;
+	if (file == INVALID_HANDLE_VALUE)
+	{
+		free(LanguageFileBuffer);
+		return NULL;
+	}
 
 	ReadFile (file, LanguageFileBuffer, find.nFileSizeLow, &read, NULL);
 	CloseHandle (file);
-	if (read != find.nFileSizeLow) return NULL;
+	if (read != find.nFileSizeLow)
+	{
+		free(LanguageFileBuffer);
+		return NULL;
+	}
 
 	return LanguageFileBuffer;
 }
@@ -130,7 +148,7 @@ BOOL LoadLanguageFile ()
 	ClearDictionaryPool ();
 
 	if (PreferredLangId[0] != 0)
-		strcpy (langId, PreferredLangId);
+		StringCbCopyA (langId, sizeof(langId), PreferredLangId);
 
 	// Parse all available language files until preferred language is found
 	for (res = MapFirstLanguageFile (); res != NULL; res = MapNextLanguageFile ())
@@ -147,7 +165,7 @@ BOOL LoadLanguageFile ()
 		if (defaultLangParsed && strcmp (attr, VERSION_STRING) && strcmp (attr, "DEBUG"))
 		{
 			wchar_t m[2048];
-			swprintf (m, L"The installed language pack is incompatible with this version of VeraCrypt (the language pack is for VeraCrypt %hs). A newer version may be available at www.idrix.fr.\n\nTo prevent this message from being displayed, do any of the following:\n\n- Select 'Settings' > 'Language'; then select 'English' and click 'OK'.\n\n- Remove or replace the language pack with a compatible version (the language pack may reside e.g. in 'C:\\Program Files\\VeraCrypt' or '%%LOCALAPPDATA%%\\VirtualStore\\Program Files\\VeraCrypt', etc.)", attr);
+			StringCbPrintfW (m, sizeof(m), L"The installed language pack is incompatible with this version of VeraCrypt (the language pack is for VeraCrypt %hs). A newer version may be available at www.idrix.fr.\n\nTo prevent this message from being displayed, do any of the following:\n\n- Select 'Settings' > 'Language'; then select 'English' and click 'OK'.\n\n- Remove or replace the language pack with a compatible version (the language pack may reside e.g. in 'C:\\Program Files\\VeraCrypt' or '%%LOCALAPPDATA%%\\VirtualStore\\Program Files\\VeraCrypt', etc.)", attr);
 			MessageBoxW (NULL, m, L"VeraCrypt", MB_ICONERROR);
 			continue;
 		}
@@ -189,7 +207,7 @@ BOOL LoadLanguageFile ()
 				XmlGetAttributeText (xml, "size", attr, sizeof (attr));
 				sscanf (attr, "%d", &font.Size);
 
-				strcpy (attr, "font_");
+				StringCbCopyA (attr, sizeof(attr), "font_");
 				XmlGetAttributeText (xml, "class", attr + 5, sizeof (attr) - 5);
 				AddDictionaryEntry (
 					AddPoolData ((void *) attr, strlen (attr) + 1), 0,
@@ -298,7 +316,7 @@ BOOL LoadLanguageFile ()
 
 		do
 		{
-			if (sscanf (header, "#define %s %d", key, &intKey) == 2)
+			if (sscanf (header, "#define %127s %d", key, &intKey) == 2)
 			{
 				WCHAR *str = GetString (key);
 
@@ -375,13 +393,13 @@ BOOL CALLBACK LanguageDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 								// Language pack version 
 								if (!ActiveLangPackVersion[0] || memcmp (ActiveLangPackVersion, "0.0.0", 5) == 0)
 								{
-									swprintf (szVers, GetString("LANG_PACK_VERSION"), L"--");
+									StringCbPrintfW (szVers, sizeof(szVers), GetString("LANG_PACK_VERSION"), L"--");
 								}
 								else
 								{
 									nLen = MultiByteToWideChar (CP_UTF8, 0, ActiveLangPackVersion, -1, wversion, sizeof (wversion) / sizeof(wversion[0]));
 									if (nLen != 0 && nLen != ERROR_NO_UNICODE_TRANSLATION)
-										swprintf (szVers, GetString("LANG_PACK_VERSION"), wversion);
+										StringCbPrintfW (szVers, sizeof(szVers),GetString("LANG_PACK_VERSION"), wversion);
 								}
 								SetWindowTextW (GetDlgItem (hwndDlg, IDC_LANGPACK_VERSION), szVers);
 
@@ -394,7 +412,7 @@ BOOL CALLBACK LanguageDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 								}
 							}
 
-							strcpy (lastLangId, attr);
+							StringCbCopyA (lastLangId, sizeof(lastLangId),attr);
 							langCount++;
 						}
 					}
@@ -410,7 +428,7 @@ BOOL CALLBACK LanguageDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 					EndDialog (hwndDlg, IDCANCEL);
 
 				if (langCount == 2)
-					strcpy (PreferredLangId, lastLangId);
+					StringCbCopyA (PreferredLangId, sizeof(PreferredLangId), lastLangId);
 				
 				EndDialog (hwndDlg, IDOK);
 			}
@@ -446,7 +464,7 @@ BOOL CALLBACK LanguageDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 					}	
 		
 					if (SendDlgItemMessage (hwndDlg, IDC_LANGLIST, LB_GETCOUNT, 0, 0) > 1)
-						strcpy (PreferredLangId, l);
+						StringCbCopyA (PreferredLangId, sizeof(PreferredLangId), l);
 				}
 			}
 
@@ -465,7 +483,7 @@ BOOL CALLBACK LanguageDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 			char tmpstr [256];
 
 			if (strlen (ActiveLangPackVersion) > 0 && strlen (GetPreferredLangId()) > 0)
-				sprintf (tmpstr, "&langpackversion=%s&lang=%s", ActiveLangPackVersion, GetPreferredLangId());
+				StringCbPrintfA (tmpstr, sizeof(tmpstr), "&langpackversion=%s&lang=%s", ActiveLangPackVersion, GetPreferredLangId());
 			else
 				tmpstr[0] = 0;
 
@@ -488,7 +506,7 @@ char *GetPreferredLangId ()
 
 void SetPreferredLangId (char *langId)
 {
-	strncpy (PreferredLangId, langId, 5);
+	StringCbCopyA (PreferredLangId, sizeof(PreferredLangId), langId);
 }
 
 
@@ -503,7 +521,7 @@ wchar_t *GetString (const char *stringId)
 	WCHAR *str = (WCHAR *) GetDictionaryValue (stringId);
 	if (str != NULL) return str;
 
-	wsprintfW (UnknownString, UNKNOWN_STRING_ID L"%hs" UNKNOWN_STRING_ID, stringId);
+	StringCbPrintfW (UnknownString, sizeof(UnknownString), UNKNOWN_STRING_ID L"%hs" UNKNOWN_STRING_ID, stringId);
 	return UnknownString;
 }
 

src/Common/Language.xml

@@ -44,6 +44,7 @@
     <control lang="en" key="IDC_HIDVOL_WIZ_MODE_FULL">Normal mode</control>
     <control lang="en" key="IDC_KB">&amp;KB</control>
     <control lang="en" key="IDC_KEYFILES_ENABLE">U&amp;se keyfiles</control>
+    <control lang="en" key="IDC_KEYFILES_RANDOM_SIZE">Random size ( 64 &lt;-&gt; 1048576 )</control>
     <control lang="en" key="IDC_KEY_FILES">&amp;Keyfiles...</control>
     <control lang="en" key="IDC_LINK_HASH_INFO">Information on hash algorithms</control>
     <control lang="en" key="IDC_LINK_MORE_INFO_ABOUT_CIPHER">More information</control>
@@ -145,6 +146,7 @@
     <control lang="en" key="IDC_PREF_CACHE_PASSWORDS">Cache passwords in driver memory</control>
     <control lang="en" key="IDC_PREF_DISMOUNT_INACTIVE">Auto-dismount volume after no data has been read/written to it for</control>
     <control lang="en" key="IDC_PREF_DISMOUNT_LOGOFF">User logs off</control>
+    <control lang="en" key="IDC_PREF_DISMOUNT_SESSION_LOCKED">User session locked</control>
     <control lang="en" key="IDC_PREF_DISMOUNT_POWERSAVING">Entering power saving mode</control>
     <control lang="en" key="IDC_PREF_DISMOUNT_SCREENSAVER">Screen saver is launched</control>
     <control lang="en" key="IDC_PREF_FORCE_AUTO_DISMOUNT">Force auto-dismount even if volume contains open files or directories</control>
@@ -165,6 +167,7 @@
     <control lang="en" key="IDC_SHOW_PASSWORD_CHPWD_ORI">Display password</control>
     <control lang="en" key="IDC_TRAVEL_OPEN_EXPLORER">Open &amp;Explorer window for mounted volume</control>
     <control lang="en" key="IDC_TRAV_CACHE_PASSWORDS">&amp;Cache password in driver memory</control>
+	 <control lang="en" key="IDC_TRUECRYPT_MODE">TrueCrypt Mode</control>
     <control lang="en" key="IDC_UNMOUNTALL">Di&amp;smount All</control>
     <control lang="en" key="IDC_VOLUME_PROPERTIES">&amp;Volume Properties...</control>
     <control lang="en" key="IDC_VOLUME_TOOLS">Volume &amp;Tools...</control>
@@ -198,6 +201,7 @@
     <control lang="en" key="IDM_CREATE_RESCUE_DISK">Create Rescue Disk...</control>
     <control lang="en" key="IDM_CREATE_VOLUME">Create New Volume...</control>
     <control lang="en" key="IDM_DEFAULT_KEYFILES">Default Keyfiles...</control>
+	 <control lang="en" key="IDM_DONATE">Donate now...</control>
     <control lang="en" key="IDM_ENCRYPT_SYSTEM_DEVICE">Encrypt System Partition/Drive...</control>
     <control lang="en" key="IDM_FAQ">Frequently Asked Questions</control>
     <control lang="en" key="IDM_HELP">User's Guide</control>
@@ -268,6 +272,7 @@
     <control lang="en" key="IDT_PARALLELIZATION_OPTIONS">Thread-Based Parallelization</control>
     <control lang="en" key="IDT_PKCS11_LIB_PATH">PKCS #11 Library Path</control>
     <control lang="en" key="IDT_PKCS5_PRF">PKCS-5 PRF:</control>
+    <control lang="en" key="IDT_NEW_PKCS5_PRF">PKCS-5 PRF:</control>
     <control lang="en" key="IDT_PW_CACHE_OPTIONS">Password Cache</control>
     <control lang="en" key="IDT_SECURITY_OPTIONS">Security Options</control>
     <control lang="en" key="IDT_TASKBAR_ICON">VeraCrypt Background Task</control>
@@ -330,6 +335,9 @@
     <control lang="en" key="IDT_KEYFILE_GENERATOR_NOTE">IMPORTANT: Move your mouse as randomly as possible within this window. The longer you move it, the better. This significantly increases the cryptographic strength of the keyfile.</control>
     <control lang="en" key="IDT_KEYFILE_WARNING">WARNING: If you lose a keyfile or if any bit of its first 1024 kilobytes changes, it will be impossible to mount volumes that use the keyfile!</control>
     <control lang="en" key="IDT_KEY_UNIT">bits</control>
+    <control lang="en" key="IDT_NUMBER_KEYFILES">Number of keyfiles:</control>
+    <control lang="en" key="IDT_KEYFILES_SIZE">Keyfiles size (in Bytes):</control>
+    <control lang="en" key="IDT_KEYFILES_BASE_NAME">Keyfiles base name:</control>
     <control lang="en" key="IDT_LANGPACK_AUTHORS">Translated by:</control>
     <control lang="en" key="IDT_PLAINTEXT">Plaintext size:</control>
     <control lang="en" key="IDT_PLAINTEXT_SIZE_UNIT">bits</control>
@@ -340,6 +348,7 @@
     <control lang="en" key="IDT_SECURITY_TOKEN">Security token:</control>
     <control lang="en" key="IDT_SORT_METHOD">Sort Method:</control>
     <control lang="en" key="IDT_STATIC_MODELESS_WAIT_DLG_INFO">Please wait. This process may take a long time...</control>
+    <control lang="en" key="IDT_STATIC_MODAL_WAIT_DLG_INFO">Please wait...\nThis process may take a long time and VeraCrypt may seem unresponsive.</control>
     <control lang="en" key="IDT_TEST_BLOCK_NUMBER">Block number:</control>
     <control lang="en" key="IDT_TEST_CIPHERTEXT">Ciphertext (hexadecimal)</control>
     <control lang="en" key="IDT_TEST_DATA_UNIT_NUMBER">Data unit number (64-bit hexadecimal, data unit size is 512 bytes)</control>
@@ -431,7 +440,7 @@
     <string lang="en" key="ASK_DEBUGGER_INSTALL">In order to analyze the system crash, VeraCrypt needs to install Microsoft Debugging Tools for Windows first.\n\nAfter you click OK, the Windows installer will download the Microsoft Debugging Tools installation package (16 MB) from a Microsoft server and install it (the Windows installer will be forwarded to the Microsoft server URL from the veracrypt.org server, which ensures that this feature works even if Microsoft changes the location of the installation package).</string>
     <string lang="en" key="SYSTEM_CRASH_ANALYSIS_INFO">After you click OK, VeraCrypt will analyze the system crash. This may take up to several minutes.</string>
     <string lang="en" key="DEBUGGER_NOT_FOUND">Please make sure the environment variable 'PATH' includes the path to 'kd.exe' (Kernel Debugger).</string>
-    <string lang="en" key="SYSTEM_CRASH_NO_TRUECRYPT">It appears that VeraCrypt most likely did not cause the system crash. There are many potential reasons why the system could have crashed (for example, a failing hardware component, a bug in a device driver, etc.)</string>
+    <string lang="en" key="SYSTEM_CRASH_NO_VERACRYPT">It appears that VeraCrypt most likely did not cause the system crash. There are many potential reasons why the system could have crashed (for example, a failing hardware component, a bug in a device driver, etc.)</string>
     <string lang="en" key="SYSTEM_CRASH_UPDATE_DRIVER">Results of the analysis indicate that updating the following driver might solve this issue: </string>
     <string lang="en" key="SYSTEM_CRASH_REPORT">To help us determine whether there is a bug in VeraCrypt, you can send us an automatically generated error report containing the following items:\n- Program version\n- Operating system version\n- Type of CPU\n- Error category\n- Driver name and version\n- System call stack\n\nIf you select 'Yes', the following URL (which contains the entire error report) will be opened in your default Internet browser.</string>
     <string lang="en" key="ASK_SEND_ERROR_REPORT">Do you want to send us the above error report?</string>
@@ -476,7 +485,7 @@
     <string lang="en" key="FORMAT_FINISHED_HELP">\n\nThe VeraCrypt volume has been created and is ready for use. If you wish to create another VeraCrypt volume, click Next. Otherwise, click Exit.</string>
     <string lang="en" key="SYSENC_HIDDEN_VOL_FORMAT_FINISHED_HELP">\n\nThe hidden VeraCrypt volume has been successfully created (the hidden operating system will reside within this hidden volume).\n\nClick Next to continue.</string>
     <string lang="en" key="NONSYS_INPLACE_ENC_FINISHED_TITLE">Volume Fully Encrypted</string>
-    <string lang="en" key="NONSYS_INPLACE_ENC_FINISHED_INFO">IMPORTANT: TO MOUNT THIS NEWLY CREATED HDCRYPT VOLUME AND TO ACCESS DATA STORED IN IT, CLICK 'Auto-Mount Devices' IN THE MAIN TRUECRYPT WINDOW. After you enter the correct password (and/or supply correct keyfiles), the volume will be mounted to the drive letter you select from the list in the main VeraCrypt window (and you will be able to access the encrypted data via the selected drive letter).\n\nPLEASE REMEMBER OR WRITE DOWN THE ABOVE STEPS. YOU MUST FOLLOW THEM WHENEVER YOU WANT TO MOUNT THE VOLUME AND ACCESS DATA STORED IN IT. Alternatively, in the main VeraCrypt window, click 'Select Device', then select this partition/volume, and click 'Mount'.\n\nThe partition/volume has been successfully encrypted (it contains a fully encrypted VeraCrypt volume now) and is ready for use.</string>
+    <string lang="en" key="NONSYS_INPLACE_ENC_FINISHED_INFO">IMPORTANT: TO MOUNT THIS NEWLY CREATED VERACRYPT VOLUME AND TO ACCESS DATA STORED IN IT, CLICK 'Auto-Mount Devices' IN THE MAIN VERACRYPT WINDOW. After you enter the correct password (and/or supply correct keyfiles), the volume will be mounted to the drive letter you select from the list in the main VeraCrypt window (and you will be able to access the encrypted data via the selected drive letter).\n\nPLEASE REMEMBER OR WRITE DOWN THE ABOVE STEPS. YOU MUST FOLLOW THEM WHENEVER YOU WANT TO MOUNT THE VOLUME AND ACCESS DATA STORED IN IT. Alternatively, in the main VeraCrypt window, click 'Select Device', then select this partition/volume, and click 'Mount'.\n\nThe partition/volume has been successfully encrypted (it contains a fully encrypted VeraCrypt volume now) and is ready for use.</string>
     <string lang="en" key="FORMAT_FINISHED_INFO">The VeraCrypt volume has been successfully created.</string>
     <string lang="en" key="FORMAT_FINISHED_TITLE">Volume Created</string>
     <string lang="en" key="FORMAT_HELP">IMPORTANT: Move your mouse as randomly as possible within this window. The longer you move it, the better. This significantly increases the cryptographic strength of the encryption keys. Then click Format to create the volume.</string>
@@ -489,7 +498,7 @@
     <string lang="en" key="HIDDEN_VOL_WIZARD_MODE_DIRECT_HELP">If you select this option, you will create a hidden volume within an existing VeraCrypt volume. It will be assumed that you have already created a VeraCrypt volume that is suitable to host the hidden volume.</string>
     <string lang="en" key="HIDDEN_VOL_WIZARD_MODE_TITLE">Volume Creation Mode</string>
     <string lang="en" key="HIDVOL_FORMAT_FINISHED_TITLE">Hidden Volume Created</string>
-    <string lang="en" key="HIDVOL_FORMAT_FINISHED_HELP">The hidden VeraCrypt volume has been successfully created and is ready for use. If all the instructions have been followed and if the precautions and requirements listed in the section "Security Requirements and Precautions Pertaining to Hidden Volumes" in the VeraCrypt User's Guide are followed, it should be impossible to prove that the hidden volume exists, even when the outer volume is mounted.\n\nWARNING: IF YOU DO NOT PROTECT THE HIDDEN VOLUME (FOR INFORMATION ON HOW TO DO SO, REFER TO THE SECTION "PROTECTION OF HIDDEN VOLUMES AGAINST DAMAGE" IN THE HDCRYPT USER'S GUIDE), DO NOT WRITE TO THE OUTER VOLUME. OTHERWISE, YOU MAY OVERWRITE AND DAMAGE THE HIDDEN VOLUME!</string>
+    <string lang="en" key="HIDVOL_FORMAT_FINISHED_HELP">The hidden VeraCrypt volume has been successfully created and is ready for use. If all the instructions have been followed and if the precautions and requirements listed in the section "Security Requirements and Precautions Pertaining to Hidden Volumes" in the VeraCrypt User's Guide are followed, it should be impossible to prove that the hidden volume exists, even when the outer volume is mounted.\n\nWARNING: IF YOU DO NOT PROTECT THE HIDDEN VOLUME (FOR INFORMATION ON HOW TO DO SO, REFER TO THE SECTION "PROTECTION OF HIDDEN VOLUMES AGAINST DAMAGE" IN THE VERACRYPT USER'S GUIDE), DO NOT WRITE TO THE OUTER VOLUME. OTHERWISE, YOU MAY OVERWRITE AND DAMAGE THE HIDDEN VOLUME!</string>
     <string lang="en" key="FIRST_HIDDEN_OS_BOOT_INFO">You have started the hidden operating system. As you may have noticed, the hidden operating system appears to be installed on the same partition as the original operating system. However, in reality, it is installed within the partition behind it (in the hidden volume). All read and write operations are being transparently redirected from the original system partition to the hidden volume.\n\nNeither the operating system nor applications will know that data written to and read from the system partition are actually written to and read from the partition behind it (from/to a hidden volume). Any such data is encrypted and decrypted on the fly as usual (with an encryption key different from the one that will be used for the decoy operating system).\n\n\nPlease click Next to continue.</string>
     <string lang="en" key="HIDVOL_HOST_FILLING_HELP_SYSENC">The outer volume has been created and mounted as drive %hc:. To this outer volume you should now copy some sensitive-looking files that you actually do NOT want to hide. They will be there for anyone forcing you to disclose the password for the first partition behind the system partition, where both the outer volume and the hidden volume (containing the hidden operating system) will reside. You will be able to reveal the password for this outer volume, and the existence of the hidden volume (and of the hidden operating system) will remain secret.\n\nIMPORTANT: The files you copy to the outer volume should not occupy more than %s. Otherwise, there may not be enough free space on the outer volume for the hidden volume (and you will not be able to continue). After you finish copying, click Next (do not dismount the volume).</string>
     <string lang="en" key="HIDVOL_HOST_FILLING_HELP">Outer volume has been successfully created and mounted as drive %hc:. To this volume you should now copy some sensitive-looking files that you actually do NOT want to hide. The files will be there for anyone forcing you to disclose your password. You will reveal only the password for this outer volume, not for the hidden one. The files that you really care about will be stored in the hidden volume, which will be created later on. When you finish copying, click Next. Do not dismount the volume.\n\nNote: After you click Next, cluster bitmap of the outer volume will be scanned to determine the size of uninterrupted area of free space whose end is aligned with the end of the volume. This area will accommodate the hidden volume, so it will limit its maximum possible size. Cluster bitmap scanning ensures that no data on the outer volume are overwritten by the hidden volume.</string>
@@ -549,7 +558,7 @@
     <string lang="en" key="SELECT_PKCS11_MODULE">Select PKCS #11 Library</string>
     <string lang="en" key="OUTOFMEMORY">Out of Memory</string>
     <string lang="en" key="FORMAT_DEVICE_FOR_ADVANCED_ONLY">IMPORTANT: We strongly recommend that inexperienced users create a VeraCrypt file container on the selected device/partition, instead of attempting to encrypt the entire device/partition.\n\nWhen you create a VeraCrypt file container (as opposed to encrypting a device or partition) there is, for example, no risk of destroying a large number of files. Note that a VeraCrypt file container (even though it contains a virtual encrypted disk) is actually just like any normal file. For more information, see the chapter Beginner's Tutorial in the VeraCrypt User Guide.\n\nAre you sure you want to encrypt the entire device/partition?</string>
-    <string lang="en" key="OVERWRITEPROMPT">WARNING: The file '%hs' already exists!\n\nIMPORTANT: HDCRYPT WILL NOT ENCRYPT THE FILE, BUT IT WILL DELETE IT. Are you sure you want to delete the file and replace it with a new VeraCrypt container?</string>
+    <string lang="en" key="OVERWRITEPROMPT">WARNING: The file '%hs' already exists!\n\nIMPORTANT: VERACRYPT WILL NOT ENCRYPT THE FILE, BUT IT WILL DELETE IT. Are you sure you want to delete the file and replace it with a new VeraCrypt container?</string>
     <string lang="en" key="OVERWRITEPROMPT_DEVICE">CAUTION: ALL FILES CURRENTLY STORED ON THE SELECTED %s '%hs'%s WILL BE ERASED AND LOST (THEY WILL NOT BE ENCRYPTED)!\n\nAre you sure you want to proceed with format?</string>
     <string lang="en" key="NONSYS_INPLACE_ENC_CONFIRM">WARNING: You will not be able to mount the volume or access any files stored on it until it has been fully encrypted.\n\nAre you sure you want to start encrypting the selected %s '%hs'%s?</string>
     <string lang="en" key="NONSYS_INPLACE_ENC_CONFIRM_BACKUP">WARNING: Please note that if power supply is suddenly interrupted while encrypting existing data in place, or when the operating system crashes due to a software error or hardware malfunction while VeraCrypt is encrypting existing data in place, portions of the data will be corrupted or lost. Therefore, before you start encrypting, please make sure that you have backup copies of the files you want to encrypt.\n\nDo you have such a backup?</string>
@@ -599,6 +608,7 @@
     <string lang="en" key="SELECT_DEST_DIR">Select destination directory</string>
     <string lang="en" key="SELECT_KEYFILE">Select Keyfile</string>
     <string lang="en" key="SELECT_KEYFILE_PATH">Select a keyfile search path. WARNING: Note that only the path will be remembered, not the filenames!</string>
+    <string lang="en" key="SELECT_KEYFILE_GENERATION_DIRECTORY">Select a directory where to store the keyfiles.</string>
     <string lang="en" key="SERPENT_HELP">Designed by Ross Anderson, Eli Biham, and Lars Knudsen. Published in 1998. 256-bit key, 128-bit block. Mode of operation is XTS. Serpent was one of the AES finalists.</string>
     <string lang="en" key="SIZE_HELP">Please specify the size of the container you want to create.\n\nIf you create a dynamic (sparse-file) container, this parameter will specify its maximum possible size.\n\nNote that the minimum possible size of a FAT volume is 292 KB. The minimum possible size of an NTFS volume is 3792 KB.</string>
     <string lang="en" key="SIZE_HELP_HIDDEN_HOST_VOL">Please specify the size of the outer volume to be created (you will first create the outer volume and then a hidden volume within it). The minimum possible size of a volume within which a hidden volume is intended to be created is 340 KB.</string>
@@ -750,6 +760,7 @@
     <string lang="en" key="REMOVABLE_DISK">Removable Disk</string>
     <string lang="en" key="HARDDISK">Harddisk</string>
     <string lang="en" key="UNCHANGED">Unchanged</string>
+    <string lang="en" key="AUTODETECTION">Autodetection</string>
     <string lang="en" key="SETUP_MODE_TITLE">Wizard Mode</string>
     <string lang="en" key="SETUP_MODE_INFO">Select one of the modes. If you are not sure which to select, use the default mode.</string>
     <string lang="en" key="SETUP_MODE_HELP_INSTALL">Select this option if you want to install VeraCrypt on this system.</string>
@@ -862,7 +873,12 @@
     <string lang="en" key="ENTER_NORMAL_VOL_PASSWORD">Enter password for the normal/outer volume</string>
     <string lang="en" key="ENTER_HIDDEN_VOL_PASSWORD">Enter password for the hidden volume</string>
     <string lang="en" key="ENTER_HEADER_BACKUP_PASSWORD">Enter password for the header stored in backup file</string>
-    <string lang="en" key="KEYFILE_CREATED">Keyfile has been successfully created.</string>
+    <string lang="en" key="KEYFILE_CREATED">Keyfiles have been successfully created.</string>
+    <string lang="en" key="KEYFILE_INCORRECT_NUMBER">The number of keyfiles you supplied is invalid.</string>
+    <string lang="en" key="KEYFILE_INCORRECT_SIZE">The keyfile size must be comprized between 64 and 1048576 bytes.</string>
+    <string lang="en" key="KEYFILE_EMPTY_BASE_NAME">Please enter a name for the keyfile(s) to be generated</string>
+    <string lang="en" key="KEYFILE_INVALID_BASE_NAME">The base name of the keyfile(s) is invalid</string>
+    <string lang="en" key="KEYFILE_ALREADY_EXISTS">The keyfile '%s' already exists.\nDo you want to overwrite it? The generation process will be stopped if you answer No.</string>
     <string lang="en" key="HEADER_DAMAGED_AUTO_USED_HEADER_BAK">WARNING: The header of this volume is damaged! VeraCrypt automatically used the backup of the volume header embedded in the volume.\n\nYou should repair the volume header by selecting 'Tools' > 'Restore Volume Header'.</string>
     <string lang="en" key="VOL_HEADER_BACKED_UP">Volume header backup has been successfully created.\n\nIMPORTANT: Restoring the volume header using this backup will also restore the current volume password. Moreover, if keyfile(s) are/is necessary to mount the volume, the same keyfile(s) will be necessary to mount the volume again when the volume header is restored.\n\nWARNING: This volume header backup may be used to restore the header ONLY of this particular volume. If you use this header backup to restore a header of a different volume, you will be able to mount the volume, but you will NOT be able to decrypt any data stored in the volume (because you will change its master key).</string>
     <string lang="en" key="VOL_HEADER_RESTORED">The volume header has been successfully restored.\n\nIMPORTANT: Please note that an old password may have been restored as well. Moreover, if keyfile(s) were/was necessary to mount the volume when the backup was created, the same keyfile(s) are now necessary to mount the volume again.</string>
@@ -911,8 +927,8 @@
     <string lang="en" key="SIZE_ITEM">Size:   </string>
     <string lang="en" key="PATH_ITEM">Path:   </string>
     <string lang="en" key="DRIVE_LETTER_ITEM">Drive Letter:   </string>
-    <string lang="en" key="UNSUPPORTED_CHARS_IN_PWD">Error: Password must contain only ASCII characters.\n\nNon-ASCII characters in password might cause the volume to be impossible to mount when your system configuration changes.\n\nThe following characters are allowed:\n\n  ! " # $ % &amp; ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; &lt; = &gt; ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \\ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w k y z { | } ~</string>
-    <string lang="en" key="UNSUPPORTED_CHARS_IN_PWD_RECOM">Warning: Password contains non-ASCII characters. This may cause the volume to be impossible to mount when your system configuration changes.\n\nYou should replace all non-ASCII characters in the password with ASCII characters. To do so, click 'Volumes' -&gt; 'Change Volume Password'.\n\nThe following are ASCII characters:\n\n  ! " # $ % &amp; ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; &lt; = &gt; ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \\ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w k y z { | } ~</string>
+    <string lang="en" key="UNSUPPORTED_CHARS_IN_PWD">Error: Password must contain only ASCII characters.\n\nNon-ASCII characters in password might cause the volume to be impossible to mount when your system configuration changes.\n\nThe following characters are allowed:\n\n  ! " # $ % &amp; ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; &lt; = &gt; ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \\ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~</string>
+    <string lang="en" key="UNSUPPORTED_CHARS_IN_PWD_RECOM">Warning: Password contains non-ASCII characters. This may cause the volume to be impossible to mount when your system configuration changes.\n\nYou should replace all non-ASCII characters in the password with ASCII characters. To do so, click 'Volumes' -&gt; 'Change Volume Password'.\n\nThe following are ASCII characters:\n\n  ! " # $ % &amp; ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; &lt; = &gt; ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \\ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~</string>
     <string lang="en" key="EXE_FILE_EXTENSION_CONFIRM">WARNING: We strongly recommend that you avoid file extensions that are used for executable files (such as .exe, .sys, or .dll) and other similarly problematic file extensions. Using such file extensions causes Windows and antivirus software to interfere with the container, which adversely affects the performance of the volume and may also cause other serious problems.\n\nWe strongly recommend that you remove the file extension or change it (e.g., to '.hc').\n\nAre you sure you want to use the problematic file extension?</string>
     <string lang="en" key="EXE_FILE_EXTENSION_MOUNT_WARNING">WARNING: This container has a file extension that is used for executable files (such as .exe, .sys, or .dll) or some other file extension that is similarly problematic. It will very likely cause Windows and antivirus software to interfere with the container, which will adversely affect the performance of the volume and may also cause other serious problems.\n\nWe strongly recommend that you remove the file extension of the container or change it (e.g., to '.hc') after you dismount the volume.</string>
     <string lang="en" key="HOMEPAGE">Homepage</string>
@@ -1018,6 +1034,7 @@
     <string lang="en" key="EXTRA_BOOT_PARTITION_REMOVAL_INSTRUCTIONS">\nThe extra boot partition can be removed before installing Windows. To do so, follow these steps:\n\n1) Boot your Windows installation disc.\n\n2) In the Windows installer screen, click 'Install now' > 'Custom (advanced)'.\n\n3) Click 'Drive Options'.\n\n4) Select the main system partition and delete it by clicking 'Delete' and 'OK'.\n\n5) Select the 'System Reserved' partition, click 'Extend', and increase its size so that the operating system can be installed to it.\n\n6) Click 'Apply' and 'OK'.\n\n7) Install Windows on the 'System Reserved' partition.\n\n\nShould an attacker ask why you removed the extra boot partition, you can answer that you wanted to prevent any possible data leaks to the unencrypted boot partition.\n\nNote: You can print this text by clicking the 'Print' button below. If you save a copy of this text or print it (strongly recommended, unless your printer stores copies of documents it prints on its internal drive), you should destroy any copies of it after removing the extra boot partition (otherwise, if such a copy was found, it might indicate that there is a hidden operating system on this computer).</string>
     <string lang="en" key="GAP_BETWEEN_SYS_AND_HIDDEN_OS_PARTITION">Warning: There is unallocated space between the system partition and the first partition behind it. After you create the hidden operating system, you must not create any new partitions in that unallocated space. Otherwise, the hidden operating system will be impossible to boot (until you delete such newly created partitions).</string>
     <string lang="en" key="ALGO_NOT_SUPPORTED_FOR_SYS_ENCRYPTION">This algorithm is currently not supported for system encryption.</string>
+	 <string lang="en" key="ALGO_NOT_SUPPORTED_FOR_TRUECRYPT_MODE">This algorithm is not supported for TrueCrypt mode.</string>
     <string lang="en" key="KEYFILES_NOT_SUPPORTED_FOR_SYS_ENCRYPTION">Keyfiles are currently not supported for system encryption.</string>
     <string lang="en" key="CANNOT_RESTORE_KEYBOARD_LAYOUT">Warning: VeraCrypt could not restore the original keyboard layout. This may cause you to enter a password incorrectly.</string>
     <string lang="en" key="CANT_CHANGE_KEYB_LAYOUT_FOR_SYS_ENCRYPTION">Error: Cannot set the keyboard layout for VeraCrypt to the standard US keyboard layout.\n\nNote that the password needs to be typed in the pre-boot environment (before Windows starts) where non-US Windows keyboard layouts are not available. Therefore, the password must always be typed using the standard US keyboard layout.</string>
@@ -1049,6 +1066,7 @@
     <string lang="en" key="WIPE_MODE_3_DOD_5220">3-pass (US DoD 5220.22-M)</string>
     <string lang="en" key="WIPE_MODE_7_DOD_5220">7-pass (US DoD 5220.22-M)</string>
     <string lang="en" key="WIPE_MODE_35_GUTMANN">35-pass ("Gutmann")</string>
+    <string lang="en" key="WIPE_MODE_256">256-pass</string>
     <string lang="en" key="SYS_MULTI_BOOT_MODE_TITLE">Number of Operating Systems</string>
     <string lang="en" key="MULTI_BOOT_FOR_ADVANCED_ONLY">WARNING: Inexperienced users should never attempt to encrypt Windows in multi-boot configurations.\n\nContinue?</string>
     <string lang="en" key="HIDDEN_OS_MULTI_BOOT">When creating/using a hidden operating system, VeraCrypt supports multi-boot configurations only when the following conditions are met:\n\n- The currently running operating system must be installed on the boot drive, which must not contain any other operating systems.\n\n- Operating systems installed on other drives must not use any boot loader residing on the drive on which the currently running operating system is installed.\n\nAre the above conditions met?</string>
@@ -1216,7 +1234,8 @@
     <string lang="en" key="CONFIRM_SETTING_DEGRADES_PERFORMANCE">WARNING: This setting may degrade performance.\n\nAre you sure you want to use this setting?</string>
     <string lang="en" key="HOST_DEVICE_REMOVAL_DISMOUNT_WARN_TITLE">Warning: VeraCrypt volume auto-dismounted</string>
     <string lang="en" key="HOST_DEVICE_REMOVAL_DISMOUNT_WARN">Before you physically remove or turn off a device containing a mounted volume, you should always dismount the volume in VeraCrypt first.\n\nUnexpected spontaneous dismount is usually caused by an intermittently failing cable, drive (enclosure), etc.</string>
-    <string lang="en" key="TEST">Test</string>
+    <string lang="en" key="UNSUPPORTED_TRUECRYPT_FORMAT">VeraCrypt supports only TrueCrypt volumes created with TrueCrypt 6.x series</string>
+	  <string lang="en" key="TEST">Test</string>
     <string lang="en" key="KEYFILE">Keyfile</string>
     <string lang="en" key="VKEY_08">Backspace</string>
     <string lang="en" key="VKEY_09">Tab</string>

src/Common/Password.c

@@ -66,15 +66,20 @@ BOOL CheckPasswordCharEncoding (HWND hPassword, Password *ptrPw)
 	
 	if (hPassword == NULL)
 	{
-		unsigned char *pw;
-		len = ptrPw->Length;
-		pw = (unsigned char *) ptrPw->Text;
-
-		for (i = 0; i < len; i++)
+		if (ptrPw)
 		{
-			if (pw[i] >= 0x7f || pw[i] < 0x20)	// A non-ASCII or non-printable character?
-				return FALSE;
+			unsigned char *pw;
+			len = ptrPw->Length;
+			pw = (unsigned char *) ptrPw->Text;
+
+			for (i = 0; i < len; i++)
+			{
+				if (pw[i] >= 0x7f || pw[i] < 0x20)	// A non-ASCII or non-printable character?
+					return FALSE;
+			}
 		}
+		else
+			return FALSE;
 	}
 	else
 	{
@@ -114,7 +119,7 @@ BOOL CheckPasswordLength (HWND hwndDlg, HWND hwndItem)
 	return TRUE;
 }
 
-int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, int pkcs5, HWND hwndDlg)
+int ChangePwd (const char *lpszVolume, Password *oldPassword, int old_pkcs5, BOOL truecryptMode, Password *newPassword, int pkcs5, int wipePassCount, HWND hwndDlg)
 {
 	int nDosLinkCreated = 1, nStatus = ERR_OS_ERROR;
 	char szDiskFile[TC_MAX_PATH], szCFDevice[TC_MAX_PATH];
@@ -138,9 +143,23 @@ int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, i
 
 	if (oldPassword->Length == 0 || newPassword->Length == 0) return -1;
 
+	if ((wipePassCount <= 0) || (truecryptMode && (old_pkcs5 == SHA256)))
+	{
+      nStatus = ERR_PARAMETER_INCORRECT;
+      handleError (hwndDlg, nStatus);
+      return nStatus;
+	}
+
+   if (!lpszVolume)
+   {
+      nStatus = ERR_OUTOFMEMORY;
+      handleError (hwndDlg, nStatus);
+      return nStatus;
+   }
+
 	WaitCursor ();
 
-	CreateFullVolumePath (szDiskFile, lpszVolume, &bDevice);
+	CreateFullVolumePath (szDiskFile, sizeof(szDiskFile), lpszVolume, &bDevice);
 
 	if (bDevice == FALSE)
 	{
@@ -148,7 +167,7 @@ int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, i
 	}
 	else
 	{
-		nDosLinkCreated = FakeDosNameForDevice (szDiskFile, szDosDevice, szCFDevice, FALSE);
+		nDosLinkCreated = FakeDosNameForDevice (szDiskFile, szDosDevice, sizeof(szDosDevice), szCFDevice, sizeof(szCFDevice),FALSE);
 		
 		if (nDosLinkCreated != 0)
 			goto error;
@@ -213,6 +232,8 @@ int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, i
 	if (Randinit ())
 		goto error;
 
+	SetRandomPoolEnrichedByUserStatus (FALSE); /* force the display of the random enriching dialog */
+
 	if (!bDevice && bPreserveTimestamp)
 	{
 		if (GetFileTime ((HANDLE) dev, &ftCreationTime, &ftLastAccessTime, &ftLastWriteTime) == 0)
@@ -237,12 +258,6 @@ int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, i
 			headerOffset.QuadPart = TC_HIDDEN_VOLUME_HEADER_OFFSET;
 			break;
 
-		case TC_VOLUME_TYPE_HIDDEN_LEGACY:
-			if (bDevice && driveInfo.BytesPerSector != TC_SECTOR_SIZE_LEGACY)
-				continue;
-
-			headerOffset.QuadPart = hostSize - TC_HIDDEN_VOLUME_HEADER_OFFSET_LEGACY;
-			break;
 		}
 
 		if (!SetFilePointerEx ((HANDLE) dev, headerOffset, NULL, FILE_BEGIN))
@@ -266,7 +281,7 @@ int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, i
 
 		/* Try to decrypt the header */
 
-		nStatus = ReadVolumeHeader (FALSE, buffer, oldPassword, &cryptoInfo, NULL);
+		nStatus = ReadVolumeHeader (FALSE, buffer, oldPassword, old_pkcs5, truecryptMode, &cryptoInfo, NULL);
 		if (nStatus == ERR_CIPHER_INIT_WEAK_KEY)
 			nStatus = 0;	// We can ignore this error here
 
@@ -311,7 +326,7 @@ int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, i
 
 	while (TRUE)
 	{
-		/* The header will be re-encrypted PRAND_DISK_WIPE_PASSES times to prevent adversaries from using 
+		/* The header will be re-encrypted wipePassCount times to prevent adversaries from using 
 		techniques such as magnetic force microscopy or magnetic force scanning tunnelling microscopy
 		to recover the overwritten header. According to Peter Gutmann, data should be overwritten 22
 		times (ideally, 35 times) using non-random patterns and pseudorandom data. However, as users might
@@ -323,10 +338,10 @@ int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, i
 		of the header to differ substantially and in a random manner from the versions written during the
 		other passes. */
 
-		for (wipePass = 0; wipePass < PRAND_DISK_WIPE_PASSES; wipePass++)
+		for (wipePass = 0; wipePass < wipePassCount; wipePass++)
 		{
 			// Prepare new volume header
-			nStatus = CreateVolumeHeaderInMemory (FALSE,
+			nStatus = CreateVolumeHeaderInMemory (hwndDlg, FALSE,
 				buffer,
 				cryptoInfo->ea,
 				cryptoInfo->mode,
@@ -335,13 +350,13 @@ int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, i
 				cryptoInfo->master_keydata,
 				&ci,
 				cryptoInfo->VolumeSize.Value,
-				(volumeType == TC_VOLUME_TYPE_HIDDEN || volumeType == TC_VOLUME_TYPE_HIDDEN_LEGACY) ? cryptoInfo->hiddenVolumeSize : 0,
+				(volumeType == TC_VOLUME_TYPE_HIDDEN) ? cryptoInfo->hiddenVolumeSize : 0,
 				cryptoInfo->EncryptedAreaStart.Value,
 				cryptoInfo->EncryptedAreaLength.Value,
-				cryptoInfo->RequiredProgramVersion,
+				truecryptMode? 0 : cryptoInfo->RequiredProgramVersion,
 				cryptoInfo->HeaderFlags,
 				cryptoInfo->SectorSize,
-				wipePass < PRAND_DISK_WIPE_PASSES - 1);
+				wipePass < wipePassCount - 1);
 
 			if (ci != NULL)
 				crypto_close (ci);
@@ -368,7 +383,7 @@ int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, i
 				&& (cryptoInfo->HeaderFlags & TC_HEADER_FLAG_NONSYS_INPLACE_ENC) != 0
 				&& (cryptoInfo->HeaderFlags & ~TC_HEADER_FLAG_NONSYS_INPLACE_ENC) == 0)
 			{
-				nStatus = WriteRandomDataToReservedHeaderAreas (dev, cryptoInfo, cryptoInfo->VolumeSize.Value, !backupHeader, backupHeader);
+				nStatus = WriteRandomDataToReservedHeaderAreas (hwndDlg, dev, cryptoInfo, cryptoInfo->VolumeSize.Value, !backupHeader, backupHeader);
 				if (nStatus != ERR_SUCCESS)
 					goto error;
 			}

src/Common/Password.h

@@ -35,7 +35,7 @@ typedef struct
 void VerifyPasswordAndUpdate ( HWND hwndDlg , HWND hButton , HWND hPassword , HWND hVerify , unsigned char *szPassword , char *szVerify, BOOL keyFilesEnabled );
 BOOL CheckPasswordLength (HWND hwndDlg, HWND hwndItem);		
 BOOL CheckPasswordCharEncoding (HWND hPassword, Password *ptrPw);			
-int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, int pkcs5, HWND hwndDlg);
+int ChangePwd (const char *lpszVolume, Password *oldPassword, int old_pkcs5, BOOL truecryptMode, Password *newPassword, int pkcs5, int wipePassCount, HWND hwndDlg);
 
 #endif	// defined(_WIN32) && !defined(TC_WINDOWS_DRIVER)
 

src/Common/Pkcs5.c

@@ -14,9 +14,10 @@
 #include <memory.h>
 #include "Rmd160.h"
 #ifndef TC_WINDOWS_BOOT
-#include "Sha1.h"
 #include "Sha2.h"
 #include "Whirlpool.h"
+#else
+#include "Sha2Small.h"
 #endif
 #include "Pkcs5.h"
 #include "Crypto.h"
@@ -33,6 +34,167 @@ void hmac_truncate
 		d2[i] = d1[i];
 }
 
+#if !defined(TC_WINDOWS_BOOT) || defined(TC_WINDOWS_BOOT_SHA2)
+
+void hmac_sha256
+(
+	  char *k,		/* secret key */
+	  int lk,		/* length of the key in bytes */
+	  char *d,		/* data */
+	  int ld,		/* length of data in bytes */
+	  char *out		/* output buffer, at least "t" bytes */
+)
+{
+	sha256_ctx ictx, octx;
+	char isha[SHA256_DIGESTSIZE], osha[SHA256_DIGESTSIZE];
+#ifndef TC_WINDOWS_BOOT
+	char key[SHA256_DIGESTSIZE];
+#endif
+	char buf[SHA256_BLOCKSIZE];
+	int i;
+
+#ifndef TC_WINDOWS_BOOT
+    /* If the key is longer than the hash algorithm block size,
+	   let key = sha256(key), as per HMAC specifications. */
+	if (lk > SHA256_BLOCKSIZE)
+	{
+		sha256_ctx tctx;
+
+		sha256_begin (&tctx);
+		sha256_hash ((unsigned char *) k, lk, &tctx);
+		sha256_end ((unsigned char *) key, &tctx);
+
+		k = key;
+		lk = SHA256_DIGESTSIZE;
+
+		burn (&tctx, sizeof(tctx));		// Prevent leaks
+	}
+#endif
+	/**** Inner Digest ****/
+
+	sha256_begin (&ictx);
+
+	/* Pad the key for inner digest */
+	for (i = 0; i < lk; ++i)
+		buf[i] = (char) (k[i] ^ 0x36);
+	for (i = lk; i < SHA256_BLOCKSIZE; ++i)
+		buf[i] = 0x36;
+
+	sha256_hash ((unsigned char *) buf, SHA256_BLOCKSIZE, &ictx);
+	sha256_hash ((unsigned char *) d, ld, &ictx);
+
+	sha256_end ((unsigned char *) isha, &ictx);
+
+	/**** Outer Digest ****/
+
+	sha256_begin (&octx);
+
+	for (i = 0; i < lk; ++i)
+		buf[i] = (char) (k[i] ^ 0x5C);
+	for (i = lk; i < SHA256_BLOCKSIZE; ++i)
+		buf[i] = 0x5C;
+
+	sha256_hash ((unsigned char *) buf, SHA256_BLOCKSIZE, &octx);
+	sha256_hash ((unsigned char *) isha, SHA256_DIGESTSIZE, &octx);
+
+	sha256_end ((unsigned char *) osha, &octx);
+
+	/* truncate and print the results */
+	hmac_truncate (osha, out, SHA256_DIGESTSIZE);
+
+	/* Prevent leaks */
+	burn (&ictx, sizeof(ictx));
+	burn (&octx, sizeof(octx));
+	burn (isha, sizeof(isha));
+	burn (osha, sizeof(osha));
+	burn (buf, sizeof(buf));
+#ifndef TC_WINDOWS_BOOT
+	burn (key, sizeof(key));
+#endif
+}
+
+
+void derive_u_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b)
+{
+	char j[SHA256_DIGESTSIZE], k[SHA256_DIGESTSIZE];
+	char init[128];
+	char counter[4];
+	uint32 c;
+	int i;
+
+#ifdef TC_WINDOWS_BOOT
+	/* In bootloader, iterations is a boolean : TRUE for boot derivation mode, FALSE otherwise 
+	 * This enables us to save code space needed for implementing other features.
+	 */
+	if (iterations)
+		c = 200000;
+	else
+		c = 500000;
+#else
+	c = iterations;
+#endif
+
+	/* iteration 1 */
+	memset (counter, 0, 4);
+	counter[3] = (char) b;
+	memcpy (init, salt, salt_len);	/* salt */
+	memcpy (&init[salt_len], counter, 4);	/* big-endian block number */
+	hmac_sha256 (pwd, pwd_len, init, salt_len + 4, j);
+	memcpy (u, j, SHA256_DIGESTSIZE);
+
+	/* remaining iterations */
+	while (c > 1)
+	{
+		hmac_sha256 (pwd, pwd_len, j, SHA256_DIGESTSIZE, k);
+		for (i = 0; i < SHA256_DIGESTSIZE; i++)
+		{
+			u[i] ^= k[i];
+			j[i] = k[i];
+		}
+		c--;
+	}
+
+	/* Prevent possible leaks. */
+	burn (j, sizeof(j));
+	burn (k, sizeof(k));
+}
+
+
+void derive_key_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen)
+{
+	char u[SHA256_DIGESTSIZE];
+	int b, l, r;
+
+	if (dklen % SHA256_DIGESTSIZE)
+	{
+		l = 1 + dklen / SHA256_DIGESTSIZE;
+	}
+	else
+	{
+		l = dklen / SHA256_DIGESTSIZE;
+	}
+
+	r = dklen - (l - 1) * SHA256_DIGESTSIZE;
+
+	/* first l - 1 blocks */
+	for (b = 1; b < l; b++)
+	{
+		derive_u_sha256 (pwd, pwd_len, salt, salt_len, iterations, u, b);
+		memcpy (dk, u, SHA256_DIGESTSIZE);
+		dk += SHA256_DIGESTSIZE;
+	}
+
+	/* last block */
+	derive_u_sha256 (pwd, pwd_len, salt, salt_len, iterations, u, b);
+	memcpy (dk, u, r);
+
+
+	/* Prevent possible leaks. */
+	burn (u, sizeof(u));
+}
+
+#endif
+
 #ifndef TC_WINDOWS_BOOT
 
 void hmac_sha512
@@ -47,10 +209,13 @@ void hmac_sha512
 {
 	sha512_ctx ictx, octx;
 	char isha[SHA512_DIGESTSIZE], osha[SHA512_DIGESTSIZE];
+#ifndef TC_WINDOWS_BOOT
 	char key[SHA512_DIGESTSIZE];
+#endif
 	char buf[SHA512_BLOCKSIZE];
 	int i;
 
+#ifndef TC_WINDOWS_BOOT
     /* If the key is longer than the hash algorithm block size,
 	   let key = sha512(key), as per HMAC specifications. */
 	if (lk > SHA512_BLOCKSIZE)
@@ -66,7 +231,7 @@ void hmac_sha512
 
 		burn (&tctx, sizeof(tctx));		// Prevent leaks
 	}
-
+#endif
 	/**** Inner Digest ****/
 
 	sha512_begin (&ictx);
@@ -106,7 +271,9 @@ void hmac_sha512
 	burn (isha, sizeof(isha));
 	burn (osha, sizeof(osha));
 	burn (buf, sizeof(buf));
+#ifndef TC_WINDOWS_BOOT
 	burn (key, sizeof(key));
+#endif
 }
 
 
@@ -175,160 +342,21 @@ void derive_key_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, int it
 	burn (u, sizeof(u));
 }
 
-
-/* Deprecated/legacy */
-void hmac_sha1
-(
-	  char *k,		/* secret key */
-	  int lk,		/* length of the key in bytes */
-	  char *d,		/* data */
-	  int ld,		/* length of data in bytes */
-	  char *out,		/* output buffer, at least "t" bytes */
-	  int t
-)
-{
-	sha1_ctx ictx, octx;
-	char isha[SHA1_DIGESTSIZE], osha[SHA1_DIGESTSIZE];
-	char key[SHA1_DIGESTSIZE];
-	char buf[SHA1_BLOCKSIZE];
-	int i;
-
-    /* If the key is longer than the hash algorithm block size,
-	   let key = sha1(key), as per HMAC specifications. */
-	if (lk > SHA1_BLOCKSIZE)
-	{
-		sha1_ctx tctx;
-
-		sha1_begin (&tctx);
-		sha1_hash ((unsigned char *) k, lk, &tctx);
-		sha1_end ((unsigned char *) key, &tctx);
-
-		k = key;
-		lk = SHA1_DIGESTSIZE;
-
-		burn (&tctx, sizeof(tctx));		// Prevent leaks
-	}
-
-	/**** Inner Digest ****/
-
-	sha1_begin (&ictx);
-
-	/* Pad the key for inner digest */
-	for (i = 0; i < lk; ++i)
-		buf[i] = (char) (k[i] ^ 0x36);
-	for (i = lk; i < SHA1_BLOCKSIZE; ++i)
-		buf[i] = 0x36;
-
-	sha1_hash ((unsigned char *) buf, SHA1_BLOCKSIZE, &ictx);
-	sha1_hash ((unsigned char *) d, ld, &ictx);
-
-	sha1_end ((unsigned char *) isha, &ictx);
-
-	/**** Outer Digest ****/
-
-	sha1_begin (&octx);
-
-	for (i = 0; i < lk; ++i)
-		buf[i] = (char) (k[i] ^ 0x5C);
-	for (i = lk; i < SHA1_BLOCKSIZE; ++i)
-		buf[i] = 0x5C;
-
-	sha1_hash ((unsigned char *) buf, SHA1_BLOCKSIZE, &octx);
-	sha1_hash ((unsigned char *) isha, SHA1_DIGESTSIZE, &octx);
-
-	sha1_end ((unsigned char *) osha, &octx);
-
-	/* truncate and print the results */
-	t = t > SHA1_DIGESTSIZE ? SHA1_DIGESTSIZE : t;
-	hmac_truncate (osha, out, t);
-
-	/* Prevent leaks */
-	burn (&ictx, sizeof(ictx));
-	burn (&octx, sizeof(octx));
-	burn (isha, sizeof(isha));
-	burn (osha, sizeof(osha));
-	burn (buf, sizeof(buf));
-	burn (key, sizeof(key));
-}
-
-
-/* Deprecated/legacy */
-void derive_u_sha1 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b)
-{
-	char j[SHA1_DIGESTSIZE], k[SHA1_DIGESTSIZE];
-	char init[128];
-	char counter[4];
-	int c, i;
-
-	/* iteration 1 */
-	memset (counter, 0, 4);
-	counter[3] = (char) b;
-	memcpy (init, salt, salt_len);	/* salt */
-	memcpy (&init[salt_len], counter, 4);	/* big-endian block number */
-	hmac_sha1 (pwd, pwd_len, init, salt_len + 4, j, SHA1_DIGESTSIZE);
-	memcpy (u, j, SHA1_DIGESTSIZE);
-
-	/* remaining iterations */
-	for (c = 1; c < iterations; c++)
-	{
-		hmac_sha1 (pwd, pwd_len, j, SHA1_DIGESTSIZE, k, SHA1_DIGESTSIZE);
-		for (i = 0; i < SHA1_DIGESTSIZE; i++)
-		{
-			u[i] ^= k[i];
-			j[i] = k[i];
-		}
-	}
-
-	/* Prevent possible leaks. */
-	burn (j, sizeof(j));
-	burn (k, sizeof(k));
-}
-
-
-/* Deprecated/legacy */
-void derive_key_sha1 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen)
-{
-	char u[SHA1_DIGESTSIZE];
-	int b, l, r;
-
-	if (dklen % SHA1_DIGESTSIZE)
-	{
-		l = 1 + dklen / SHA1_DIGESTSIZE;
-	}
-	else
-	{
-		l = dklen / SHA1_DIGESTSIZE;
-	}
-
-	r = dklen - (l - 1) * SHA1_DIGESTSIZE;
-
-	/* first l - 1 blocks */
-	for (b = 1; b < l; b++)
-	{
-		derive_u_sha1 (pwd, pwd_len, salt, salt_len, iterations, u, b);
-		memcpy (dk, u, SHA1_DIGESTSIZE);
-		dk += SHA1_DIGESTSIZE;
-	}
-
-	/* last block */
-	derive_u_sha1 (pwd, pwd_len, salt, salt_len, iterations, u, b);
-	memcpy (dk, u, r);
-
-
-	/* Prevent possible leaks. */
-	burn (u, sizeof(u));
-}
-
 #endif // TC_WINDOWS_BOOT
 
+#if !defined(TC_WINDOWS_BOOT) || defined(TC_WINDOWS_BOOT_RIPEMD160)
+
 void hmac_ripemd160 (char *key, int keylen, char *input, int len, char *digest)
 {
     RMD160_CTX context;
     unsigned char k_ipad[65];  /* inner padding - key XORd with ipad */
     unsigned char k_opad[65];  /* outer padding - key XORd with opad */
+#ifndef TC_WINDOWS_BOOT
     unsigned char tk[RIPEMD160_DIGESTSIZE];
+#endif
     int i;
 
+#ifndef TC_WINDOWS_BOOT
     /* If the key is longer than the hash algorithm block size,
 	   let key = ripemd160(key), as per HMAC specifications. */
     if (keylen > RIPEMD160_BLOCKSIZE) 
@@ -344,7 +372,7 @@ void hmac_ripemd160 (char *key, int keylen, char *input, int len, char *digest)
 
 		burn (&tctx, sizeof(tctx));	// Prevent leaks
     }
-
+#endif
 	/*
 
 	RMD160(K XOR opad, RMD160(K XOR ipad, text))
@@ -383,17 +411,31 @@ void hmac_ripemd160 (char *key, int keylen, char *input, int len, char *digest)
 	/* Prevent possible leaks. */
     burn (k_ipad, sizeof(k_ipad));
     burn (k_opad, sizeof(k_opad));
+#ifndef TC_WINDOWS_BOOT
 	burn (tk, sizeof(tk));
+#endif
 	burn (&context, sizeof(context));
 }
 
-void derive_u_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b)
+void derive_u_ripemd160 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b)
 {
 	char j[RIPEMD160_DIGESTSIZE], k[RIPEMD160_DIGESTSIZE];
 	char init[128];
 	char counter[4];
-	int c, i, l;
-   int EnhanceSecurityLoops = (bNotTest)? 10 : 1;
+	uint32 c;
+	int i;
+
+#ifdef TC_WINDOWS_BOOT
+	/* In bootloader, iterations is a boolean : TRUE for boot derivation mode, FALSE otherwise 
+	 * This enables us to save code space needed for implementing other features.
+	 */
+	if (iterations)
+		c = 327661;
+	else
+		c = 655331;
+#else
+	c  = iterations;
+#endif
 
 	/* iteration 1 */
 	memset (counter, 0, 4);
@@ -404,17 +446,15 @@ void derive_u_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int
 	memcpy (u, j, RIPEMD160_DIGESTSIZE);
 
 	/* remaining iterations */
-	for (l = 0; l < EnhanceSecurityLoops; l++)
+	while ( c > 1)
 	{
-		for (c = 1; c < iterations; c++)
+		hmac_ripemd160 (pwd, pwd_len, j, RIPEMD160_DIGESTSIZE, k);
+		for (i = 0; i < RIPEMD160_DIGESTSIZE; i++)
 		{
-			hmac_ripemd160 (pwd, pwd_len, j, RIPEMD160_DIGESTSIZE, k);
-			for (i = 0; i < RIPEMD160_DIGESTSIZE; i++)
-			{
-				u[i] ^= k[i];
-				j[i] = k[i];
-			}
+			u[i] ^= k[i];
+			j[i] = k[i];
 		}
+		c--;
 	}
 
 	/* Prevent possible leaks. */
@@ -422,7 +462,7 @@ void derive_u_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int
 	burn (k, sizeof(k));
 }
 
-void derive_key_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen)
+void derive_key_ripemd160 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen)
 {
 	char u[RIPEMD160_DIGESTSIZE];
 	int b, l, r;
@@ -441,19 +481,20 @@ void derive_key_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, in
 	/* first l - 1 blocks */
 	for (b = 1; b < l; b++)
 	{
-		derive_u_ripemd160 (bNotTest, pwd, pwd_len, salt, salt_len, iterations, u, b);
+		derive_u_ripemd160 (pwd, pwd_len, salt, salt_len, iterations, u, b);
 		memcpy (dk, u, RIPEMD160_DIGESTSIZE);
 		dk += RIPEMD160_DIGESTSIZE;
 	}
 
 	/* last block */
-	derive_u_ripemd160 (bNotTest, pwd, pwd_len, salt, salt_len, iterations, u, b);
+	derive_u_ripemd160 (pwd, pwd_len, salt, salt_len, iterations, u, b);
 	memcpy (dk, u, r);
 
 
 	/* Prevent possible leaks. */
 	burn (u, sizeof(u));
 }
+#endif // TC_WINDOWS_BOOT
 
 #ifndef TC_WINDOWS_BOOT
 
@@ -469,10 +510,13 @@ void hmac_whirlpool
 {
 	WHIRLPOOL_CTX ictx, octx;
 	char iwhi[WHIRLPOOL_DIGESTSIZE], owhi[WHIRLPOOL_DIGESTSIZE];
+#ifndef TC_WINDOWS_BOOT
 	char key[WHIRLPOOL_DIGESTSIZE];
+#endif
 	char buf[WHIRLPOOL_BLOCKSIZE];
 	int i;
 
+#ifndef TC_WINDOWS_BOOT
     /* If the key is longer than the hash algorithm block size,
 	   let key = whirlpool(key), as per HMAC specifications. */
 	if (lk > WHIRLPOOL_BLOCKSIZE)
@@ -488,7 +532,7 @@ void hmac_whirlpool
 
 		burn (&tctx, sizeof(tctx));		// Prevent leaks
 	}
-
+#endif
 	/**** Inner Digest ****/
 
 	WHIRLPOOL_init (&ictx);
@@ -528,7 +572,9 @@ void hmac_whirlpool
 	burn (owhi, sizeof(owhi));
 	burn (iwhi, sizeof(iwhi));
 	burn (buf, sizeof(buf));
+#ifndef TC_WINDOWS_BOOT
 	burn (key, sizeof(key));
+#endif
 }
 
 void derive_u_whirlpool (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b)
@@ -603,8 +649,8 @@ char *get_pkcs5_prf_name (int pkcs5_prf_id)
 	case SHA512:	
 		return "HMAC-SHA-512";
 
-	case SHA1:	// Deprecated/legacy
-		return "HMAC-SHA-1";
+	case SHA256:	
+		return "HMAC-SHA-256";
 
 	case RIPEMD160:	
 		return "HMAC-RIPEMD-160";
@@ -617,33 +663,32 @@ char *get_pkcs5_prf_name (int pkcs5_prf_id)
 	}
 }
 
-#endif //!TC_WINDOWS_BOOT
 
 
-int get_pkcs5_iteration_count (int pkcs5_prf_id, BOOL bBoot)
+int get_pkcs5_iteration_count (int pkcs5_prf_id, BOOL truecryptMode, BOOL bBoot)
 {
 	switch (pkcs5_prf_id)
 	{
-#ifdef TC_WINDOWS_BOOT
-	case RIPEMD160:	
-		return 32767; /* we multiply this number by 10 inside derive_u_ripemd160 */
 
-#else
 	case RIPEMD160:	
-		return bBoot? 32767 : 65534; /* we multiply this number by 10 inside derive_u_ripemd160 */
+		if (truecryptMode)
+			return bBoot ? 1000 : 2000;
+		else
+			return bBoot? 327661 : 655331;
 
 	case SHA512:	
-		return 500000;			
-
-	case SHA1:		// Deprecated/legacy		
-		return 1000000;			
+		return truecryptMode? 1000 : 500000;
 
 	case WHIRLPOOL:	
-		return 500000;
-#endif
+		return truecryptMode? 1000 : 500000;
+
+	case SHA256:
+		return bBoot? 200000 : 500000;
 
 	default:		
 		TC_THROW_FATAL_EXCEPTION;	// Unknown/wrong ID
 	}
 	return 0;
 }
+
+#endif //!TC_WINDOWS_BOOT

src/Common/Pkcs5.h

@@ -18,20 +18,20 @@
 extern "C"
 {
 #endif
+void hmac_sha256 (char *k, int lk, char *d, int ld, char *out);
+void derive_u_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b);
+void derive_key_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen);
 
 void hmac_sha512 (char *k, int lk, char *d, int ld, char *out, int t);
 void derive_u_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b);
 void derive_key_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen);
-void hmac_sha1 (char *k, int lk, char *d, int ld, char *out, int t);
-void derive_u_sha1 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b);
-void derive_key_sha1 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen);
 void hmac_ripemd160 (char *key, int keylen, char *input, int len, char *digest);
-void derive_u_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b);
-void derive_key_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen);
+void derive_u_ripemd160 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b);
+void derive_key_ripemd160 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen);
 void hmac_whirlpool (char *k, int lk, char *d, int ld, char *out, int t);
 void derive_u_whirlpool (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b);
 void derive_key_whirlpool (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen);
-int get_pkcs5_iteration_count (int pkcs5_prf_id, BOOL bBoot);
+int get_pkcs5_iteration_count (int pkcs5_prf_id, BOOL truecryptMode, BOOL bBoot);
 char *get_pkcs5_prf_name (int pkcs5_prf_id);
 
 #if defined(__cplusplus)

src/Common/Progress.c

@@ -17,6 +17,8 @@
 #include "../Format/FormatCom.h"
 #include "../Format/resource.h"
 
+#include <Strsafe.h>
+
 static ULONG prevTime, startTime;
 static __int64 TotalSize;
 static __int64 resumedPointBytesDone;
@@ -74,31 +76,31 @@ BOOL UpdateProgressBarProc (__int64 byteOffset)
 		double perc = (double) (100.0 * (bProgressBarReverse ? ((double) (TotalSize - byteOffset)) : ((double) byteOffset)) / (TotalSize == 0 ? 0.0001 : ((double) TotalSize)));
 
 		if (perc > 99.999999999)
-			wcscpy (text, GetString ("PROCESSED_PORTION_100_PERCENT"));
+			StringCbCopyW (text,sizeof(text),  GetString ("PROCESSED_PORTION_100_PERCENT"));
 		else
-			_snwprintf (text, sizeof text/2, GetString ("PROCESSED_PORTION_X_PERCENT"), perc);
+			StringCbPrintfW (text, sizeof text, GetString ("PROCESSED_PORTION_X_PERCENT"), perc);
 
-		wcscat (speed, L" ");
+		StringCbCatW (speed, sizeof(speed), L" ");
 	}
 	else
 	{
-		GetSizeString (bytesDone, text);
+		GetSizeString (bytesDone, text, sizeof(text));
 		if (bytesDone < (unsigned __int64) BYTES_PER_MB * 1000000)
-			swprintf(text, L"%I64d %s ", bytesDone / BYTES_PER_MB, GetString ("MB"));
+			StringCbPrintfW(text, sizeof(text), L"%I64d %s ", bytesDone / BYTES_PER_MB, GetString ("MB"));
 		else if (bytesDone < (unsigned __int64) BYTES_PER_GB * 1000000)
-			swprintf(text, L"%I64d %s ", bytesDone / BYTES_PER_GB, GetString ("GB"));
+			StringCbPrintfW(text, sizeof(text), L"%I64d %s ", bytesDone / BYTES_PER_GB, GetString ("GB"));
 		else if (bytesDone < (unsigned __int64) BYTES_PER_TB * 1000000)
-			swprintf(text, L"%I64d %s ", bytesDone / BYTES_PER_TB, GetString ("TB"));
+			StringCbPrintfW(text, sizeof(text), L"%I64d %s ", bytesDone / BYTES_PER_TB, GetString ("TB"));
 		else
-			swprintf(text, L"%I64d %s ", bytesDone / BYTES_PER_PB, GetString ("PB"));
+			StringCbPrintfW(text, sizeof(text), L"%I64d %s ", bytesDone / BYTES_PER_PB, GetString ("PB"));
 	}
 
 	SetWindowTextW (GetDlgItem (hCurPage, IDC_BYTESWRITTEN), text);
 
 	if (!bShowStatus)
 	{
-		GetSpeedString (bRWThroughput ? bytesPerSec*2 : bytesPerSec, speed);
-		wcscat (speed, L" ");
+		GetSpeedString (bRWThroughput ? bytesPerSec*2 : bytesPerSec, speed, sizeof(speed));
+		StringCbCatW (speed, sizeof(speed), L" ");
 		SetWindowTextW (GetDlgItem (hCurPage, IDC_WRITESPEED), speed);
 	}
 
@@ -107,15 +109,15 @@ BOOL UpdateProgressBarProc (__int64 byteOffset)
 		int64 sec = (int64) ((bProgressBarReverse ? byteOffset : (TotalSize - byteOffset)) / (bytesPerSec == 0 ? 0.001 : bytesPerSec));
 
 		if (bytesPerSec == 0 || sec > 60 * 60 * 24 * 999)
-			swprintf (text, L"%s ", GetString ("NOT_APPLICABLE_OR_NOT_AVAILABLE"));
+			StringCbPrintfW (text, sizeof(text), L"%s ", GetString ("NOT_APPLICABLE_OR_NOT_AVAILABLE"));
 		else if (sec >= 60 * 60 * 24 * 2)
-			swprintf (text, L"%I64d %s ", sec / (60 * 24 * 60), days);
+			StringCbPrintfW (text, sizeof(text), L"%I64d %s ", sec / (60 * 24 * 60), days);
 		else if (sec >= 120 * 60)
-			swprintf (text, L"%I64d %s ", sec / (60 * 60), hours);
+			StringCbPrintfW (text, sizeof(text), L"%I64d %s ", sec / (60 * 60), hours);
 		else if (sec >= 120)
-			swprintf (text, L"%I64d %s ", sec / 60, minutes);
+			StringCbPrintfW (text, sizeof(text), L"%I64d %s ", sec / 60, minutes);
 		else
-			swprintf (text, L"%I64d %s ", sec, seconds);
+			StringCbPrintfW (text, sizeof(text), L"%I64d %s ", sec, seconds);
 
 		SetWindowTextW (GetDlgItem (hCurPage, IDC_TIMEREMAIN), text);
 	}

src/Common/Random.c

@@ -12,6 +12,7 @@
 #include "Tcdefs.h"
 #include "Crc.h"
 #include "Random.h"
+#include <Strsafe.h>
 
 static unsigned __int8 buffer[RNG_POOL_SIZE];
 static unsigned char *pRandPool = NULL;
@@ -209,6 +210,7 @@ BOOL Randmix ()
 		WHIRLPOOL_CTX	wctx;
 		RMD160_CTX		rctx;
 		sha512_ctx		sctx;
+		sha256_ctx		s256ctx;
 		int poolIndex, digestIndex, digestSize;
 
 		switch (HashFunction)
@@ -221,6 +223,10 @@ BOOL Randmix ()
 			digestSize = SHA512_DIGESTSIZE;
 			break;
 
+		case SHA256:
+			digestSize = SHA256_DIGESTSIZE;
+			break;
+
 		case WHIRLPOOL:
 			digestSize = WHIRLPOOL_DIGESTSIZE;
 			break;
@@ -249,6 +255,12 @@ BOOL Randmix ()
 				sha512_end (hashOutputBuffer, &sctx);
 				break;
 
+			case SHA256:
+				sha256_begin (&s256ctx);
+				sha256_hash (pRandPool, RNG_POOL_SIZE, &s256ctx);
+				sha256_end (hashOutputBuffer, &s256ctx);
+				break;
+
 			case WHIRLPOOL:
 				WHIRLPOOL_init (&wctx);
 				WHIRLPOOL_add (pRandPool, RNG_POOL_SIZE * 8, &wctx);
@@ -279,6 +291,10 @@ BOOL Randmix ()
 			burn (&sctx, sizeof(sctx));		
 			break;
 
+		case SHA256:
+			burn (&s256ctx, sizeof(s256ctx));		
+			break;
+
 		case WHIRLPOOL:
 			burn (&wctx, sizeof(wctx));		
 			break;
@@ -301,14 +317,14 @@ void RandaddBuf (void *buf, int len)
 	}
 }
 
-BOOL RandpeekBytes (unsigned char *buf, int len)
+BOOL RandpeekBytes (void* hwndDlg, unsigned char *buf, int len)
 {
 	if (!bRandDidInit)
 		return FALSE;
 
 	if (len > RNG_POOL_SIZE)
 	{
-		Error ("ERR_NOT_ENOUGH_RANDOM_DATA");	
+		Error ("ERR_NOT_ENOUGH_RANDOM_DATA", (HWND) hwndDlg);	
 		len = RNG_POOL_SIZE;
 	}
 
@@ -321,9 +337,18 @@ BOOL RandpeekBytes (unsigned char *buf, int len)
 
 
 /* Get len random bytes from the pool (max. RNG_POOL_SIZE bytes per a single call) */
-BOOL RandgetBytes (unsigned char *buf, int len, BOOL forceSlowPoll)
+BOOL RandgetBytes (void* hwndDlg, unsigned char *buf, int len, BOOL forceSlowPoll)
 {
-	int i;
+	return RandgetBytesFull (hwndDlg, buf, len, forceSlowPoll, FALSE);
+}
+
+/* Get len random bytes from the pool.
+ *  If allowAnyLength is FALSE, then len must be less or equal to RNG_POOL_SIZE
+ *  If allowAnyLength is TRUE, then len can have any positive value
+ */
+BOOL RandgetBytesFull ( void* hwndDlg, unsigned char *buf , int len, BOOL forceSlowPoll , BOOL allowAnyLength)
+{
+	int i, looplen;
 	BOOL ret = TRUE;
 
 	if (!bRandDidInit || HashFunction == 0)
@@ -343,36 +368,54 @@ BOOL RandgetBytes (unsigned char *buf, int len, BOOL forceSlowPoll)
 		ret = FALSE;
 
 	/* There's never more than RNG_POOL_SIZE worth of randomess */
-	if (len > RNG_POOL_SIZE)
+	if ( (!allowAnyLength) && (len > RNG_POOL_SIZE))
 	{
-		Error ("ERR_NOT_ENOUGH_RANDOM_DATA");	
+		Error ("ERR_NOT_ENOUGH_RANDOM_DATA", (HWND) hwndDlg);	
 		len = RNG_POOL_SIZE;
+		LeaveCriticalSection (&critRandProt);
 		return FALSE;
 	}
 
-	// Requested number of bytes is copied from pool to output buffer,
-	// pool is rehashed, and output buffer is XORed with new data from pool
-	for (i = 0; i < len; i++)
+	while (len > 0)
 	{
-		buf[i] = pRandPool[randPoolReadIndex++];
-		if (randPoolReadIndex == RNG_POOL_SIZE) randPoolReadIndex = 0;
-	}
+		if (len > RNG_POOL_SIZE)
+		{
+			looplen = RNG_POOL_SIZE;
+			len -= RNG_POOL_SIZE;
+		}
+		else
+		{
+			looplen = len;
+			len = 0;
+		}
 
-	/* Invert the pool */
-	for (i = 0; i < RNG_POOL_SIZE / 4; i++)
-	{
-		((unsigned __int32 *) pRandPool)[i] = ~((unsigned __int32 *) pRandPool)[i];
-	}
+		// this loop number of bytes is copied from pool to output buffer,
+		// pool is rehashed, and output buffer is XORed with new data from pool
+		for (i = 0; i < looplen; i++)
+		{
+			buf[i] = pRandPool[randPoolReadIndex++];
+			if (randPoolReadIndex == RNG_POOL_SIZE) randPoolReadIndex = 0;
+		}
 
-	// Mix the pool
-	if (!FastPoll ())
-		ret = FALSE;
+		/* Invert the pool */
+		for (i = 0; i < RNG_POOL_SIZE / 4; i++)
+		{
+			((unsigned __int32 *) pRandPool)[i] = ~((unsigned __int32 *) pRandPool)[i];
+		}
 
-	// XOR the current pool content into the output buffer to prevent pool state leaks
-	for (i = 0; i < len; i++)
-	{
-		buf[i] ^= pRandPool[randPoolReadIndex++];
-		if (randPoolReadIndex == RNG_POOL_SIZE) randPoolReadIndex = 0;
+		// Mix the pool
+		if (!FastPoll ())
+			ret = FALSE;
+
+		// XOR the current pool content into the output buffer to prevent pool state leaks
+		for (i = 0; i < looplen; i++)
+		{
+			buf[i] ^= pRandPool[randPoolReadIndex++];
+			if (randPoolReadIndex == RNG_POOL_SIZE) randPoolReadIndex = 0;
+		}
+
+		// increment the pointer for the next loop
+		buf += looplen;
 	}
 
 	LeaveCriticalSection (&critRandProt);
@@ -573,7 +616,15 @@ BOOL SlowPoll (void)
 	{
 		/* Obtain a handle to the module containing the Lan Manager
 		   functions */
-		hNetAPI32 = LoadLibrary ("NETAPI32.DLL");
+		char dllPath[MAX_PATH];
+		if (GetSystemDirectory (dllPath, MAX_PATH))
+		{
+			StringCbCatA(dllPath, sizeof(dllPath), "\\NETAPI32.DLL");
+		}
+		else
+			StringCbCopyA(dllPath, sizeof(dllPath), "C:\\Windows\\System32\\NETAPI32.DLL");
+
+		hNetAPI32 = LoadLibrary (dllPath);
 		if (hNetAPI32 != NULL)
 		{
 			/* Now get pointers to the functions */
@@ -622,7 +673,7 @@ BOOL SlowPoll (void)
 		char szDevice[24];
 
 		/* Check whether we can access this device */
-		sprintf (szDevice, "\\\\.\\PhysicalDrive%d", nDrive);
+		StringCbPrintfA (szDevice, sizeof(szDevice), "\\\\.\\PhysicalDrive%d", nDrive);
 		hDevice = CreateFile (szDevice, 0, FILE_SHARE_READ | FILE_SHARE_WRITE,
 				      NULL, OPEN_EXISTING, 0, NULL);
 		if (hDevice == INVALID_HANDLE_VALUE)

src/Common/Random.h

@@ -43,8 +43,16 @@ BOOL Randmix ( void );
 void RandaddBuf ( void *buf , int len );
 BOOL FastPoll ( void );
 BOOL SlowPoll ( void );
-BOOL RandpeekBytes ( unsigned char *buf , int len );
-BOOL RandgetBytes ( unsigned char *buf , int len, BOOL forceSlowPoll );
+BOOL RandpeekBytes ( void* hwndDlg, unsigned char *buf , int len );
+
+/* Get len random bytes from the pool (max. RNG_POOL_SIZE bytes per a single call) */
+BOOL RandgetBytes ( void* hwndDlg, unsigned char *buf , int len, BOOL forceSlowPoll );
+
+/* Get len random bytes from the pool.
+ *  If allowAnyLength is FALSE, then len must be less or equal to RNG_POOL_SIZE
+ *  If allowAnyLength is TRUE, then len can have any positive value
+ */
+BOOL RandgetBytesFull ( void* hwndDlg, unsigned char *buf , int len, BOOL forceSlowPoll , BOOL allowAnyLength);
 
 #ifdef _WIN32
 

src/Common/Registry.c

@@ -8,6 +8,7 @@
 
 #include "Tcdefs.h"
 #include "Registry.h"
+#include <Strsafe.h>
 
 BOOL ReadLocalMachineRegistryDword (char *subKey, char *name, DWORD *value)
 {
@@ -104,15 +105,17 @@ char *ReadRegistryString (char *subKey, char *name, char *defaultValue, char *st
 	char value[MAX_PATH*4];
 	DWORD size = sizeof (value);
 
-	strncpy (str, defaultValue, maxLen-1);
+   str[maxLen-1] = 0;
+	StringCbCopyA (str, maxLen, defaultValue);
 
 	ZeroMemory (value, sizeof value);
 	if (RegOpenKeyEx (HKEY_CURRENT_USER, subKey,
 		0, KEY_READ, &hkey) == ERROR_SUCCESS)
-		if (RegQueryValueEx (hkey, name, 0,	0, (LPBYTE) &value,	&size) == ERROR_SUCCESS)
-			strncpy (str, value, maxLen-1);
+		if (RegQueryValueEx (hkey, name, 0,	0, (LPBYTE) value,	&size) == ERROR_SUCCESS)
+			StringCbCopyA (str, maxLen,value);
 
-	RegCloseKey (hkey);
+	if (hkey)
+		RegCloseKey (hkey);
 	return str;
 }
 
@@ -168,6 +171,30 @@ BOOL WriteLocalMachineRegistryDword (char *subKey, char *name, DWORD value)
 	return TRUE;
 }
 
+BOOL WriteLocalMachineRegistryDwordW (WCHAR *subKey, WCHAR *name, DWORD value)
+{
+	HKEY hkey = 0;
+	DWORD disp;
+	LONG status;
+
+	if ((status = RegCreateKeyExW (HKEY_LOCAL_MACHINE, subKey,
+		0, NULL, REG_OPTION_NON_VOLATILE, KEY_WRITE, NULL, &hkey, &disp)) != ERROR_SUCCESS)
+	{
+		SetLastError (status);
+		return FALSE;
+	}
+
+	if ((status = RegSetValueExW (hkey, name, 0, REG_DWORD, (BYTE *) &value, sizeof value)) != ERROR_SUCCESS)
+	{
+		RegCloseKey (hkey);
+		SetLastError (status);
+		return FALSE;
+	}
+
+	RegCloseKey (hkey);
+	return TRUE;
+}
+
 BOOL WriteLocalMachineRegistryMultiString (char *subKey, char *name, char *multiString, DWORD size)
 {
 	HKEY hkey = 0;
@@ -278,9 +305,9 @@ void DeleteRegistryValue (char *subKey, char *name)
 }
 
 
-void GetStartupRegKeyName (char *regk)
+void GetStartupRegKeyName (char *regk, size_t cbRegk)
 {
 	// The string is split in order to prevent some antivirus packages from falsely reporting  
 	// TrueCrypt.exe to contain a possible Trojan horse because of this string (heuristic scan).
-	sprintf (regk, "%s%s", "Software\\Microsoft\\Windows\\Curren", "tVersion\\Run");
+	StringCbPrintfA (regk, cbRegk,"%s%s", "Software\\Microsoft\\Windows\\Curren", "tVersion\\Run");
 }

src/Common/Registry.h

@@ -19,13 +19,14 @@ char *ReadRegistryString (char *subKey, char *name, char *defaultValue, char *st
 DWORD ReadRegistryBytes (char *path, char *name, char *value, int maxLen);
 void WriteRegistryInt (char *subKey, char *name, int value);
 BOOL WriteLocalMachineRegistryDword (char *subKey, char *name, DWORD value);
+BOOL WriteLocalMachineRegistryDwordW (WCHAR *subKey, WCHAR *name, DWORD value);
 BOOL WriteLocalMachineRegistryMultiString (char *subKey, char *name, char *multiString, DWORD size);
 BOOL WriteLocalMachineRegistryString (char *subKey, char *name, char *str, BOOL expandable);
 void WriteRegistryString (char *subKey, char *name, char *str);
 BOOL WriteRegistryBytes (char *path, char *name, char *str, DWORD size);
 BOOL DeleteLocalMachineRegistryKey (char *parentKey, char *subKeyToDelete);
 void DeleteRegistryValue (char *subKey, char *name);
-void GetStartupRegKeyName (char *regk);
+void GetStartupRegKeyName (char *regk, size_t cbRegk);
 
 #ifdef  __cplusplus
 }

src/Common/Resource.h

@@ -43,6 +43,22 @@
 #define IDD_NEW_TOKEN_KEYFILE           539
 #define IDD_RANDOM_POOL_ENRICHMENT      540
 #define IDI_TRUECRYPT_MOUNTED_ICON      541
+#define IDR_BOOT_SECTOR_SHA2            542
+#define IDR_BOOT_SECTOR_AES_SHA2        543
+#define IDR_BOOT_SECTOR_SERPENT_SHA2    544
+#define IDR_BOOT_SECTOR_TWOFISH_SHA2    545
+#define IDR_BOOT_LOADER_SHA2            546
+#define IDR_BOOT_LOADER_AES_SHA2        547
+#define IDR_BOOT_LOADER_SERPENT_SHA2    548
+#define IDR_BOOT_LOADER_TWOFISH_SHA2    549
+#define IDR_RESCUE_BOOT_SECTOR_SHA2     550
+#define IDR_RESCUE_BOOT_SECTOR_AES_SHA2 551
+#define IDR_RESCUE_BOOT_SECTOR_SERPENT_SHA2 552
+#define IDR_RESCUE_BOOT_SECTOR_TWOFISH_SHA2 553
+#define IDR_RESCUE_LOADER_SHA2          554
+#define IDR_RESCUE_LOADER_AES_SHA2      555
+#define IDR_RESCUE_LOADER_SERPENT_SHA2  556
+#define IDR_RESCUE_LOADER_TWOFISH_SHA2  557
 #define IDC_HW_AES_LABEL_LINK           5000
 #define IDC_HW_AES                      5001
 #define IDC_PARALLELIZATION_LABEL_LINK  5002
@@ -160,6 +176,18 @@
 #define IDC_CONTINUE                    5114
 #define IDT_ABOUT_RELEASE               5115
 #define IDT_STATIC_MODELESS_WAIT_DLG_INFO 5116
+#define IDT_NUMBER_KEYFILES             5117
+#define IDC_NUMBER_KEYFILES             5118
+#define IDT_KEYFILES_BASE_NAME          5119
+#define IDC_KEYFILES_BASE_NAME          5120
+#define IDC_KEYFILES_SIZE               5121
+#define IDC_KEYFILES_RANDOM_SIZE        5122
+#define IDT_KEYFILES_SIZE               5123
+#define IDD_STATIC_MODAL_WAIT_DLG       5124
+#define IDT_STATIC_MODAL_WAIT_DLG_INFO  5125
+#define IDC_WAIT_PROGRESS_BAR           5126
+#define IDC_PKCS5_PRF_ID                5127
+#define IDT_PKCS5_PRF                   5128
 
 // Next default values for new objects
 // 
@@ -168,7 +196,7 @@
 #define _APS_NO_MFC                     1
 #define _APS_NEXT_RESOURCE_VALUE        542
 #define _APS_NEXT_COMMAND_VALUE         40001
-#define _APS_NEXT_CONTROL_VALUE         5117
+#define _APS_NEXT_CONTROL_VALUE         5129
 #define _APS_NEXT_SYMED_VALUE           101
 #endif
 #endif

src/Common/SecurityToken.cpp

@@ -30,7 +30,7 @@
 
 using namespace std;
 
-namespace TrueCrypt
+namespace VeraCrypt
 {
 	SecurityTokenKeyfile::SecurityTokenKeyfile (const SecurityTokenKeyfilePath &path)
 	{
@@ -701,7 +701,7 @@ namespace TrueCrypt
 				}
 				wchar_t err[8192];
 				wsprintfW (err, L"%s:\n\n%hs%s", GetString ("SECURITY_TOKEN_ERROR"), errorString.c_str(), subjectErrorCode.str().c_str());
-				ErrorDirect (err);
+				ErrorDirect (err, parent);
 			}
 			else
 			{
@@ -710,7 +710,7 @@ namespace TrueCrypt
 				if (SubjectErrorCodeValid)
 					err += L"\n\nError code" + subjectErrorCode.str();
 
-				ErrorDirect (err.c_str());
+				ErrorDirect (err.c_str(), parent);
 			}
 		}
 	}

src/Common/SecurityToken.h

@@ -49,7 +49,7 @@
 #define TC_SECURITY_TOKEN_KEYFILE_URL_SLOT L"slot"
 #define TC_SECURITY_TOKEN_KEYFILE_URL_FILE L"file"
 
-namespace TrueCrypt
+namespace VeraCrypt
 {
 	struct SecurityTokenInfo
 	{
@@ -69,7 +69,7 @@ namespace TrueCrypt
 
 	struct SecurityTokenKeyfile
 	{
-		SecurityTokenKeyfile () { }
+		SecurityTokenKeyfile () : Handle(CK_INVALID_HANDLE), SlotId(CK_UNAVAILABLE_INFORMATION) { Token.SlotId = CK_UNAVAILABLE_INFORMATION; Token.Flags = 0; }
 		SecurityTokenKeyfile (const SecurityTokenKeyfilePath &path);
 
 		operator SecurityTokenKeyfilePath () const;
@@ -85,7 +85,8 @@ namespace TrueCrypt
 	{
 		Pkcs11Exception (CK_RV errorCode = (CK_RV) -1)
 			: ErrorCode (errorCode),
-			SubjectErrorCodeValid (false)
+			SubjectErrorCodeValid (false),
+			SubjectErrorCode( (uint64) -1)
 		{
 		}
 
@@ -132,22 +133,22 @@ namespace TrueCrypt
 
 	struct SecurityTokenLibraryNotInitialized : public Exception
 	{
-		void Show (HWND parent) const { Error (SecurityTokenLibraryPath[0] == 0 ? "NO_PKCS11_MODULE_SPECIFIED" : "PKCS11_MODULE_INIT_FAILED"); }
+		void Show (HWND parent) const { Error (SecurityTokenLibraryPath[0] == 0 ? "NO_PKCS11_MODULE_SPECIFIED" : "PKCS11_MODULE_INIT_FAILED", parent); }
 	};
 	
 	struct InvalidSecurityTokenKeyfilePath : public Exception
 	{
-		void Show (HWND parent) const { Error ("INVALID_TOKEN_KEYFILE_PATH"); }
+		void Show (HWND parent) const { Error ("INVALID_TOKEN_KEYFILE_PATH", parent); }
 	};
 
 	struct SecurityTokenKeyfileAlreadyExists : public Exception
 	{
-		void Show (HWND parent) const { Error ("TOKEN_KEYFILE_ALREADY_EXISTS"); }
+		void Show (HWND parent) const { Error ("TOKEN_KEYFILE_ALREADY_EXISTS", parent); }
 	};
 
 	struct SecurityTokenKeyfileNotFound : public Exception
 	{
-		void Show (HWND parent) const { Error ("TOKEN_KEYFILE_NOT_FOUND"); }
+		void Show (HWND parent) const { Error ("TOKEN_KEYFILE_NOT_FOUND", parent); }
 	};
 
 #endif // !TC_HEADER_Platform_Exception
@@ -155,7 +156,7 @@ namespace TrueCrypt
 
 	struct Pkcs11Session
 	{
-		Pkcs11Session () : UserLoggedIn (false) { }
+		Pkcs11Session () : Handle (CK_UNAVAILABLE_INFORMATION), UserLoggedIn (false) { }
 
 		CK_SESSION_HANDLE Handle;
 		bool UserLoggedIn;

src/Common/Tcdefs.h

@@ -15,15 +15,15 @@
 #define TC_APP_NAME						"VeraCrypt"
 
 // Version displayed to user 
-#define VERSION_STRING					"1.0b"
+#define VERSION_STRING					"1.0f-1"
 
 // Version number to compare against driver
-#define VERSION_NUM						0x010b
+#define VERSION_NUM						0x0110
 
 // Release date
-#define TC_STR_RELEASE_DATE				"June 26, 2013"
-#define TC_RELEASE_DATE_YEAR			2013
-#define TC_RELEASE_DATE_MONTH			6
+#define TC_STR_RELEASE_DATE				"January 4, 2015"
+#define TC_RELEASE_DATE_YEAR			2015
+#define TC_RELEASE_DATE_MONTH			01
 
 #define BYTES_PER_KB                    1024LL
 #define BYTES_PER_MB                    1048576LL
@@ -123,7 +123,7 @@ void ThrowFatalException (int line);
 
 #	define TC_THROW_FATAL_EXCEPTION	ThrowFatalException (__LINE__)
 #elif defined (TC_WINDOWS_DRIVER)
-#	define TC_THROW_FATAL_EXCEPTION KeBugCheckEx (SECURITY_SYSTEM, __LINE__, 0, 0, 'TC')
+#	define TC_THROW_FATAL_EXCEPTION KeBugCheckEx (SECURITY_SYSTEM, __LINE__, 0, 0, 'VC')
 #else
 #	define TC_THROW_FATAL_EXCEPTION	*(char *) 0 = 0
 #endif
@@ -134,8 +134,8 @@ void ThrowFatalException (int line);
 #include <ntddk.h>		/* Standard header file for nt drivers */
 #include <ntdddisk.h>		/* Standard I/O control codes  */
 
-#define TCalloc(size) ((void *) ExAllocatePoolWithTag( NonPagedPool, size, 'MMCT' ))
-#define TCfree(memblock) ExFreePoolWithTag( memblock, 'MMCT' )
+#define TCalloc(size) ((void *) ExAllocatePoolWithTag( NonPagedPool, size, 'MMCV' ))
+#define TCfree(memblock) ExFreePoolWithTag( memblock, 'MMCV' )
 
 #define DEVICE_DRIVER
 
@@ -197,7 +197,7 @@ typedef int BOOL;
 #		ifdef DEVICE_DRIVER
 #			define trace_msg Dump
 #		elif defined (_WIN32)
-#			define trace_msg(...) do { char msg[2048]; _snprintf (msg, sizeof (msg), __VA_ARGS__); OutputDebugString (msg); } while (0)
+#			define trace_msg(...) do { char msg[2048]; StringCbPrintfA (msg, sizeof (msg), __VA_ARGS__); OutputDebugString (msg); } while (0)
 #		endif
 #		define trace_point trace_msg (__FUNCTION__ ":" TC_TO_STRING(__LINE__) "\n")
 #	else
@@ -252,8 +252,8 @@ void EraseMemory (void *memory, int size);
 #define MAX_URL_LENGTH	2084 /* Internet Explorer limit. Includes the terminating null character. */
 
 #define TC_HOMEPAGE "http://www.idrix.fr/"
-#define TC_APPLINK "http://www.idrix.fr/"
-#define TC_APPLINK_SECURE "https://www.idrix.fr/"
+#define TC_APPLINK "https://veracrypt.codeplex.com"
+#define TC_APPLINK_SECURE "https://veracrypt.codeplex.com"
 
 enum
 {
@@ -295,7 +295,8 @@ enum
 	ERR_PARAMETER_INCORRECT					= 30,
 	ERR_SYS_HIDVOL_HEAD_REENC_MODE_WRONG	= 31,
 	ERR_NONSYS_INPLACE_ENC_INCOMPLETE		= 32,
-	ERR_USER_ABORT							= 33
+	ERR_USER_ABORT							= 33,
+	ERR_UNSUPPORTED_TRUECRYPT_FORMAT		= 34
 };
 
 #endif 	// #ifndef TCDEFS_H

src/Common/Tests.c

@@ -290,91 +290,6 @@ BOOL XTSAesTest (PCRYPTO_INFO ci)
 	return TRUE;
 }
 
-/* Blowfish Test Vectors (deprecated/legacy) */
-
-/* Blowfish test vectors from www.counterpane.com/blowfish.html */
-
-#define BF_TEST_COUNT 34
-
-typedef struct {
-	unsigned char key[8];
-	unsigned char plaintext[8];
-	unsigned char ciphertext[8];
-	} BF_TEST;
-
-#pragma warning(disable:4295)
-
-BF_TEST bf_ecb_vectors[BF_TEST_COUNT] = {
-"\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00","\x4E\xF9\x97\x45\x61\x98\xDD\x78",
-"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF","\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF","\x51\x86\x6F\xD5\xB8\x5E\xCB\x8A",
-"\x30\x00\x00\x00\x00\x00\x00\x00","\x10\x00\x00\x00\x00\x00\x00\x01","\x7D\x85\x6F\x9A\x61\x30\x63\xF2",
-"\x11\x11\x11\x11\x11\x11\x11\x11","\x11\x11\x11\x11\x11\x11\x11\x11","\x24\x66\xDD\x87\x8B\x96\x3C\x9D",
-"\x01\x23\x45\x67\x89\xAB\xCD\xEF","\x11\x11\x11\x11\x11\x11\x11\x11","\x61\xF9\xC3\x80\x22\x81\xB0\x96",
-"\x11\x11\x11\x11\x11\x11\x11\x11","\x01\x23\x45\x67\x89\xAB\xCD\xEF","\x7D\x0C\xC6\x30\xAF\xDA\x1E\xC7",
-"\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00","\x4E\xF9\x97\x45\x61\x98\xDD\x78",
-"\xFE\xDC\xBA\x98\x76\x54\x32\x10","\x01\x23\x45\x67\x89\xAB\xCD\xEF","\x0A\xCE\xAB\x0F\xC6\xA0\xA2\x8D",
-"\x7C\xA1\x10\x45\x4A\x1A\x6E\x57","\x01\xA1\xD6\xD0\x39\x77\x67\x42","\x59\xC6\x82\x45\xEB\x05\x28\x2B",
-"\x01\x31\xD9\x61\x9D\xC1\x37\x6E","\x5C\xD5\x4C\xA8\x3D\xEF\x57\xDA","\xB1\xB8\xCC\x0B\x25\x0F\x09\xA0",
-"\x07\xA1\x13\x3E\x4A\x0B\x26\x86","\x02\x48\xD4\x38\x06\xF6\x71\x72","\x17\x30\xE5\x77\x8B\xEA\x1D\xA4",
-"\x38\x49\x67\x4C\x26\x02\x31\x9E","\x51\x45\x4B\x58\x2D\xDF\x44\x0A","\xA2\x5E\x78\x56\xCF\x26\x51\xEB",
-"\x04\xB9\x15\xBA\x43\xFE\xB5\xB6","\x42\xFD\x44\x30\x59\x57\x7F\xA2","\x35\x38\x82\xB1\x09\xCE\x8F\x1A",
-"\x01\x13\xB9\x70\xFD\x34\xF2\xCE","\x05\x9B\x5E\x08\x51\xCF\x14\x3A","\x48\xF4\xD0\x88\x4C\x37\x99\x18",
-"\x01\x70\xF1\x75\x46\x8F\xB5\xE6","\x07\x56\xD8\xE0\x77\x47\x61\xD2","\x43\x21\x93\xB7\x89\x51\xFC\x98",
-"\x43\x29\x7F\xAD\x38\xE3\x73\xFE","\x76\x25\x14\xB8\x29\xBF\x48\x6A","\x13\xF0\x41\x54\xD6\x9D\x1A\xE5",
-"\x07\xA7\x13\x70\x45\xDA\x2A\x16","\x3B\xDD\x11\x90\x49\x37\x28\x02","\x2E\xED\xDA\x93\xFF\xD3\x9C\x79",
-"\x04\x68\x91\x04\xC2\xFD\x3B\x2F","\x26\x95\x5F\x68\x35\xAF\x60\x9A","\xD8\x87\xE0\x39\x3C\x2D\xA6\xE3",
-"\x37\xD0\x6B\xB5\x16\xCB\x75\x46","\x16\x4D\x5E\x40\x4F\x27\x52\x32","\x5F\x99\xD0\x4F\x5B\x16\x39\x69",
-"\x1F\x08\x26\x0D\x1A\xC2\x46\x5E","\x6B\x05\x6E\x18\x75\x9F\x5C\xCA","\x4A\x05\x7A\x3B\x24\xD3\x97\x7B",
-"\x58\x40\x23\x64\x1A\xBA\x61\x76","\x00\x4B\xD6\xEF\x09\x17\x60\x62","\x45\x20\x31\xC1\xE4\xFA\xDA\x8E",
-"\x02\x58\x16\x16\x46\x29\xB0\x07","\x48\x0D\x39\x00\x6E\xE7\x62\xF2","\x75\x55\xAE\x39\xF5\x9B\x87\xBD",
-"\x49\x79\x3E\xBC\x79\xB3\x25\x8F","\x43\x75\x40\xC8\x69\x8F\x3C\xFA","\x53\xC5\x5F\x9C\xB4\x9F\xC0\x19",
-"\x4F\xB0\x5E\x15\x15\xAB\x73\xA7","\x07\x2D\x43\xA0\x77\x07\x52\x92","\x7A\x8E\x7B\xFA\x93\x7E\x89\xA3",
-"\x49\xE9\x5D\x6D\x4C\xA2\x29\xBF","\x02\xFE\x55\x77\x81\x17\xF1\x2A","\xCF\x9C\x5D\x7A\x49\x86\xAD\xB5",
-"\x01\x83\x10\xDC\x40\x9B\x26\xD6","\x1D\x9D\x5C\x50\x18\xF7\x28\xC2","\xD1\xAB\xB2\x90\x65\x8B\xC7\x78",
-"\x1C\x58\x7F\x1C\x13\x92\x4F\xEF","\x30\x55\x32\x28\x6D\x6F\x29\x5A","\x55\xCB\x37\x74\xD1\x3E\xF2\x01",
-"\x01\x01\x01\x01\x01\x01\x01\x01","\x01\x23\x45\x67\x89\xAB\xCD\xEF","\xFA\x34\xEC\x48\x47\xB2\x68\xB2",
-"\x1F\x1F\x1F\x1F\x0E\x0E\x0E\x0E","\x01\x23\x45\x67\x89\xAB\xCD\xEF","\xA7\x90\x79\x51\x08\xEA\x3C\xAE",
-"\xE0\xFE\xE0\xFE\xF1\xFE\xF1\xFE","\x01\x23\x45\x67\x89\xAB\xCD\xEF","\xC3\x9E\x07\x2D\x9F\xAC\x63\x1D",
-"\x00\x00\x00\x00\x00\x00\x00\x00","\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF","\x01\x49\x33\xE0\xCD\xAF\xF6\xE4",
-"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF","\x00\x00\x00\x00\x00\x00\x00\x00","\xF2\x1E\x9A\x77\xB7\x1C\x49\xBC",
-"\x01\x23\x45\x67\x89\xAB\xCD\xEF","\x00\x00\x00\x00\x00\x00\x00\x00","\x24\x59\x46\x88\x57\x54\x36\x9A",
-"\xFE\xDC\xBA\x98\x76\x54\x32\x10","\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF","\x6B\x5C\x5A\x9C\x5D\x9E\x0A\x5A"
-};
-
-
-#define TRIPLEDES_TEST_COUNT 1
-
-typedef struct {
-	unsigned char key[24];
-	unsigned char plaintext[8];
-	unsigned char ciphertext[8];
-	} TRIPLEDES_TEST;
-
-TRIPLEDES_TEST tripledes_vectors[TRIPLEDES_TEST_COUNT] = {
-0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0xfe, 0xdc, 0xba, 0x98,
-0x76, 0x54, 0x32, 0x10, 0x89, 0xab, 0xcd, 0xef, 0x01, 0x23, 0x45, 0x67,
-                              
-0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xe7,
-
-0xde, 0x0b, 0x7c, 0x06, 0xae, 0x5e, 0x0e, 0xd5
-};
-
-/* CAST-128 Test Vectors from RFC2144 (deprecated/legacy) */
-
-#define CAST_TEST_COUNT 1
-
-typedef struct {
-	unsigned char key[16];
-	unsigned char plaintext[8];
-	unsigned char ciphertext[8];
-	} CAST_TEST;
-
-
-CAST_TEST cast_ecb_vectors[CAST_TEST_COUNT] = {
-	"\x01\x23\x45\x67\x12\x34\x56\x78\x23\x45\x67\x89\x34\x56\x78\x9A",
-	"\x01\x23\x45\x67\x89\xAB\xCD\xEF",
-	"\x23\x8B\x4F\xE5\x84\x7E\x44\xB2"
-	};
 
 // AES ECB test vectors FIPS-197
 
@@ -433,6 +348,36 @@ TWOFISH_TEST twofish_vectors[TWOFISH_TEST_COUNT] = {
 
 /* Test vectors from FIPS 198a, RFC 4231, RFC 2104, RFC 2202, and other sources. */
 
+char *hmac_sha256_test_keys[] =
+{
+	"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b",
+	"Jefe",
+	"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa",
+	"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19",
+	"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa",
+	"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa",
+};
+
+char *hmac_sha256_test_data[] =
+{
+	"Hi There",
+	"what do ya want for nothing?",
+	"\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd",
+	"\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd",
+	"Test Using Larger Than Block-Size Key - Hash Key First",
+	"This is a test using a larger than block-size key and a larger than block-size data. The key needs to be hashed before being used by the HMAC algorithm.",
+};
+
+char *hmac_sha256_test_vectors[] =
+{
+	"\xb0\x34\x4c\x61\xd8\xdb\x38\x53\x5c\xa8\xaf\xce\xaf\x0b\xf1\x2b\x88\x1d\xc2\x00\xc9\x83\x3d\xa7\x26\xe9\x37\x6c\x2e\x32\xcf\xf7",
+	"\x5b\xdc\xc1\x46\xbf\x60\x75\x4e\x6a\x04\x24\x26\x08\x95\x75\xc7\x5a\x00\x3f\x08\x9d\x27\x39\x83\x9d\xec\x58\xb9\x64\xec\x38\x43",
+	"\x77\x3e\xa9\x1e\x36\x80\x0e\x46\x85\x4d\xb8\xeb\xd0\x91\x81\xa7\x29\x59\x09\x8b\x3e\xf8\xc1\x22\xd9\x63\x55\x14\xce\xd5\x65\xfe",
+	"\x82\x55\x8a\x38\x9a\x44\x3c\x0e\xa4\xcc\x81\x98\x99\xf2\x08\x3a\x85\xf0\xfa\xa3\xe5\x78\xf8\x07\x7a\x2e\x3f\xf4\x67\x29\x66\x5b",
+	"\x60\xe4\x31\x59\x1e\xe0\xb6\x7f\x0d\x8a\x26\xaa\xcb\xf5\xb7\x7f\x8e\x0b\xc6\x21\x37\x28\xc5\x14\x05\x46\x04\x0f\x0e\xe3\x7f\x54",
+	"\x9b\x09\xff\xa7\x1b\x94\x2f\xcb\x27\x63\x5f\xbc\xd5\xb0\xe9\x44\xbf\xdc\x63\x64\x4f\x07\x13\x93\x8a\x7f\x51\x53\x5c\x3a\x35\xe2",
+};
+
 char *hmac_sha512_test_keys[] =
 {
 	"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b",
@@ -463,35 +408,6 @@ char *hmac_sha512_test_vectors[] =
 	"\xe3\x7b\x6a\x77\x5d\xc8\x7d\xba\xa4\xdf\xa9\xf9\x6e\x5e\x3f\xfd\xde\xbd\x71\xf8\x86\x72\x89\x86\x5d\xf5\xa3\x2d\x20\xcd\xc9\x44\xb6\x02\x2c\xac\x3c\x49\x82\xb1\x0d\x5e\xeb\x55\xc3\xe4\xde\x15\x13\x46\x76\xfb\x6d\xe0\x44\x60\x65\xc9\x74\x40\xfa\x8c\x6a\x58",
 };
 
-char *hmac_sha1_test_keys[] =
-{
-	// Deprecated/legacy
-	"\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3",
-	"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b",
-	"Jefe",
-	"\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA"
-};
-
-char *hmac_sha1_test_data[] =
-{
-	// Deprecated/legacy
-	"Sample #3",
-	"Hi There",
-	"what do ya want for nothing?",
-	"\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
-      "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
-	"\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
-};
-
-char *hmac_sha1_test_vectors[] =
-{
-	// Deprecated/legacy
-	"\xbc\xf4\x1e\xab\x8b\xb2\xd8\x02\xf3\xd0\x5c\xaf\x7c\xb0\x92\xec\xf8\xd1\xa3\xaa",
-	"\xb6\x17\x31\x86\x55\x05\x72\x64\xe2\x8b\xc0\xb6\xfb\x37\x8c\x8e\xf1\x46\xbe\x00",
-	"\xef\xfc\xdf\x6a\xe5\xeb\x2f\xa2\xd2\x74\x16\xd5\xf1\x84\xdf\x9c\x25\x9a\x7c\x79",
-	"\x12\x5d\x73\x42\xb9\xac\x11\xcd\x91\xa3\x9a\xf4\x8a\xa1\x7b\x4f\x63\xf1\x75\xd3"
-};
-
 char *hmac_ripemd160_test_keys[] =
 {
 	"\x00\x11\x22\x33\x44\x55\x66\x77\x88\x99\xaa\xbb\xcc\xdd\xee\xff\x01\x23\x45\x67",
@@ -534,29 +450,15 @@ void CipherInit2(int cipher, void* key, void* ks, int key_len)
 {
 	switch (cipher)
 	{
-	case BLOWFISH:
-		/* Deprecated/legacy */
-		BlowfishSetKey (ks, key_len,  key); 
-		break;
 
 	case AES:
 		CipherInit(cipher,key,ks);
 		break;
 
-	case CAST:
-		/* Deprecated/legacy */
-		CipherInit(cipher,key,ks);
-		break;
-
 	case SERPENT:
 		CipherInit(cipher,key,ks);
 		break;
 
-	case TRIPLEDES:
-		/* Deprecated/legacy */
-		CipherInit(cipher,key,ks);
-		break;
-
 	case TWOFISH:
 		CipherInit(cipher,key,ks);
 		break;
@@ -568,72 +470,6 @@ void CipherInit2(int cipher, void* key, void* ks, int key_len)
 }
 
 
-/* Deprecated/legacy */
-typedef struct {
-	unsigned __int8 key1[32];
-	unsigned __int8 key2[16];
-	unsigned __int8 index[16];
-	unsigned __int8 plaintext[16];
-	unsigned __int8 ciphertext[16];
-} LRW_TEST;
-
-#define LRW_TEST_COUNT 2
-
-/* Deprecated/legacy */
-LRW_TEST lrw_vectors[LRW_TEST_COUNT] = {
-	{
-		{ 0xf8, 0xd4, 0x76, 0xff, 0xd6, 0x46, 0xee, 0x6c, 0x23, 0x84, 0xcb, 0x1c, 0x77, 0xd6, 0x19, 0x5d,
-		  0xfe, 0xf1, 0xa9, 0xf3, 0x7b, 0xbc, 0x8d, 0x21, 0xa7, 0x9c, 0x21, 0xf8, 0xcb, 0x90, 0x02, 0x89 },
-		{ 0xa8, 0x45, 0x34, 0x8e, 0xc8, 0xc5, 0xb5, 0xf1, 0x26, 0xf5, 0x0e, 0x76, 0xfe, 0xfd, 0x1b, 0x1e },
-		{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 },
-		{ 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46 },
-		{ 0xbd, 0x06, 0xb8, 0xe1, 0xdb, 0x98, 0x89, 0x9e, 0xc4, 0x98, 0xe4, 0x91, 0xcf, 0x1c, 0x70, 0x2b }
-	},
-	{
-		{ 0xfb, 0x76, 0x15, 0xb2, 0x3d, 0x80, 0x89, 0x1d, 0xd4, 0x70, 0x98, 0x0b, 0xc7, 0x95, 0x84, 0xc8,
-		  0xb2, 0xfb, 0x64, 0xce, 0x60, 0x97, 0x87, 0x8d, 0x17, 0xfc, 0xe4, 0x5a, 0x49, 0xe8, 0x30, 0xb7 },
-		{ 0x6e, 0x78, 0x17, 0xe7, 0x2d, 0x5e, 0x12, 0xd4, 0x60, 0x64, 0x04, 0x7a, 0xf1, 0x2f, 0x9e, 0x0c },
-		{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00 },
-		{ 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46 },
-		{ 0x5b, 0x90, 0x8e, 0xc1, 0xab, 0xdd, 0x67, 0x5f, 0x3d, 0x69, 0x8a, 0x95, 0x53, 0xc8, 0x9c, 0xe5 }
-	}
-};
-
-
-BOOL LRWAesTest (PCRYPTO_INFO ci)
-{
-	/* Deprecated/legacy */
-
-	unsigned __int8 p[16];
-	int i;
-
-	for (i = 0; i < LRW_TEST_COUNT; i++)
-	{
-		ci->ea = EAGetByName ("AES");
-		if (ci->ea == 0)
-			return FALSE;
-
-		ci->mode = LRW;
-
-		if (EAInit (ci->ea, lrw_vectors[i].key1, ci->ks) != ERR_SUCCESS)
-			return FALSE;
-
-		memcpy (&ci->k2, lrw_vectors[i].key2, sizeof (lrw_vectors[i].key2));
-		if (!EAInitMode (ci))
-			return FALSE;
-
-		memcpy (p, lrw_vectors[i].plaintext, sizeof (p));
-
-		EncryptBufferLRW128 (p, sizeof (p), BE64(((unsigned __int64 *)(lrw_vectors[i].index))[1]), ci);
-
-		if (memcmp (lrw_vectors[i].ciphertext, p, sizeof (p)) != 0)
-			return FALSE;
-	}
-
-	return TRUE;
-}
-
-
 BOOL TestSectorBufEncryption (PCRYPTO_INFO ci)
 {
 	unsigned char buf [ENCRYPTION_DATA_UNIT_SIZE * 4];
@@ -653,15 +489,12 @@ BOOL TestSectorBufEncryption (PCRYPTO_INFO ci)
 		0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13
 	};
 
-	if (!TestLegacySectorBufEncryption (ci))
-		return FALSE;
-
 
 	/* Encryption/decryption of data units (typically, volume data sectors) */
 
 	nbrUnits = sizeof (buf) / ENCRYPTION_DATA_UNIT_SIZE;
 
-	ci->mode = XTS;	// Other modes of operation are tested in TestLegacySectorBufEncryption()
+	ci->mode = XTS;	// we only implement XTS
 
 	/* The buffer can accommodate 4 data units and we'll test 4 cases by "scrolling". The data unit 0xFFFFFFFFFF
 	will "move" from the start of the buffer to its end. For a 512-byte data unit, the byte offset 562949953420800
@@ -678,7 +511,7 @@ BOOL TestSectorBufEncryption (PCRYPTO_INFO ci)
 			if (!EAIsModeSupported (ci->ea, ci->mode))
 				continue;
 
-			EAGetName (name, ci->ea);
+			EAGetName (name, ci->ea, 0);
 
 			if (EAInit (ci->ea, key1, ci->ks) != ERR_SUCCESS)
 				return FALSE;
@@ -944,7 +777,7 @@ BOOL TestSectorBufEncryption (PCRYPTO_INFO ci)
 		if (!EAIsModeSupported (ci->ea, ci->mode))
 			continue;
 
-		EAGetName (name, ci->ea);
+		EAGetName (name, ci->ea, 0);
 
 		if (EAInit (ci->ea, key1, ci->ks) != ERR_SUCCESS)
 			return FALSE;
@@ -1029,340 +862,6 @@ BOOL TestSectorBufEncryption (PCRYPTO_INFO ci)
 	return (nTestsPerformed == 80);
 }
 
-
-BOOL TestLegacySectorBufEncryption (PCRYPTO_INFO ci)
-{
-	unsigned char buf [ENCRYPTION_DATA_UNIT_SIZE * 2];
-	unsigned int i;
-	char name[64];
-	unsigned __int32 crc;
-	UINT64_STRUCT unitNo;
-	uint32 nbrUnits;
-	int blockSize;
-	BOOL lrw64InitDone = FALSE;
-	BOOL lrw128InitDone = FALSE;
-	int nTestsPerformed = 0;
-
-	unitNo.Value = 0x0234567890ABCDEFull;
-	nbrUnits = sizeof (buf) / ENCRYPTION_DATA_UNIT_SIZE;
-
-	for (i = 0; i < sizeof (buf); i++)
-		buf[i] = (unsigned char) i;
-
-	for (i = 0; i < sizeof (ci->k2); i++)
-		ci->k2[i] = (unsigned char) i;
-
-	// Test all EAs
-	for (ci->ea = EAGetFirst (); ci->ea != 0; ci->ea = EAGetNext (ci->ea))
-	{
-		EAGetName (name, ci->ea);
-		blockSize = CipherGetBlockSize (EAGetFirstCipher (ci->ea));
-
-		if (EAInit (ci->ea, (unsigned char *)buf, ci->ks) == ERR_CIPHER_INIT_FAILURE)
-			return FALSE;
-
-		// Test all deprecated modes of operation
-		for (ci->mode = EAGetFirstMode (ci->ea);
-			ci->mode != 0;
-			ci->mode = EAGetNextMode (ci->ea, ci->mode))
-		{
-			// Skip modes that are not deprecated
-			if (ci->mode == XTS)
-				continue;
-
-			if (ci->mode == LRW
-				&& (blockSize == 8 && !lrw64InitDone || blockSize == 16 && !lrw128InitDone ))
-			{
-				if (!EAInitMode (ci))
-					return FALSE;
-
-				if (blockSize == 8)
-					lrw64InitDone = TRUE;
-				else if (blockSize == 16)
-					lrw128InitDone = TRUE;
-			}
-
-			EncryptDataUnits (buf, &unitNo, nbrUnits, ci);
-			crc = GetCrc32 (buf, sizeof (buf));
-
-			switch (ci->mode)
-			{
-			case LRW:		// Deprecated/legacy
-				if (strcmp (name, "AES") == 0)
-				{
-					if (crc != 0x5237acf9)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Blowfish") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0xf94d5300)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "CAST5") == 0)		// Deprecated/legacy
-				{
-					if (crc != 0x33971e82)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent") == 0)
-				{
-					if (crc != 0x7fb86805)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Triple DES") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0x2b20bb84)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Twofish") == 0)
-				{
-					if (crc != 0xa9de0f0b)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Twofish") == 0)
-				{
-					if (crc != 0x4ed0fd80)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Twofish-Serpent") == 0)
-				{
-					if (crc != 0xea04b3cf)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent-AES") == 0)
-				{
-					if (crc != 0x0d33596a)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent-Twofish-AES") == 0)
-				{
-					if (crc != 0x2845d0e3)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Twofish-Serpent") == 0)
-				{
-					if (crc != 0xca65c5cd)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				break;
-
-			case CBC:		// Deprecated/legacy
-			case INNER_CBC:	// Deprecated/legacy
-			case OUTER_CBC:	// Deprecated/legacy
-				if (strcmp (name, "AES") == 0)
-				{
-					if (crc != 0x2274f53d)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Blowfish") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0x033899a1)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "CAST5") == 0)		// Deprecated/legacy
-				{
-					if (crc != 0x331cecc7)	
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent") == 0)
-				{
-					if (crc != 0x42dff3d4)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Triple DES") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0xfe497d0c)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Blowfish") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0xa7a80c84)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Blowfish-Serpent") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0xa0584562)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Twofish") == 0)
-				{
-					if (crc != 0x3c226444)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Twofish-Serpent") == 0)
-				{
-					if (crc != 0x5e5e77fd)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent-AES") == 0)
-				{
-					if (crc != 0x57c612d5)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent-Twofish-AES") == 0)
-				{
-					if (crc != 0x081e045a)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Twofish-Serpent") == 0)
-				{
-					if (crc != 0xa7b659f3)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				break;
-			}
-
-			if (crc == 0xb70b4c26)
-				return FALSE;
-
-			DecryptDataUnits (buf, &unitNo, nbrUnits, ci);
-
-			if (GetCrc32 (buf, sizeof (buf)) != 0xb70b4c26)
-				return FALSE;
-
-			nTestsPerformed++;
-
-			EncryptBuffer (buf, sizeof (buf), ci);
-			crc = GetCrc32 (buf, sizeof (buf));
-
-			switch (ci->mode)
-			{
-			case LRW:		// Deprecated/legacy
-				if (strcmp (name, "AES") == 0)
-				{
-					if (crc != 0x5ae1e3d8)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Blowfish") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0x2738426f)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Twofish-Serpent") == 0)
-				{
-					if (crc != 0x14f2948a)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				break;
-
-			case CBC:		// Deprecated/legacy
-			case INNER_CBC:	// Deprecated/legacy
-			case OUTER_CBC:	// Deprecated/legacy
-				if (strcmp (name, "AES") == 0)
-				{
-					if (crc != 0x960f740e)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Blowfish") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0x7e1cfabb)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "CAST5") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0xeaae21c8)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent") == 0)
-				{
-					if (crc != 0xa8139d62)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Triple DES") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0xecf5d7d0)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Blowfish") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0xb70171b6)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Blowfish-Serpent") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0x1e749a87)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Twofish") == 0)
-				{
-					if (crc != 0xb4b8bb9b)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Twofish-Serpent") == 0)
-				{
-					if (crc != 0x76b6c1cb)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent-AES") == 0)
-				{
-					if (crc != 0x634f12ed)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent-Twofish-AES") == 0)
-				{
-					if (crc != 0xe54bc1b9)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Twofish-Serpent") == 0)
-				{
-					if (crc != 0x21cdb382)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				break;
-			}
-
-			if (crc == 0xb70b4c26)
-				return FALSE;
-
-			DecryptBuffer (buf, sizeof (buf), ci);
-
-			if (GetCrc32 (buf, sizeof (buf)) != 0xb70b4c26)
-				return FALSE;
-
-			nTestsPerformed++;
-		}
-	}
-	return (nTestsPerformed == 86);
-}
-
-
 static BOOL DoAutoTestAlgorithms (void)
 {
 	PCRYPTO_INFO ci;
@@ -1377,74 +876,6 @@ static BOOL DoAutoTestAlgorithms (void)
 
 	memset (ci, 0, sizeof (*ci));
 
-	/* Blowfish (deprecated/legacy) */
-
-	for (i=0;i<BF_TEST_COUNT;i++)
-	{		
-		memcpy(key, bf_ecb_vectors[i].key, 8);
-		memcpy(tmp, bf_ecb_vectors[i].plaintext, 8);
-		CipherInit2(BLOWFISH, key, ks_tmp, 8);
-
-		((uint32 *)tmp)[0] = BE32 (((uint32 *)tmp)[0]);
-		((uint32 *)tmp)[1] = BE32 (((uint32 *)tmp)[1]);
-
-		BlowfishEncryptLE (tmp,tmp,(BF_KEY *)ks_tmp,1);
-		BlowfishEncryptLE (tmp,tmp,(BF_KEY *)ks_tmp,0);
-		BlowfishEncryptLE (tmp,tmp,(BF_KEY *)ks_tmp,1);
-
-		((uint32 *)tmp)[0] = BE32 (((uint32 *)tmp)[0]);
-		((uint32 *)tmp)[1] = BE32 (((uint32 *)tmp)[1]);
-
-		if (memcmp(bf_ecb_vectors[i].ciphertext,tmp,8)!=0)
-			break;
-	}
-
-	if (i != BF_TEST_COUNT)
-		bFailed = TRUE;
-
-	/* CAST5 (deprecated/legacy) */
-
-	for (i=0;i<CAST_TEST_COUNT;i++)
-	{			
-		int cipher = CAST;
-		memcpy(key, cast_ecb_vectors[i].key, 16);
-		memcpy(tmp, cast_ecb_vectors[i].plaintext, 8);
-		CipherInit2(cipher, key, ks_tmp, 16);
-
-		EncipherBlock(cipher, tmp, ks_tmp);
-		DecipherBlock(cipher, tmp, ks_tmp);
-		EncipherBlock(cipher, tmp, ks_tmp);
-
-		if (memcmp(cast_ecb_vectors[i].ciphertext, tmp,8)!=0)
-			break;
-	}
-
-	if (i!=CAST_TEST_COUNT)
-		bFailed = TRUE;
-
-
-	/* Triple DES (TECB, EDE) - deprecated/legacy */
-
-	for (i = 0; i < TRIPLEDES_TEST_COUNT; i++)
-	{			
-		int cipher = TRIPLEDES;
-		memcpy(key, tripledes_vectors[i].key, sizeof(tripledes_vectors->key));
-		memcpy(tmp, tripledes_vectors[i].plaintext, sizeof(tripledes_vectors->plaintext));
-
-		CipherInit(cipher, key, ks_tmp);
-
-		EncipherBlock(cipher, tmp, ks_tmp);
-		if (memcmp(tripledes_vectors[i].ciphertext, tmp, sizeof(tripledes_vectors->ciphertext)) != 0)
-			break;
-
-		DecipherBlock(cipher, tmp, ks_tmp);
-		if (memcmp(tripledes_vectors[i].plaintext, tmp, sizeof(tripledes_vectors->plaintext)) != 0)
-			break;
-	}
-	if (i != TRIPLEDES_TEST_COUNT)
-		bFailed = TRUE;
-
-
 	/* AES */
 
 	for (i = 0; i < AES_TEST_COUNT; i++)
@@ -1550,10 +981,6 @@ static BOOL DoAutoTestAlgorithms (void)
 	if (!XTSAesTest (ci))
 		bFailed = TRUE;
 
-	/* LRW-AES (deprecated/legacy) */
-	if (!LRWAesTest (ci))
-		bFailed = TRUE;
-
 	/* Sector and buffer related algorithms */
 	if (!TestSectorBufEncryption (ci))
 		bFailed = TRUE;
@@ -1582,6 +1009,23 @@ BOOL AutoTestAlgorithms (void)
 	return result;
 }
 
+BOOL test_hmac_sha256 ()
+{
+	unsigned int i;
+	int nTestsPerformed = 0;
+
+	for (i = 0; i < sizeof (hmac_sha256_test_data) / sizeof(char *); i++)
+	{
+		char digest[SHA256_DIGESTSIZE];
+		hmac_sha256 (hmac_sha256_test_keys[i], (int) strlen (hmac_sha256_test_keys[i]), hmac_sha256_test_data[i], (int) strlen (hmac_sha256_test_data[i]), digest);
+		if (memcmp (digest, hmac_sha256_test_vectors[i], SHA256_DIGESTSIZE) != 0)
+			return FALSE;
+		else
+			nTestsPerformed++;
+	}
+
+	return (nTestsPerformed == 6);
+}
 
 BOOL test_hmac_sha512 ()
 {
@@ -1601,26 +1045,6 @@ BOOL test_hmac_sha512 ()
 	return (nTestsPerformed == 6);
 }
 
-BOOL test_hmac_sha1 ()
-{
-	// Deprecated/legacy
-
-	int nTestsPerformed = 0;
-	int i;
-
-	for (i = 0; i < 3; i++)
-	{
-		char digest[SHA1_DIGESTSIZE];
-		hmac_sha1 (hmac_sha1_test_keys[i], (int) strlen (hmac_sha1_test_keys[i]), hmac_sha1_test_data[i], (int) strlen (hmac_sha1_test_data[i]), digest, SHA1_DIGESTSIZE);
-		if (memcmp (digest, hmac_sha1_test_vectors[i], SHA1_DIGESTSIZE) != 0)
-			return FALSE;
-		else
-			nTestsPerformed++;
-	}
-
-	return (nTestsPerformed == 3);
-}
-
 BOOL test_hmac_ripemd160 ()
 {
 	int nTestsPerformed = 0;
@@ -1654,12 +1078,12 @@ BOOL test_pkcs5 ()
 {
 	char dk[144];
 
-	/* HMAC-SHA-512 tests */
-	if (!test_hmac_sha512())
+	/* HMAC-SHA-256 tests */
+	if (!test_hmac_sha256())
 		return FALSE;
 
-	/* HMAC-SHA-1 tests (deprecated/legacy)  */
-	if (test_hmac_sha1() == FALSE)
+	/* HMAC-SHA-512 tests */
+	if (!test_hmac_sha512())
 		return FALSE;
 
 	/* HMAC-RIPEMD-160 tests */
@@ -1670,6 +1094,26 @@ BOOL test_pkcs5 ()
 	if (test_hmac_whirlpool() == FALSE)
 		return FALSE;
 
+	/* PKCS-5 test 1 with HMAC-SHA-256 used as the PRF (https://tools.ietf.org/html/draft-josefsson-scrypt-kdf-00) */
+	derive_key_sha256 ("passwd", 6, "\x73\x61\x6C\x74", 4, 1, dk, 64);
+	if (memcmp (dk, "\x55\xac\x04\x6e\x56\xe3\x08\x9f\xec\x16\x91\xc2\x25\x44\xb6\x05\xf9\x41\x85\x21\x6d\xde\x04\x65\xe6\x8b\x9d\x57\xc2\x0d\xac\xbc\x49\xca\x9c\xcc\xf1\x79\xb6\x45\x99\x16\x64\xb3\x9d\x77\xef\x31\x7c\x71\xb8\x45\xb1\xe3\x0b\xd5\x09\x11\x20\x41\xd3\xa1\x97\x83", 64) != 0)
+		return FALSE;
+
+	/* PKCS-5 test 2 with HMAC-SHA-256 used as the PRF (https://stackoverflow.com/questions/5130513/pbkdf2-hmac-sha2-test-vectors) */
+	derive_key_sha256 ("password", 8, "\x73\x61\x6C\x74", 4, 2, dk, 32);
+	if (memcmp (dk, "\xae\x4d\x0c\x95\xaf\x6b\x46\xd3\x2d\x0a\xdf\xf9\x28\xf0\x6d\xd0\x2a\x30\x3f\x8e\xf3\xc2\x51\xdf\xd6\xe2\xd8\x5a\x95\x47\x4c\x43", 32) != 0)
+		return FALSE;
+
+	/* PKCS-5 test 3 with HMAC-SHA-256 used as the PRF (MS CryptoAPI) */
+	derive_key_sha256 ("password", 8, "\x12\x34\x56\x78", 4, 5, dk, 4);
+	if (memcmp (dk, "\xf2\xa0\x4f\xb2", 4) != 0)
+		return FALSE;
+
+	/* PKCS-5 test 4 with HMAC-SHA-256 used as the PRF (MS CryptoAPI) */
+	derive_key_sha256 ("password", 8, "\x12\x34\x56\x78", 4, 5, dk, 144);
+	if (memcmp (dk, "\xf2\xa0\x4f\xb2\xd3\xe9\xa5\xd8\x51\x0b\x5c\x06\xdf\x70\x8e\x24\xe9\xc7\xd9\x15\x3d\x22\xcd\xde\xb8\xa6\xdb\xfd\x71\x85\xc6\x99\x32\xc0\xee\x37\x27\xf7\x24\xcf\xea\xa6\xac\x73\xa1\x4c\x4e\x52\x9b\x94\xf3\x54\x06\xfc\x04\x65\xa1\x0a\x24\xfe\xf0\x98\x1d\xa6\x22\x28\xeb\x24\x55\x74\xce\x6a\x3a\x28\xe2\x04\x3a\x59\x13\xec\x3f\xf2\xdb\xcf\x58\xdd\x53\xd9\xf9\x17\xf6\xda\x74\x06\x3c\x0b\x66\xf5\x0f\xf5\x58\xa3\x27\x52\x8c\x5b\x07\x91\xd0\x81\xeb\xb6\xbc\x30\x69\x42\x71\xf2\xd7\x18\x42\xbe\xe8\x02\x93\x70\x66\xad\x35\x65\xbc\xf7\x96\x8e\x64\xf1\xc6\x92\xda\xe0\xdc\x1f\xb5\xf4", 144) != 0)
+		return FALSE;
+
 	/* PKCS-5 test 1 with HMAC-SHA-512 used as the PRF */
 	derive_key_sha512 ("password", 8, "\x12\x34\x56\x78", 4, 5, dk, 4);
 	if (memcmp (dk, "\x13\x64\xae\xf8", 4) != 0)
@@ -1681,30 +1125,13 @@ BOOL test_pkcs5 ()
 	if (memcmp (dk, "\x13\x64\xae\xf8\x0d\xf5\x57\x6c\x30\xd5\x71\x4c\xa7\x75\x3f\xfd\x00\xe5\x25\x8b\x39\xc7\x44\x7f\xce\x23\x3d\x08\x75\xe0\x2f\x48\xd6\x30\xd7\x00\xb6\x24\xdb\xe0\x5a\xd7\x47\xef\x52\xca\xa6\x34\x83\x47\xe5\xcb\xe9\x87\xf1\x20\x59\x6a\xe6\xa9\xcf\x51\x78\xc6\xb6\x23\xa6\x74\x0d\xe8\x91\xbe\x1a\xd0\x28\xcc\xce\x16\x98\x9a\xbe\xfb\xdc\x78\xc9\xe1\x7d\x72\x67\xce\xe1\x61\x56\x5f\x96\x68\xe6\xe1\xdd\xf4\xbf\x1b\x80\xe0\x19\x1c\xf4\xc4\xd3\xdd\xd5\xd5\x57\x2d\x83\xc7\xa3\x37\x87\xf4\x4e\xe0\xf6\xd8\x6d\x65\xdc\xa0\x52\xa3\x13\xbe\x81\xfc\x30\xbe\x7d\x69\x58\x34\xb6\xdd\x41\xc6", 144) != 0)
 		return FALSE;
 
-	/* PKCS-5 test 1 with HMAC-SHA-1 (deprecated/legacy) used as the PRF (derives a key longer than the underlying hash) */
-	derive_key_sha1 ("password", 8, "\x12\x34\x56\x78", 4, 5, dk, 48);
-	if (memcmp (dk, "\x5c\x75\xce\xf0\x1a\x96\x0d\xf7\x4c\xb6\xb4\x9b\x9e\x38\xe6\xb5\x3b\x11\x80\xe3\x2f\xf7\xe0\xdd\xaa\xca\x8f\x81\x27\xf6\x9f\x4f\x1d\xc8\x2f\x48\x2d\xdb\x1a\x0a\xca\x90\xcb\x80\xb9\x2e\x90\x9e", 48) != 0)
-		return FALSE;
-
-	/* PKCS-5 test 2 with HMAC-SHA-1 (deprecated/legacy) used as the PRF */
-	derive_key_sha1 ("password", 8, "\x12\x34\x56\x78", 4, 5, dk, 4);
-	if (memcmp (dk, "\x5c\x75\xce\xf0", 4) != 0)
-		return FALSE;
-
-#if 0	// This test is disabled because it uses 1200 iterations (to prevent startup slowdown)
-	/* PKCS-5 test 3 with HMAC-SHA-1 (deprecated/legacy) used as the PRF */
-	derive_key_sha1 ("password", 8, "ATHENA.MIT.EDUraeburn", 21, 1200, dk, 16);
-	if (memcmp (dk, "\x5c\x08\xeb\x61\xfd\xf7\x1e\x4e\x4e\xc3\xcf\x6b\xa1\xf5\x51\x2b", 16) != 0)
-		return FALSE;
-#endif
-
 	/* PKCS-5 test 1 with HMAC-RIPEMD-160 used as the PRF */
-	derive_key_ripemd160 (FALSE, "password", 8, "\x12\x34\x56\x78", 4, 5, dk, 4);
+	derive_key_ripemd160 ("password", 8, "\x12\x34\x56\x78", 4, 5, dk, 4);
 	if (memcmp (dk, "\x7a\x3d\x7c\x03", 4) != 0)
 		return FALSE;
 
 	/* PKCS-5 test 2 with HMAC-RIPEMD-160 used as the PRF (derives a key longer than the underlying hash) */
-	derive_key_ripemd160 (FALSE, "password", 8, "\x12\x34\x56\x78", 4, 5, dk, 48);
+	derive_key_ripemd160 ("password", 8, "\x12\x34\x56\x78", 4, 5, dk, 48);
 	if (memcmp (dk, "\x7a\x3d\x7c\x03\xe7\x26\x6b\xf8\x3d\x78\xfb\x29\xd2\x64\x1f\x56\xea\xf0\xe5\xf5\xcc\xc4\x3a\x31\xa8\x84\x70\xbf\xbd\x6f\x8e\x78\x24\x5a\xc0\x0a\xf6\xfa\xf0\xf6\xe9\x00\x47\x5f\x73\xce\xe1\x43", 48) != 0)
 		return FALSE;
 

src/Common/Tests.h

@@ -17,7 +17,6 @@ extern unsigned char ks_tmp[MAX_EXPANDED_KEY];
 
 void CipherInit2(int cipher, void* key, void* ks, int key_len);
 BOOL test_hmac_sha512 (void);
-BOOL test_hmac_sha1 (void);
 BOOL test_hmac_ripemd160 (void);
 BOOL test_hmac_whirlpool (void);
 BOOL test_pkcs5 (void);

src/Common/Volumes.c

@@ -33,6 +33,9 @@
 #include "Volumes.h"
 #include "Pkcs5.h"
 
+#ifdef _WIN32
+#include <Strsafe.h>
+#endif
 
 /* Volume header v5 structure (used since TrueCrypt 7.0): */
 //
@@ -41,7 +44,7 @@
 // Unencrypted:
 // 0		64		Salt
 // Encrypted:
-// 64		4		ASCII string 'TRUE'
+// 64		4		ASCII string 'VERA'
 // 68		2		Header version
 // 70		2		Required program version
 // 72		4		CRC-32 checksum of the (decrypted) bytes 256-511
@@ -64,7 +67,7 @@
 // Unencrypted:
 // 0		64		Salt
 // Encrypted:
-// 64		4		ASCII string 'TRUE'
+// 64		4		ASCII string 'VERA'
 // 68		2		Header version
 // 70		2		Required program version
 // 72		4		CRC-32 checksum of the (decrypted) bytes 256-511
@@ -86,7 +89,7 @@
 // Unencrypted:
 // 0		64		Salt
 // Encrypted:
-// 64		4		ASCII string 'TRUE'
+// 64		4		ASCII string 'VERA'
 // 68		2		Header version
 // 70		2		Required program version
 // 72		4		CRC-32 checksum of the (decrypted) bytes 256-511
@@ -107,7 +110,7 @@
 // Unencrypted:
 // 0		64		Salt
 // Encrypted:
-// 64		4		ASCII string 'TRUE'
+// 64		4		ASCII string 'VERA'
 // 68		2		Header version
 // 70		2		Required program version
 // 72		4		CRC-32 checksum of the (decrypted) bytes 256-511
@@ -160,7 +163,7 @@ typedef struct
 
 BOOL ReadVolumeHeaderRecoveryMode = FALSE;
 
-int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, PCRYPTO_INFO *retInfo, CRYPTO_INFO *retHeaderCryptoInfo)
+int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, int selected_pkcs5_prf, BOOL truecryptMode, PCRYPTO_INFO *retInfo, CRYPTO_INFO *retHeaderCryptoInfo)
 {
 	char header[TC_VOLUME_HEADER_EFFECTIVE_SIZE];
 	KEY_INFO keyInfo;
@@ -181,18 +184,30 @@ int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, PCR
 	LONG outstandingWorkItemCount = 0;
 	int i;
 
+	if (truecryptMode)
+	{
+		// SHA-256 not supported in TrueCrypt mode
+		if (selected_pkcs5_prf == SHA256)
+			return ERR_PARAMETER_INCORRECT;
+		pkcs5PrfCount--; // don't count SHA-256 in case of TrueCrypt mode
+	}
+
 	if (retHeaderCryptoInfo != NULL)
 	{
 		cryptoInfo = retHeaderCryptoInfo;
 	}
 	else
 	{
+      if (!retInfo)
+         return ERR_PARAMETER_INCORRECT;
+
 		cryptoInfo = *retInfo = crypto_open ();
 		if (cryptoInfo == NULL)
 			return ERR_OUTOFMEMORY;
 	}
 
-	if (encryptionThreadCount > 1)
+	/* use thread pool only if no PRF was specified */
+	if ((selected_pkcs5_prf == 0) && (encryptionThreadCount > 1))
 	{
 		keyDerivationWorkItems = TCalloc (sizeof (KeyDerivationWorkItem) * pkcs5PrfCount);
 		if (!keyDerivationWorkItems)
@@ -234,11 +249,16 @@ int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, PCR
 
 	// Test all available PKCS5 PRFs
 	for (enqPkcs5Prf = FIRST_PRF_ID; enqPkcs5Prf <= LAST_PRF_ID || queuedWorkItems > 0; ++enqPkcs5Prf)
-	{
-		BOOL lrw64InitDone = FALSE;		// Deprecated/legacy
-		BOOL lrw128InitDone = FALSE;	// Deprecated/legacy
+	{	
+		// if a PRF is specified, we skip all other PRFs
+		if (selected_pkcs5_prf != 0 && enqPkcs5Prf != selected_pkcs5_prf)
+			continue;
 
-		if (encryptionThreadCount > 1)
+		// skip SHA-256 in case of TrueCrypt mode
+		if (truecryptMode && (enqPkcs5Prf == SHA256))
+			continue;
+
+		if ((selected_pkcs5_prf == 0) && (encryptionThreadCount > 1))
 		{
 			// Enqueue key derivation on thread pool
 			if (queuedWorkItems < encryptionThreadCount && enqPkcs5Prf <= LAST_PRF_ID)
@@ -254,7 +274,7 @@ int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, PCR
 
 						EncryptionThreadPoolBeginKeyDerivation (&keyDerivationCompletedEvent, &noOutstandingWorkItemEvent,
 							&item->KeyReady, &outstandingWorkItemCount, enqPkcs5Prf, keyInfo.userKey,
-							keyInfo.keyLength, keyInfo.salt, get_pkcs5_iteration_count (enqPkcs5Prf, bBoot), item->DerivedKey);
+							keyInfo.keyLength, keyInfo.salt, get_pkcs5_iteration_count (enqPkcs5Prf, truecryptMode, bBoot), item->DerivedKey);
 						
 						++queuedWorkItems;
 						break;
@@ -276,7 +296,7 @@ int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, PCR
 					if (!item->Free && InterlockedExchangeAdd (&item->KeyReady, 0) == TRUE)
 					{
 						pkcs5_prf = item->Pkcs5Prf;
-						keyInfo.noIterations = get_pkcs5_iteration_count (pkcs5_prf, bBoot);
+						keyInfo.noIterations = get_pkcs5_iteration_count (pkcs5_prf, truecryptMode, bBoot);
 						memcpy (dk, item->DerivedKey, sizeof (dk));
 
 						item->Free = TRUE;
@@ -294,12 +314,12 @@ KeyReady:	;
 		else
 		{
 			pkcs5_prf = enqPkcs5Prf;
-			keyInfo.noIterations = get_pkcs5_iteration_count (enqPkcs5Prf, bBoot);
+			keyInfo.noIterations = get_pkcs5_iteration_count (enqPkcs5Prf, truecryptMode, bBoot);
 
 			switch (pkcs5_prf)
 			{
 			case RIPEMD160:
-				derive_key_ripemd160 (TRUE, keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
+				derive_key_ripemd160 (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
 					PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
 				break;
 
@@ -308,14 +328,13 @@ KeyReady:	;
 					PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
 				break;
 
-			case SHA1:
-				// Deprecated/legacy
-				derive_key_sha1 (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
+			case WHIRLPOOL:
+				derive_key_whirlpool (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
 					PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
 				break;
 
-			case WHIRLPOOL:
-				derive_key_whirlpool (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
+			case SHA256:
+				derive_key_sha256 (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
 					PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
 				break;
 
@@ -332,16 +351,6 @@ KeyReady:	;
 		{
 			switch (cryptoInfo->mode)
 			{
-			case LRW:
-			case CBC:
-			case INNER_CBC:
-			case OUTER_CBC:
-
-				// For LRW (deprecated/legacy), copy the tweak key 
-				// For CBC (deprecated/legacy), copy the IV/whitening seed 
-				memcpy (cryptoInfo->k2, dk, LEGACY_VOL_IV_SIZE);
-				primaryKeyOffset = LEGACY_VOL_IV_SIZE;
-				break;
 
 			default:
 				primaryKeyOffset = 0;
@@ -377,21 +386,9 @@ KeyReady:	;
 						goto err;
 					}
 				}
-				else if (cryptoInfo->mode == LRW
-					&& (blockSize == 8 && !lrw64InitDone || blockSize == 16 && !lrw128InitDone))
+				else
 				{
-					// Deprecated/legacy
-
-					if (!EAInitMode (cryptoInfo))
-					{
-						status = ERR_MODE_INIT_FAILED;
-						goto err;
-					}
-
-					if (blockSize == 8)
-						lrw64InitDone = TRUE;
-					else if (blockSize == 16)
-						lrw128InitDone = TRUE;
+					continue;
 				}
 
 				// Copy the header for decryption
@@ -401,8 +398,10 @@ KeyReady:	;
 
 				DecryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, cryptoInfo);
 
-				// Magic 'TRUE'
-				if (GetHeaderField32 (header, TC_HEADER_OFFSET_MAGIC) != 0x56455241)
+				// Magic 'VERA' or 'TRUE' depending if we are in TrueCrypt mode or not
+				if ((truecryptMode && GetHeaderField32 (header, TC_HEADER_OFFSET_MAGIC) != 0x54525545)
+					|| (!truecryptMode && GetHeaderField32 (header, TC_HEADER_OFFSET_MAGIC) != 0x56455241)
+					)
 					continue;
 
 				// Header version
@@ -422,7 +421,17 @@ KeyReady:	;
 
 				// Required program version
 				cryptoInfo->RequiredProgramVersion = GetHeaderField16 (header, TC_HEADER_OFFSET_REQUIRED_VERSION);
-				cryptoInfo->LegacyVolume = cryptoInfo->RequiredProgramVersion < 0x10b;
+				if (truecryptMode)
+				{
+					if (cryptoInfo->RequiredProgramVersion < 0x600 || cryptoInfo->RequiredProgramVersion > 0x71a)
+					{
+						status = ERR_UNSUPPORTED_TRUECRYPT_FORMAT;
+						goto err;
+					}
+					cryptoInfo->LegacyVolume = FALSE;
+				}
+				else
+					cryptoInfo->LegacyVolume = cryptoInfo->RequiredProgramVersion < 0x10b;
 
 				// Check CRC of the key set
 				if (!ReadVolumeHeaderRecoveryMode
@@ -432,7 +441,7 @@ KeyReady:	;
 				// Now we have the correct password, cipher, hash algorithm, and volume type
 
 				// Check the version required to handle this volume
-				if (cryptoInfo->RequiredProgramVersion > VERSION_NUM)
+				if (!truecryptMode && (cryptoInfo->RequiredProgramVersion > VERSION_NUM))
 				{
 					status = ERR_NEW_VERSION_REQUIRED;
 					goto err;
@@ -484,6 +493,7 @@ KeyReady:	;
 					{
 						cryptoInfo->pkcs5 = pkcs5_prf;
 						cryptoInfo->noIterations = keyInfo.noIterations;
+						cryptoInfo->bTrueCryptMode = truecryptMode;
 						goto ret;
 					}
 
@@ -505,6 +515,7 @@ KeyReady:	;
 				memcpy (cryptoInfo->salt, keyInfo.salt, PKCS5_SALT_SIZE);
 				cryptoInfo->pkcs5 = pkcs5_prf;
 				cryptoInfo->noIterations = keyInfo.noIterations;
+				cryptoInfo->bTrueCryptMode = truecryptMode;
 
 				// Init the cipher with the decrypted master key
 				status = EAInit (cryptoInfo->ea, keyInfo.master_keydata + primaryKeyOffset, cryptoInfo->ks);
@@ -513,15 +524,6 @@ KeyReady:	;
 
 				switch (cryptoInfo->mode)
 				{
-				case LRW:
-				case CBC:
-				case INNER_CBC:
-				case OUTER_CBC:
-
-					// For LRW (deprecated/legacy), the tweak key
-					// For CBC (deprecated/legacy), the IV/whitening seed
-					memcpy (cryptoInfo->k2, keyInfo.master_keydata, LEGACY_VOL_IV_SIZE);
-					break;
 
 				default:
 					// The secondary master key (if cascade, multiple concatenated)
@@ -558,7 +560,7 @@ ret:
 	VirtualUnlock (&dk, sizeof (dk));
 #endif
 
-	if (encryptionThreadCount > 1)
+	if ((selected_pkcs5_prf == 0) && (encryptionThreadCount > 1))
 	{
 		TC_WAIT_EVENT (noOutstandingWorkItemEvent);
 
@@ -580,14 +582,12 @@ int ReadVolumeHeader (BOOL bBoot, char *header, Password *password, PCRYPTO_INFO
 {
 #ifdef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
 	char dk[32 * 2];			// 2 * 256-bit key
-	char masterKey[32 * 2];
 #else
 	char dk[32 * 2 * 3];		// 6 * 256-bit key
-	char masterKey[32 * 2 * 3];
 #endif
 
 	PCRYPTO_INFO cryptoInfo;
-	int status;
+	int status = ERR_SUCCESS;
 
 	if (retHeaderCryptoInfo != NULL)
 		cryptoInfo = retHeaderCryptoInfo;
@@ -595,32 +595,67 @@ int ReadVolumeHeader (BOOL bBoot, char *header, Password *password, PCRYPTO_INFO
 		cryptoInfo = *retInfo = crypto_open ();
 
 	// PKCS5 PRF
-	derive_key_ripemd160 (TRUE, password->Text, (int) password->Length, header + HEADER_SALT_OFFSET,
-		PKCS5_SALT_SIZE, 32767, dk, sizeof (dk));
+#ifdef TC_WINDOWS_BOOT_SHA2
+	derive_key_sha256 (password->Text, (int) password->Length, header + HEADER_SALT_OFFSET,
+		PKCS5_SALT_SIZE, bBoot, dk, sizeof (dk));
+#else
+	derive_key_ripemd160 (password->Text, (int) password->Length, header + HEADER_SALT_OFFSET,
+		PKCS5_SALT_SIZE, bBoot, dk, sizeof (dk));
+#endif
 
 	// Mode of operation
 	cryptoInfo->mode = FIRST_MODE_OF_OPERATION_ID;
 
+#ifdef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
+	cryptoInfo->ea = 1;
+#else
 	// Test all available encryption algorithms
 	for (cryptoInfo->ea = EAGetFirst (); cryptoInfo->ea != 0; cryptoInfo->ea = EAGetNext (cryptoInfo->ea))
+#endif
 	{
+#ifdef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
+	#if defined (TC_WINDOWS_BOOT_SERPENT)
+		serpent_set_key (dk, cryptoInfo->ks);
+	#elif defined (TC_WINDOWS_BOOT_TWOFISH)
+		twofish_set_key ((TwofishInstance *) cryptoInfo->ks, (const u4byte *) dk);
+	#else
+		status = EAInit (dk, cryptoInfo->ks);
+		if (status == ERR_CIPHER_INIT_FAILURE)
+			goto err;
+	#endif
+#else
 		status = EAInit (cryptoInfo->ea, dk, cryptoInfo->ks);
 		if (status == ERR_CIPHER_INIT_FAILURE)
 			goto err;
-
+#endif
 		// Secondary key schedule
+#ifdef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
+	#if defined (TC_WINDOWS_BOOT_SERPENT)
+		serpent_set_key (dk + 32, cryptoInfo->ks2);
+	#elif defined (TC_WINDOWS_BOOT_TWOFISH)
+		twofish_set_key ((TwofishInstance *)cryptoInfo->ks2, (const u4byte *) (dk + 32));
+	#else
+		EAInit (dk + 32, cryptoInfo->ks2);
+	#endif
+#else
 		EAInit (cryptoInfo->ea, dk + EAGetKeySize (cryptoInfo->ea), cryptoInfo->ks2);
+#endif
 
 		// Try to decrypt header 
 		DecryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, cryptoInfo);
 		
-		// Check magic 'TRUE' and CRC-32 of header fields and master keydata
+		// Check magic 'VERA' and CRC-32 of header fields and master keydata
 		if (GetHeaderField32 (header, TC_HEADER_OFFSET_MAGIC) != 0x56455241
 			|| (GetHeaderField16 (header, TC_HEADER_OFFSET_VERSION) >= 4 && GetHeaderField32 (header, TC_HEADER_OFFSET_HEADER_CRC) != GetCrc32 (header + TC_HEADER_OFFSET_MAGIC, TC_HEADER_OFFSET_HEADER_CRC - TC_HEADER_OFFSET_MAGIC))
 			|| GetHeaderField32 (header, TC_HEADER_OFFSET_KEY_AREA_CRC) != GetCrc32 (header + HEADER_MASTER_KEYDATA_OFFSET, MASTER_KEYDATA_SIZE))
 		{
 			EncryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, cryptoInfo);
+#ifdef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
+			status = ERR_PASSWORD_WRONG;
+			goto err;
+#else
 			continue;
+#endif
 		}
 
 		// Header decrypted
@@ -640,19 +675,47 @@ int ReadVolumeHeader (BOOL bBoot, char *header, Password *password, PCRYPTO_INFO
 		// Flags
 		cryptoInfo->HeaderFlags = GetHeaderField32 (header, TC_HEADER_OFFSET_FLAGS);
 
-		memcpy (masterKey, header + HEADER_MASTER_KEYDATA_OFFSET, sizeof (masterKey));
+#ifdef TC_WINDOWS_BOOT_SHA2
+		cryptoInfo->pkcs5 = SHA256;
+#else
+		cryptoInfo->pkcs5 = RIPEMD160;
+#endif
+
+		memcpy (dk, header + HEADER_MASTER_KEYDATA_OFFSET, sizeof (dk));
 		EncryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, cryptoInfo);
 
 		if (retHeaderCryptoInfo)
 			goto ret;
 
 		// Init the encryption algorithm with the decrypted master key
-		status = EAInit (cryptoInfo->ea, masterKey, cryptoInfo->ks);
+#ifdef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
+	#if defined (TC_WINDOWS_BOOT_SERPENT)
+		serpent_set_key (dk, cryptoInfo->ks);
+	#elif defined (TC_WINDOWS_BOOT_TWOFISH)
+		twofish_set_key ((TwofishInstance *) cryptoInfo->ks, (const u4byte *) dk);
+	#else
+		status = EAInit (dk, cryptoInfo->ks);
 		if (status == ERR_CIPHER_INIT_FAILURE)
 			goto err;
+	#endif
+#else
+		status = EAInit (cryptoInfo->ea, dk, cryptoInfo->ks);
+		if (status == ERR_CIPHER_INIT_FAILURE)
+			goto err;
+#endif
 
 		// The secondary master key (if cascade, multiple concatenated)
-		EAInit (cryptoInfo->ea, masterKey + EAGetKeySize (cryptoInfo->ea), cryptoInfo->ks2);
+#ifdef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
+	#if defined (TC_WINDOWS_BOOT_SERPENT)
+		serpent_set_key (dk + 32, cryptoInfo->ks2);
+	#elif defined (TC_WINDOWS_BOOT_TWOFISH)
+		twofish_set_key ((TwofishInstance *)cryptoInfo->ks2, (const u4byte *) (dk + 32));
+	#else
+		EAInit (dk + 32, cryptoInfo->ks2);
+	#endif
+#else
+		EAInit (cryptoInfo->ea, dk + EAGetKeySize (cryptoInfo->ea), cryptoInfo->ks2);
+#endif
 		goto ret;
 	}
 
@@ -667,7 +730,6 @@ err:
 
 ret:
 	burn (dk, sizeof(dk));
-	burn (masterKey, sizeof(masterKey));
 	return status;
 }
 
@@ -682,7 +744,7 @@ ret:
 #endif
 
 // Creates a volume header in memory
-int CreateVolumeHeaderInMemory (BOOL bBoot, char *header, int ea, int mode, Password *password,
+int CreateVolumeHeaderInMemory (HWND hwndDlg, BOOL bBoot, char *header, int ea, int mode, Password *password,
 		   int pkcs5_prf, char *masterKeydata, PCRYPTO_INFO *retInfo,
 		   unsigned __int64 volumeSize, unsigned __int64 hiddenVolumeSize,
 		   unsigned __int64 encryptedAreaStart, unsigned __int64 encryptedAreaLength, uint16 requiredProgramVersion, uint32 headerFlags, uint32 sectorSize, BOOL bWipeMode)
@@ -715,24 +777,12 @@ int CreateVolumeHeaderInMemory (BOOL bBoot, char *header, int ea, int mode, Pass
 
 		switch (mode)
 		{
-		case LRW:
-		case CBC:
-		case INNER_CBC:
-		case OUTER_CBC:
-
-			// Deprecated/legacy modes of operation
-			bytesNeeded = LEGACY_VOL_IV_SIZE + EAGetKeySize (ea);
-
-			// In fact, this should never be the case since volumes being newly created are not
-			// supposed to use any deprecated mode of operation.
-			TC_THROW_FATAL_EXCEPTION;
-			break;
 
 		default:
 			bytesNeeded = EAGetKeySize (ea) * 2;	// Size of primary + secondary key(s)
 		}
 
-		if (!RandgetBytes (keyInfo.master_keydata, bytesNeeded, TRUE))
+		if (!RandgetBytes (hwndDlg, keyInfo.master_keydata, bytesNeeded, TRUE))
 			return ERR_CIPHER_INIT_WEAK_KEY;
 	}
 	else
@@ -744,16 +794,20 @@ int CreateVolumeHeaderInMemory (BOOL bBoot, char *header, int ea, int mode, Pass
 	// User key 
 	memcpy (keyInfo.userKey, password->Text, nUserKeyLen);
 	keyInfo.keyLength = nUserKeyLen;
-	keyInfo.noIterations = get_pkcs5_iteration_count (pkcs5_prf, bBoot);
+	keyInfo.noIterations = get_pkcs5_iteration_count (pkcs5_prf, FALSE, bBoot);
 
 	// User selected encryption algorithm
 	cryptoInfo->ea = ea;
 
+	// User selected PRF
+	cryptoInfo->pkcs5 = pkcs5_prf;
+	cryptoInfo->bTrueCryptMode = FALSE;
+
 	// Mode of operation
 	cryptoInfo->mode = mode;
 
 	// Salt for header key derivation
-	if (!RandgetBytes (keyInfo.salt, PKCS5_SALT_SIZE, !bWipeMode))
+	if (!RandgetBytes (hwndDlg, keyInfo.salt, PKCS5_SALT_SIZE, !bWipeMode))
 		return ERR_CIPHER_INIT_WEAK_KEY; 
 
 	// PBKDF2 (PKCS5) is used to derive primary header key(s) and secondary header key(s) (XTS) from the password/keyfiles
@@ -764,14 +818,13 @@ int CreateVolumeHeaderInMemory (BOOL bBoot, char *header, int ea, int mode, Pass
 			PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
 		break;
 
-	case SHA1:
-		// Deprecated/legacy
-		derive_key_sha1 (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
+	case SHA256:
+		derive_key_sha256 (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
 			PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
 		break;
 
 	case RIPEMD160:
-		derive_key_ripemd160 (TRUE, keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
+		derive_key_ripemd160 (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
 			PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
 		break;
 
@@ -853,16 +906,6 @@ int CreateVolumeHeaderInMemory (BOOL bBoot, char *header, int ea, int mode, Pass
 
 	switch (mode)
 	{
-	case LRW:
-	case CBC:
-	case INNER_CBC:
-	case OUTER_CBC:
-
-		// For LRW (deprecated/legacy), the tweak key
-		// For CBC (deprecated/legacy), the IV/whitening seed
-		memcpy (cryptoInfo->k2, dk, LEGACY_VOL_IV_SIZE);
-		primaryKeyOffset = LEGACY_VOL_IV_SIZE;
-		break;
 
 	default:
 		// The secondary key (if cascade, multiple concatenated)
@@ -896,15 +939,6 @@ int CreateVolumeHeaderInMemory (BOOL bBoot, char *header, int ea, int mode, Pass
 
 	switch (cryptoInfo->mode)
 	{
-	case LRW:
-	case CBC:
-	case INNER_CBC:
-	case OUTER_CBC:
-
-		// For LRW (deprecated/legacy), the tweak key
-		// For CBC (deprecated/legacy), the IV/whitening seed
-		memcpy (cryptoInfo->k2, keyInfo.master_keydata, LEGACY_VOL_IV_SIZE);
-		break;
 
 	default:
 		// The secondary master key (if cascade, multiple concatenated)
@@ -934,16 +968,16 @@ int CreateVolumeHeaderInMemory (BOOL bBoot, char *header, int ea, int mode, Pass
 		for (i = 0; i < j; i++)
 		{
 			char tmp2[8] = {0};
-			sprintf (tmp2, "%02X", (int) (unsigned char) keyInfo.master_keydata[i + primaryKeyOffset]);
-			strcat (MasterKeyGUIView, tmp2);
+			StringCbPrintfA (tmp2, sizeof(tmp2), "%02X", (int) (unsigned char) keyInfo.master_keydata[i + primaryKeyOffset]);
+			StringCbCatA (MasterKeyGUIView, sizeof(MasterKeyGUIView), tmp2);
 		}
 
 		HeaderKeyGUIView[0] = 0;
 		for (i = 0; i < NBR_KEY_BYTES_TO_DISPLAY; i++)
 		{
 			char tmp2[8];
-			sprintf (tmp2, "%02X", (int) (unsigned char) dk[primaryKeyOffset + i]);
-			strcat (HeaderKeyGUIView, tmp2);
+			StringCbPrintfA (tmp2, sizeof(tmp2), "%02X", (int) (unsigned char) dk[primaryKeyOffset + i]);
+			StringCbCatA (HeaderKeyGUIView, sizeof(HeaderKeyGUIView), tmp2);
 		}
 
 		if (dots3)
@@ -1068,7 +1102,7 @@ BOOL WriteEffectiveVolumeHeader (BOOL device, HANDLE fileHandle, byte *header)
 // Writes randomly generated data to unused/reserved header areas.
 // When bPrimaryOnly is TRUE, then only the primary header area (not the backup header area) is filled with random data.
 // When bBackupOnly is TRUE, only the backup header area (not the primary header area) is filled with random data.
-int WriteRandomDataToReservedHeaderAreas (HANDLE dev, CRYPTO_INFO *cryptoInfo, uint64 dataAreaSize, BOOL bPrimaryOnly, BOOL bBackupOnly)
+int WriteRandomDataToReservedHeaderAreas (HWND hwndDlg, HANDLE dev, CRYPTO_INFO *cryptoInfo, uint64 dataAreaSize, BOOL bPrimaryOnly, BOOL bBackupOnly)
 {
 	char temporaryKey[MASTER_KEYDATA_SIZE];
 	char originalK2[MASTER_KEYDATA_SIZE];
@@ -1089,8 +1123,8 @@ int WriteRandomDataToReservedHeaderAreas (HANDLE dev, CRYPTO_INFO *cryptoInfo, u
 	while (TRUE)
 	{
 		// Temporary keys
-		if (!RandgetBytes (temporaryKey, EAGetKeySize (cryptoInfo->ea), FALSE)
-			|| !RandgetBytes (cryptoInfo->k2, sizeof (cryptoInfo->k2), FALSE))
+		if (!RandgetBytes (hwndDlg, temporaryKey, EAGetKeySize (cryptoInfo->ea), FALSE)
+			|| !RandgetBytes (hwndDlg, cryptoInfo->k2, sizeof (cryptoInfo->k2), FALSE))
 		{
 			nStatus = ERR_PARAMETER_INCORRECT; 
 			goto final_seq;

src/Common/Volumes.h

@@ -21,11 +21,11 @@ extern "C" {
 
 // Version number written to volume header during format;
 // specifies the minimum program version required to mount the volume
-#define TC_VOLUME_MIN_REQUIRED_PROGRAM_VERSION	0x0100
+#define TC_VOLUME_MIN_REQUIRED_PROGRAM_VERSION	0x010b
 
 // Version number written (encrypted) to the key data area of an encrypted system partition/drive;
 // specifies the minimum program version required to decrypt the system partition/drive
-#define TC_SYSENC_KEYSCOPE_MIN_REQ_PROG_VERSION	0x0100
+#define TC_SYSENC_KEYSCOPE_MIN_REQ_PROG_VERSION	0x010b
 
 // Current volume format version (created by TrueCrypt 6.0+)
 #define TC_VOLUME_FORMAT_VERSION				2
@@ -126,13 +126,17 @@ extern BOOL ReadVolumeHeaderRecoveryMode;
 uint16 GetHeaderField16 (byte *header, int offset);
 uint32 GetHeaderField32 (byte *header, int offset);
 UINT64_STRUCT GetHeaderField64 (byte *header, int offset);
+#ifdef TC_WINDOWS_BOOT
 int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, PCRYPTO_INFO *retInfo, CRYPTO_INFO *retHeaderCryptoInfo);
+#else
+int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, int pkcs5_prf, BOOL truecryptMode, PCRYPTO_INFO *retInfo, CRYPTO_INFO *retHeaderCryptoInfo);
+#endif
 
 #if !defined (DEVICE_DRIVER) && !defined (TC_WINDOWS_BOOT)
-int CreateVolumeHeaderInMemory (BOOL bBoot, char *encryptedHeader, int ea, int mode, Password *password, int pkcs5_prf, char *masterKeydata, PCRYPTO_INFO *retInfo, unsigned __int64 volumeSize, unsigned __int64 hiddenVolumeSize, unsigned __int64 encryptedAreaStart, unsigned __int64 encryptedAreaLength, uint16 requiredProgramVersion, uint32 headerFlags, uint32 sectorSize, BOOL bWipeMode);
+int CreateVolumeHeaderInMemory (HWND hwndDlg, BOOL bBoot, char *encryptedHeader, int ea, int mode, Password *password, int pkcs5_prf, char *masterKeydata, PCRYPTO_INFO *retInfo, unsigned __int64 volumeSize, unsigned __int64 hiddenVolumeSize, unsigned __int64 encryptedAreaStart, unsigned __int64 encryptedAreaLength, uint16 requiredProgramVersion, uint32 headerFlags, uint32 sectorSize, BOOL bWipeMode);
 BOOL ReadEffectiveVolumeHeader (BOOL device, HANDLE fileHandle, byte *header, DWORD *bytesRead);
 BOOL WriteEffectiveVolumeHeader (BOOL device, HANDLE fileHandle, byte *header);
-int WriteRandomDataToReservedHeaderAreas (HANDLE dev, CRYPTO_INFO *cryptoInfo, uint64 dataAreaSize, BOOL bPrimaryOnly, BOOL bBackupOnly);
+int WriteRandomDataToReservedHeaderAreas (HWND hwndDlg, HANDLE dev, CRYPTO_INFO *cryptoInfo, uint64 dataAreaSize, BOOL bPrimaryOnly, BOOL bBackupOnly);
 #endif
 
 #endif // !TC_HEADER_Volume_VolumeHeader

src/Common/Wipe.c

@@ -155,11 +155,11 @@ int GetWipePassCount (WipeAlgorithmId algorithm)
 	case TC_WIPE_35_GUTMANN:
 		return 35;
 
-	default:
-		TC_THROW_FATAL_EXCEPTION;
+	case TC_WIPE_256:
+		return 256;
 	}
 
-	return 0;	// Prevent compiler warnings
+	return -1;	// Prevent compiler warnings
 }
 
 
@@ -168,6 +168,7 @@ BOOL WipeBuffer (WipeAlgorithmId algorithm, byte randChars[TC_WIPE_RAND_CHAR_COU
 	switch (algorithm)
 	{
 	case TC_WIPE_1_RAND:
+	case TC_WIPE_256:
 		return Wipe1PseudoRandom (pass, buffer, size);
 
 	case TC_WIPE_3_DOD_5220:
@@ -179,8 +180,14 @@ BOOL WipeBuffer (WipeAlgorithmId algorithm, byte randChars[TC_WIPE_RAND_CHAR_COU
 	case TC_WIPE_35_GUTMANN:
 		return Wipe35Gutmann (pass, buffer, size);
 
+	/* we will never reach here because all calls to WipeBuffer are preceeded
+	 * by a call to GetWipePassCount that already checks the same algorithm
+	 * parameters and in case of unsupported value an error is returned before
+	 * calling WipeBuffer
+	 */
+   /*
 	default:
-		TC_THROW_FATAL_EXCEPTION;
+		TC_THROW_FATAL_EXCEPTION;*/
 	}
 
 	return FALSE;	// Prevent compiler warnings

src/Common/Wipe.h

@@ -24,7 +24,8 @@ typedef enum
 	TC_WIPE_1_RAND = 100,
 	TC_WIPE_3_DOD_5220 = 300,
 	TC_WIPE_7_DOD_5220 = 700,
-	TC_WIPE_35_GUTMANN = 3500
+	TC_WIPE_35_GUTMANN = 3500,
+	TC_WIPE_256 = 25600
 
 } WipeAlgorithmId;
 

src/Core/Core.h

@@ -0,0 +1,155 @@
+/*
+ Copyright (c) 2008 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_Core_Core
+#define TC_HEADER_Core_Core
+
+#include "CoreBase.h"
+
+namespace VeraCrypt
+{
+	extern auto_ptr <CoreBase> Core;
+	extern auto_ptr <CoreBase> CoreDirect;
+
+	class WaitThreadRoutine
+	{
+	public:
+		Exception* m_pException;
+		WaitThreadRoutine() : m_pException(NULL) {}
+		virtual ~WaitThreadRoutine() {if (m_pException) delete m_pException;}
+		bool HasException () { return m_pException != NULL;}
+		Exception* GetException () const { return m_pException;}
+		void Execute(void)
+		{
+			try
+			{
+				ExecutionCode();
+			}
+			catch(Exception& ex)
+			{
+				m_pException = ex.CloneNew();
+			}
+			catch(...)
+			{
+				m_pException = new UnknownException (SRC_POS);
+			}
+		}
+		virtual void ExecutionCode(void) = 0;
+	};
+
+	class MountThreadRoutine : public WaitThreadRoutine
+	{
+	public:
+		MountOptions& m_options;
+		shared_ptr <VolumeInfo> m_pVolume;
+		MountThreadRoutine(MountOptions &options) : m_options(options) {}
+		virtual ~MountThreadRoutine() { }
+		virtual void ExecutionCode(void) { m_pVolume = Core->MountVolume(m_options); }
+	};
+
+	class VolumeCreatorThreadRoutine : public WaitThreadRoutine
+	{
+	public:
+		shared_ptr <VolumeCreationOptions> m_options;
+		shared_ptr <VolumeCreator> m_pCreator;
+		VolumeCreatorThreadRoutine(shared_ptr <VolumeCreationOptions> options, shared_ptr <VolumeCreator> pCreator)
+			: m_options(options), m_pCreator(pCreator) {}
+		virtual ~VolumeCreatorThreadRoutine() { }
+		virtual void ExecutionCode(void) { m_pCreator->CreateVolume (m_options); }
+	};
+
+	class ChangePasswordThreadRoutine : public WaitThreadRoutine
+	{
+	public:
+		shared_ptr <VolumePath> m_volumePath;
+		bool m_preserveTimestamps;
+		shared_ptr <VolumePassword> m_password;
+		shared_ptr <Pkcs5Kdf> m_kdf;
+		bool m_truecryptMode;
+		shared_ptr <KeyfileList> m_keyfiles;
+		shared_ptr <VolumePassword> m_newPassword;
+		shared_ptr <KeyfileList> m_newKeyfiles;
+		shared_ptr <Pkcs5Kdf> m_newPkcs5Kdf;
+		int m_wipeCount;
+		ChangePasswordThreadRoutine(shared_ptr <VolumePath> volumePath, bool preserveTimestamps, shared_ptr <VolumePassword> password, shared_ptr <Pkcs5Kdf> kdf, bool truecryptMode, shared_ptr <KeyfileList> keyfiles, shared_ptr <VolumePassword> newPassword, shared_ptr <KeyfileList> newKeyfiles, shared_ptr <Pkcs5Kdf> newPkcs5Kdf, int wipeCount) : m_volumePath(volumePath), m_preserveTimestamps(preserveTimestamps), m_password(password), m_kdf(kdf), m_truecryptMode(truecryptMode), m_keyfiles(keyfiles), m_newPassword(newPassword), m_newKeyfiles(newKeyfiles), m_newPkcs5Kdf(newPkcs5Kdf), m_wipeCount(wipeCount)  {}
+		virtual ~ChangePasswordThreadRoutine() { }
+		virtual void ExecutionCode(void) { Core->ChangePassword(m_volumePath, m_preserveTimestamps, m_password, m_kdf, m_truecryptMode, m_keyfiles, m_newPassword, m_newKeyfiles, m_newPkcs5Kdf, m_wipeCount); }
+	};
+
+	class OpenVolumeThreadRoutine : public WaitThreadRoutine
+	{
+	public:
+		shared_ptr <VolumePath> m_volumePath;
+		bool m_preserveTimestamps;
+		shared_ptr <VolumePassword> m_password;
+		shared_ptr<Pkcs5Kdf> m_Kdf;
+		bool m_truecryptMode;
+		shared_ptr <KeyfileList> m_keyfiles;
+		VolumeProtection::Enum m_protection;
+		shared_ptr <VolumePassword> m_protectionPassword;
+		shared_ptr<Pkcs5Kdf> m_protectionKdf;
+		shared_ptr <KeyfileList> m_protectionKeyfiles;
+		bool m_sharedAccessAllowed;
+		VolumeType::Enum m_volumeType;
+		bool m_useBackupHeaders;
+		bool m_partitionInSystemEncryptionScope;
+		shared_ptr <Volume> m_pVolume;
+
+		OpenVolumeThreadRoutine(shared_ptr <VolumePath> volumePath, bool preserveTimestamps, shared_ptr <VolumePassword> password, shared_ptr<Pkcs5Kdf> Kdf, bool truecryptMode, shared_ptr <KeyfileList> keyfiles, VolumeProtection::Enum protection = VolumeProtection::None, shared_ptr <VolumePassword> protectionPassword = shared_ptr <VolumePassword> (), shared_ptr<Pkcs5Kdf> protectionKdf = shared_ptr<Pkcs5Kdf> (), shared_ptr <KeyfileList> protectionKeyfiles = shared_ptr <KeyfileList> (), bool sharedAccessAllowed = false, VolumeType::Enum volumeType = VolumeType::Unknown, bool useBackupHeaders = false, bool partitionInSystemEncryptionScope = false):
+		m_volumePath(volumePath), m_preserveTimestamps(preserveTimestamps), m_password(password), m_Kdf(Kdf), m_truecryptMode(truecryptMode), m_keyfiles(keyfiles),
+		m_protection(protection), m_protectionPassword(protectionPassword), m_protectionKdf(protectionKdf), m_protectionKeyfiles(protectionKeyfiles), m_sharedAccessAllowed(sharedAccessAllowed), m_volumeType(volumeType),m_useBackupHeaders(useBackupHeaders),
+		m_partitionInSystemEncryptionScope(partitionInSystemEncryptionScope) {}
+
+		~OpenVolumeThreadRoutine() {}
+
+		virtual void ExecutionCode(void) { m_pVolume = Core->OpenVolume(m_volumePath,m_preserveTimestamps,m_password,m_Kdf,m_truecryptMode,m_keyfiles, m_protection,m_protectionPassword,m_protectionKdf, m_protectionKeyfiles,m_sharedAccessAllowed,m_volumeType,m_useBackupHeaders, m_partitionInSystemEncryptionScope); }
+
+	};
+
+	class ReEncryptHeaderThreadRoutine : public WaitThreadRoutine
+	{
+	public:
+		const BufferPtr &m_newHeaderBuffer;
+		shared_ptr <VolumeHeader> m_header;
+		shared_ptr <VolumePassword> m_password;
+		shared_ptr <KeyfileList> m_keyfiles;
+		ReEncryptHeaderThreadRoutine(const BufferPtr &newHeaderBuffer, shared_ptr <VolumeHeader> header, shared_ptr <VolumePassword> password, shared_ptr <KeyfileList> keyfiles)
+			: m_newHeaderBuffer(newHeaderBuffer), m_header(header), m_password(password), m_keyfiles(keyfiles) {}
+		virtual ~ReEncryptHeaderThreadRoutine() { }
+		virtual void ExecutionCode(void) { Core->ReEncryptVolumeHeaderWithNewSalt (m_newHeaderBuffer, m_header, m_password, m_keyfiles); }
+	};
+
+	class DecryptThreadRoutine : public WaitThreadRoutine
+	{
+	public:
+		shared_ptr <VolumeHeader> m_pHeader;
+		const ConstBufferPtr &m_encryptedData;
+		const VolumePassword &m_password;
+		shared_ptr <Pkcs5Kdf> m_kdf;
+		bool m_truecryptMode;
+		const Pkcs5KdfList &m_keyDerivationFunctions;
+		const EncryptionAlgorithmList &m_encryptionAlgorithms;
+		const EncryptionModeList &m_encryptionModes;
+		bool m_bResult;
+		DecryptThreadRoutine(shared_ptr <VolumeHeader> header, const ConstBufferPtr &encryptedData, const VolumePassword &password, shared_ptr <Pkcs5Kdf> kdf, bool truecryptMode, const Pkcs5KdfList &keyDerivationFunctions, const EncryptionAlgorithmList &encryptionAlgorithms, const EncryptionModeList &encryptionModes)
+			: m_pHeader(header), m_encryptedData(encryptedData), m_password(password), m_kdf(kdf), m_truecryptMode(truecryptMode), m_keyDerivationFunctions(keyDerivationFunctions), m_encryptionAlgorithms(encryptionAlgorithms), m_encryptionModes(encryptionModes), m_bResult(false){}
+		virtual ~DecryptThreadRoutine() { }
+		virtual void ExecutionCode(void) { m_bResult = m_pHeader->Decrypt(m_encryptedData, m_password, m_kdf, m_truecryptMode, m_keyDerivationFunctions, m_encryptionAlgorithms, m_encryptionModes); }
+	};
+
+	class WaitThreadUI
+	{
+	public:
+		WaitThreadUI(WaitThreadRoutine* pRoutine): m_pRoutine(pRoutine) {}
+		virtual ~WaitThreadUI() {}
+		virtual void Run(void) { m_pRoutine->ExecutionCode();} 
+		WaitThreadRoutine* m_pRoutine;
+	};
+}
+
+#endif // TC_HEADER_Core_Core

src/Core/Core.make

@@ -0,0 +1,27 @@
+#
+# Copyright (c) 2008 TrueCrypt Developers Association. All rights reserved.
+#
+# Governed by the TrueCrypt License 3.0 the full text of which is contained in
+# the file License.txt included in TrueCrypt binary and source code distribution
+# packages.
+#
+
+OBJS :=
+OBJS += CoreBase.o
+OBJS += CoreException.o
+OBJS += FatFormatter.o
+OBJS += HostDevice.o
+OBJS += MountOptions.o
+OBJS += RandomNumberGenerator.o
+OBJS += VolumeCreator.o
+OBJS += Unix/CoreService.o
+OBJS += Unix/CoreServiceRequest.o
+OBJS += Unix/CoreServiceResponse.o
+OBJS += Unix/CoreUnix.o
+OBJS += Unix/$(PLATFORM)/Core$(PLATFORM).o
+OBJS += Unix/$(PLATFORM)/Core$(PLATFORM).o
+ifeq "$(PLATFORM)" "MacOSX"
+OBJS += Unix/FreeBSD/CoreFreeBSD.o
+endif
+
+include $(BUILD_INC)/Makefile.inc

src/Core/CoreBase.cpp

@@ -0,0 +1,287 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#include <set>
+
+#include "CoreBase.h"
+#include "RandomNumberGenerator.h"
+#include "Volume/Volume.h"
+
+namespace VeraCrypt
+{
+	CoreBase::CoreBase ()
+		: DeviceChangeInProgress (false)
+	{
+	}
+
+	CoreBase::~CoreBase ()
+	{
+	}
+
+	void CoreBase::ChangePassword (shared_ptr <Volume> openVolume, shared_ptr <VolumePassword> newPassword, shared_ptr <KeyfileList> newKeyfiles, shared_ptr <Pkcs5Kdf> newPkcs5Kdf, int wipeCount) const
+	{
+		if ((!newPassword || newPassword->Size() < 1) && (!newKeyfiles || newKeyfiles->empty()))
+			throw PasswordEmpty (SRC_POS);
+
+		if (!newPkcs5Kdf)
+		{
+			if (openVolume->GetPkcs5Kdf()->GetTrueCryptMode ())
+			{
+				newPkcs5Kdf.reset (openVolume->GetPkcs5Kdf()->Clone());
+				newPkcs5Kdf->SetTrueCryptMode (false);
+			}
+			else
+				newPkcs5Kdf = openVolume->GetPkcs5Kdf();
+		}
+
+		if ((openVolume->GetHeader()->GetFlags() & TC_HEADER_FLAG_ENCRYPTED_SYSTEM) != 0
+			&& openVolume->GetType() == VolumeType::Hidden
+			&& openVolume->GetPath().IsDevice())
+		{
+			throw EncryptedSystemRequired (SRC_POS);
+		}
+
+		RandomNumberGenerator::SetHash (newPkcs5Kdf->GetHash());
+
+		SecureBuffer newSalt (openVolume->GetSaltSize());
+		SecureBuffer newHeaderKey (VolumeHeader::GetLargestSerializedKeySize());
+
+		shared_ptr <VolumePassword> password (Keyfile::ApplyListToPassword (newKeyfiles, newPassword));
+
+		bool backupHeader = false;
+		while (true)
+		{
+			for (int i = 1; i <= wipeCount; i++)
+			{
+				if (i == wipeCount)
+					RandomNumberGenerator::GetData (newSalt);
+				else
+					RandomNumberGenerator::GetDataFast (newSalt);
+
+				newPkcs5Kdf->DeriveKey (newHeaderKey, *password, newSalt);
+
+				openVolume->ReEncryptHeader (backupHeader, newSalt, newHeaderKey, newPkcs5Kdf);
+				openVolume->GetFile()->Flush();
+			}
+
+			if (!openVolume->GetLayout()->HasBackupHeader() || backupHeader)
+				break;
+
+			backupHeader = true;
+		}
+	}
+		
+	void CoreBase::ChangePassword (shared_ptr <VolumePath> volumePath, bool preserveTimestamps, shared_ptr <VolumePassword> password, shared_ptr <Pkcs5Kdf> kdf, bool truecryptMode, shared_ptr <KeyfileList> keyfiles, shared_ptr <VolumePassword> newPassword, shared_ptr <KeyfileList> newKeyfiles, shared_ptr <Pkcs5Kdf> newPkcs5Kdf, int wipeCount) const
+	{
+		shared_ptr <Volume> volume = OpenVolume (volumePath, preserveTimestamps, password, kdf, truecryptMode, keyfiles);
+		ChangePassword (volume, newPassword, newKeyfiles, newPkcs5Kdf, wipeCount);
+	}
+
+	void CoreBase::CoalesceSlotNumberAndMountPoint (MountOptions &options) const
+	{
+		if (options.SlotNumber < GetFirstSlotNumber())
+		{
+			if (options.MountPoint && !options.MountPoint->IsEmpty())
+				options.SlotNumber = MountPointToSlotNumber (*options.MountPoint);
+			else
+				options.SlotNumber = GetFirstFreeSlotNumber();
+		}
+
+		if (!IsSlotNumberAvailable (options.SlotNumber))
+#ifdef TC_WINDOWS
+			throw DriveLetterUnavailable (SRC_POS);
+#else
+			throw VolumeSlotUnavailable (SRC_POS);
+#endif
+		if (!options.NoFilesystem && (!options.MountPoint || options.MountPoint->IsEmpty()))
+			options.MountPoint.reset (new DirectoryPath (SlotNumberToMountPoint (options.SlotNumber)));
+	}
+
+	void CoreBase::CreateKeyfile (const FilePath &keyfilePath) const
+	{
+		SecureBuffer keyfileBuffer (VolumePassword::MaxSize);
+		RandomNumberGenerator::GetData (keyfileBuffer);
+
+		File keyfile;
+		keyfile.Open (keyfilePath, File::CreateWrite);
+		keyfile.Write (keyfileBuffer);
+	}
+
+	VolumeSlotNumber CoreBase::GetFirstFreeSlotNumber (VolumeSlotNumber startFrom) const
+	{
+		if (startFrom < GetFirstSlotNumber())
+			startFrom = GetFirstSlotNumber();
+
+		set <VolumeSlotNumber> usedSlotNumbers;
+
+		foreach_ref (const VolumeInfo &volume, GetMountedVolumes())
+			usedSlotNumbers.insert (volume.SlotNumber);
+
+		for (VolumeSlotNumber slotNumber = startFrom; slotNumber <= GetLastSlotNumber(); ++slotNumber)
+		{
+			if (usedSlotNumbers.find (slotNumber) == usedSlotNumbers.end()
+				&& IsMountPointAvailable (SlotNumberToMountPoint (slotNumber)))
+				return slotNumber;
+		}
+#ifdef TC_WINDOWS
+		throw DriveLetterUnavailable (SRC_POS);
+#else
+		throw VolumeSlotUnavailable (SRC_POS);
+#endif
+	}
+
+	uint64 CoreBase::GetMaxHiddenVolumeSize (shared_ptr <Volume> outerVolume) const
+	{
+		uint32 sectorSize = outerVolume->GetSectorSize();
+
+		SecureBuffer bootSectorBuffer (sectorSize);
+		outerVolume->ReadSectors (bootSectorBuffer, 0);
+
+		int fatType;
+		byte *bootSector = bootSectorBuffer.Ptr(); 
+
+		if (memcmp (bootSector + 54, "FAT12", 5) == 0)
+			fatType = 12;
+		else if (memcmp (bootSector + 54, "FAT16", 5) == 0)
+			fatType = 16;
+		else if (memcmp (bootSector + 82, "FAT32", 5) == 0)
+			fatType = 32;
+		else
+			throw ParameterIncorrect (SRC_POS);
+
+		uint32 clusterSize = bootSector[13] * sectorSize;
+		uint32 reservedSectorCount = Endian::Little (*(uint16 *) (bootSector + 14));
+		uint32 fatCount = bootSector[16];
+
+		uint64 fatSectorCount;
+		if (fatType == 32)
+			fatSectorCount = Endian::Little (*(uint32 *) (bootSector + 36));
+		else
+			fatSectorCount = Endian::Little (*(uint16 *) (bootSector + 22));
+		uint64 fatSize = fatSectorCount * sectorSize;
+
+		uint64 fatStartOffset = reservedSectorCount * sectorSize;
+		uint64 dataAreaOffset = reservedSectorCount * sectorSize + fatSize * fatCount;
+
+		if (fatType < 32)
+			dataAreaOffset += Endian::Little (*(uint16 *) (bootSector + 17)) * 32;
+
+		SecureBuffer sector (sectorSize);
+
+		// Find last used cluster
+		for (uint64 readOffset = fatStartOffset + fatSize - sectorSize;
+			readOffset >= fatStartOffset;
+			readOffset -= sectorSize)
+		{
+			outerVolume->ReadSectors (sector, readOffset);
+
+			for (int offset = sectorSize - 4; offset >= 0; offset -= 4)
+			{
+				if (*(uint32 *) (sector.Ptr() + offset))
+				{
+					uint64 clusterNumber = readOffset - fatStartOffset + offset;
+
+					if (fatType == 12)
+						clusterNumber = (clusterNumber * 8) / 12;
+					else if (fatType == 16)
+						clusterNumber /= 2;
+					else if (fatType == 32)
+						clusterNumber /= 4;
+
+					uint64 maxSize = outerVolume->GetSize() - dataAreaOffset;
+
+					// Some FAT entries may span over sector boundaries
+					if (maxSize >= clusterSize)
+						maxSize -= clusterSize;
+
+					uint64 clusterOffset = clusterNumber * clusterSize;
+					if (maxSize < clusterOffset)
+						return 0;
+
+					return maxSize - clusterOffset;
+				}
+			}
+		}
+
+		return 0;
+	}
+
+	shared_ptr <VolumeInfo> CoreBase::GetMountedVolume (const VolumePath &volumePath) const
+	{
+		VolumeInfoList volumes = GetMountedVolumes (volumePath);
+		if (volumes.empty())
+			return shared_ptr <VolumeInfo> ();
+		else
+			return volumes.front();
+	}
+
+	shared_ptr <VolumeInfo> CoreBase::GetMountedVolume (VolumeSlotNumber slot) const
+	{
+		foreach (shared_ptr <VolumeInfo> volume, GetMountedVolumes())
+		{
+			if (volume->SlotNumber == slot)
+				return volume;
+		}
+
+		return shared_ptr <VolumeInfo> ();
+	}
+
+	bool CoreBase::IsSlotNumberAvailable (VolumeSlotNumber slotNumber) const
+	{
+		if (!IsMountPointAvailable (SlotNumberToMountPoint (slotNumber)))
+			return false;
+
+		foreach_ref (const VolumeInfo &volume, GetMountedVolumes())
+		{
+			if (volume.SlotNumber == slotNumber)
+				return false;
+		}
+
+		return true;
+	}
+
+	bool CoreBase::IsVolumeMounted (const VolumePath &volumePath) const
+	{
+		return GetMountedVolume (volumePath);
+	}
+
+	shared_ptr <Volume> CoreBase::OpenVolume (shared_ptr <VolumePath> volumePath, bool preserveTimestamps, shared_ptr <VolumePassword> password, shared_ptr<Pkcs5Kdf> kdf, bool truecryptMode, shared_ptr <KeyfileList> keyfiles, VolumeProtection::Enum protection, shared_ptr <VolumePassword> protectionPassword, shared_ptr<Pkcs5Kdf> protectionKdf, shared_ptr <KeyfileList> protectionKeyfiles, bool sharedAccessAllowed, VolumeType::Enum volumeType, bool useBackupHeaders, bool partitionInSystemEncryptionScope) const
+	{
+		make_shared_auto (Volume, volume);
+		volume->Open (*volumePath, preserveTimestamps, password, kdf, truecryptMode, keyfiles, protection, protectionPassword, protectionKdf, protectionKeyfiles, sharedAccessAllowed, volumeType, useBackupHeaders, partitionInSystemEncryptionScope);
+		return volume;
+	}
+	
+	void CoreBase::RandomizeEncryptionAlgorithmKey (shared_ptr <EncryptionAlgorithm> encryptionAlgorithm) const
+	{
+		SecureBuffer eaKey (encryptionAlgorithm->GetKeySize());
+		RandomNumberGenerator::GetData (eaKey);
+		encryptionAlgorithm->SetKey (eaKey);
+
+		SecureBuffer modeKey (encryptionAlgorithm->GetMode()->GetKeySize());
+		RandomNumberGenerator::GetData (modeKey);
+		encryptionAlgorithm->GetMode()->SetKey (modeKey);
+	}
+
+	void CoreBase::ReEncryptVolumeHeaderWithNewSalt (const BufferPtr &newHeaderBuffer, shared_ptr <VolumeHeader> header, shared_ptr <VolumePassword> password, shared_ptr <KeyfileList> keyfiles) const
+	{
+		shared_ptr <Pkcs5Kdf> pkcs5Kdf = header->GetPkcs5Kdf();
+
+		RandomNumberGenerator::SetHash (pkcs5Kdf->GetHash());
+
+		SecureBuffer newSalt (header->GetSaltSize());
+		SecureBuffer newHeaderKey (VolumeHeader::GetLargestSerializedKeySize());
+
+		shared_ptr <VolumePassword> passwordKey (Keyfile::ApplyListToPassword (keyfiles, password));
+
+		RandomNumberGenerator::GetData (newSalt);
+		pkcs5Kdf->DeriveKey (newHeaderKey, *passwordKey, newSalt);
+
+		header->EncryptNew (newHeaderBuffer, newSalt, newHeaderKey, pkcs5Kdf);
+	}
+}

src/Core/CoreBase.h

@@ -0,0 +1,99 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_Core_CoreBase
+#define TC_HEADER_Core_CoreBase
+
+#include "Platform/Platform.h"
+#include "Platform/Functor.h"
+#include "Platform/User.h"
+#include "Common/Crypto.h"
+#include "Volume/Keyfile.h"
+#include "Volume/VolumeInfo.h"
+#include "Volume/Volume.h"
+#include "Volume/VolumePassword.h"
+#include "CoreException.h"
+#include "HostDevice.h"
+#include "MountOptions.h"
+#include "VolumeCreator.h"
+
+namespace VeraCrypt
+{
+	class CoreBase
+	{
+	public:
+		virtual ~CoreBase ();
+
+		virtual void ChangePassword (shared_ptr <Volume> openVolume, shared_ptr <VolumePassword> newPassword, shared_ptr <KeyfileList> newKeyfiles, shared_ptr <Pkcs5Kdf> newPkcs5Kdf = shared_ptr <Pkcs5Kdf> (), int wipeCount = PRAND_HEADER_WIPE_PASSES) const;
+		virtual void ChangePassword (shared_ptr <VolumePath> volumePath, bool preserveTimestamps, shared_ptr <VolumePassword> password, shared_ptr <Pkcs5Kdf> kdf, bool truecryptMode, shared_ptr <KeyfileList> keyfiles, shared_ptr <VolumePassword> newPassword, shared_ptr <KeyfileList> newKeyfiles, shared_ptr <Pkcs5Kdf> newPkcs5Kdf = shared_ptr <Pkcs5Kdf> (), int wipeCount = PRAND_HEADER_WIPE_PASSES) const;
+		virtual void CheckFilesystem (shared_ptr <VolumeInfo> mountedVolume, bool repair = false) const = 0; 
+		virtual void CoalesceSlotNumberAndMountPoint (MountOptions &options) const;
+		virtual void CreateKeyfile (const FilePath &keyfilePath) const;
+		virtual void DismountFilesystem (const DirectoryPath &mountPoint, bool force) const = 0;
+		virtual shared_ptr <VolumeInfo> DismountVolume (shared_ptr <VolumeInfo> mountedVolume, bool ignoreOpenFiles = false, bool syncVolumeInfo = false) = 0;
+		virtual bool FilesystemSupportsLargeFiles (const FilePath &filePath) const = 0;
+		virtual DirectoryPath GetDeviceMountPoint (const DevicePath &devicePath) const = 0;
+		virtual uint32 GetDeviceSectorSize (const DevicePath &devicePath) const = 0;
+		virtual uint64 GetDeviceSize (const DevicePath &devicePath) const = 0;
+		virtual VolumeSlotNumber GetFirstFreeSlotNumber (VolumeSlotNumber startFrom = 0) const;
+		virtual VolumeSlotNumber GetFirstSlotNumber () const { return 1; }
+		virtual VolumeSlotNumber GetLastSlotNumber () const { return 64; }
+		virtual HostDeviceList GetHostDevices (bool pathListOnly = false) const = 0;
+		virtual FilePath GetApplicationExecutablePath () const { return ApplicationExecutablePath; }
+		virtual uint64 GetMaxHiddenVolumeSize (shared_ptr <Volume> outerVolume) const;
+		virtual int GetOSMajorVersion () const = 0;
+		virtual int GetOSMinorVersion () const = 0;
+		virtual shared_ptr <VolumeInfo> GetMountedVolume (const VolumePath &volumePath) const;
+		virtual shared_ptr <VolumeInfo> GetMountedVolume (VolumeSlotNumber slot) const;
+		virtual VolumeInfoList GetMountedVolumes (const VolumePath &volumePath = VolumePath()) const = 0;
+		virtual bool HasAdminPrivileges () const = 0;
+		virtual void Init () { }
+		virtual bool IsDeviceChangeInProgress () const { return DeviceChangeInProgress; }
+		virtual bool IsDevicePresent (const DevicePath &device) const = 0;
+		virtual bool IsInPortableMode () const = 0;
+		virtual bool IsMountPointAvailable (const DirectoryPath &mountPoint) const = 0;
+		virtual bool IsOSVersion (int major, int minor) const = 0;
+		virtual bool IsOSVersionLower (int major, int minor) const = 0;
+		virtual bool IsPasswordCacheEmpty () const = 0;
+		virtual bool IsSlotNumberAvailable (VolumeSlotNumber slotNumber) const;
+		virtual bool IsSlotNumberValid (VolumeSlotNumber slotNumber) const { return slotNumber >= GetFirstSlotNumber() && slotNumber <= GetLastSlotNumber(); }
+		virtual bool IsVolumeMounted (const VolumePath &volumePath) const;
+		virtual VolumeSlotNumber MountPointToSlotNumber (const DirectoryPath &mountPoint) const = 0;
+		virtual shared_ptr <VolumeInfo> MountVolume (MountOptions &options) = 0;
+		virtual shared_ptr <Volume> OpenVolume (shared_ptr <VolumePath> volumePath, bool preserveTimestamps, shared_ptr <VolumePassword> password, shared_ptr<Pkcs5Kdf> Kdf, bool truecryptMode, shared_ptr <KeyfileList> keyfiles, VolumeProtection::Enum protection = VolumeProtection::None, shared_ptr <VolumePassword> protectionPassword = shared_ptr <VolumePassword> (), shared_ptr<Pkcs5Kdf> protectionKdf = shared_ptr<Pkcs5Kdf> (), shared_ptr <KeyfileList> protectionKeyfiles = shared_ptr <KeyfileList> (), bool sharedAccessAllowed = false, VolumeType::Enum volumeType = VolumeType::Unknown, bool useBackupHeaders = false, bool partitionInSystemEncryptionScope = false) const;
+		virtual void RandomizeEncryptionAlgorithmKey (shared_ptr <EncryptionAlgorithm> encryptionAlgorithm) const;
+		virtual void ReEncryptVolumeHeaderWithNewSalt (const BufferPtr &newHeaderBuffer, shared_ptr <VolumeHeader> header, shared_ptr <VolumePassword> password, shared_ptr <KeyfileList> keyfiles) const;
+		virtual void SetAdminPasswordCallback (shared_ptr <GetStringFunctor> functor) { }
+		virtual void SetApplicationExecutablePath (const FilePath &path) { ApplicationExecutablePath = path; }
+		virtual void SetFileOwner (const FilesystemPath &path, const UserId &owner) const = 0;
+		virtual DirectoryPath SlotNumberToMountPoint (VolumeSlotNumber slotNumber) const = 0;
+		virtual void WipePasswordCache () const = 0;
+
+		Event VolumeDismountedEvent;
+		Event VolumeMountedEvent;
+		Event WarningEvent;
+
+	protected:
+		CoreBase ();
+
+		bool DeviceChangeInProgress;
+		FilePath ApplicationExecutablePath;
+
+	private:
+		CoreBase (const CoreBase &);
+		CoreBase &operator= (const CoreBase &);
+	};
+
+	struct VolumeEventArgs : EventArgs
+	{
+		VolumeEventArgs (shared_ptr <VolumeInfo> volume) : mVolume (volume) { }
+		shared_ptr <VolumeInfo> mVolume;
+	};
+}
+
+#endif // TC_HEADER_Core_CoreBase

src/Core/CoreException.cpp

@@ -0,0 +1,29 @@
+/*
+ Copyright (c) 2008 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#include "CoreException.h"
+#include "Platform/SerializerFactory.h"
+
+namespace VeraCrypt
+{
+	void ElevationFailed::Deserialize (shared_ptr <Stream> stream)
+	{
+		ExecutedProcessFailed::Deserialize (stream);
+	}
+
+	void ElevationFailed::Serialize (shared_ptr <Stream> stream) const
+	{
+		ExecutedProcessFailed::Serialize (stream);
+	}
+
+#define TC_EXCEPTION(TYPE) TC_SERIALIZER_FACTORY_ADD(TYPE)
+#undef TC_EXCEPTION_NODECL
+#define TC_EXCEPTION_NODECL(TYPE) TC_SERIALIZER_FACTORY_ADD(TYPE)
+
+	TC_SERIALIZER_FACTORY_ADD_EXCEPTION_SET (CoreException);
+}