MacOSX : Update Main Makefile to used the new package name that include the version.

src/Boot/Windows/BootCommon.h

@@ -13,7 +13,7 @@
 #include "BootDefs.h"
 
 // The user will be advised to upgrade the rescue disk if upgrading from the following or any previous version
-#define TC_RESCUE_DISK_UPGRADE_NOTICE_MAX_VERSION 0x060a
+#define TC_RESCUE_DISK_UPGRADE_NOTICE_MAX_VERSION 0x010a
 
 #define TC_BOOT_LOADER_AREA_SIZE (TC_BOOT_LOADER_AREA_SECTOR_COUNT * TC_SECTOR_SIZE_BIOS)
 

src/Boot/Windows/BootEncryptedIo.cpp

@@ -74,7 +74,7 @@ BiosResult ReadEncryptedSectors (uint16 destSegment, uint16 destOffset, byte dri
 
 BiosResult WriteEncryptedSectors (uint16 sourceSegment, uint16 sourceOffset, byte drive, uint64 sector, uint16 sectorCount)
 {
-	BiosResult result;
+	BiosResult result = BiosResultSuccess;
 	AcquireSectorBuffer();
 	uint64 dataUnitNo;
 	uint64 writeOffset;

src/Boot/Windows/BootMain.cpp

@@ -584,7 +584,7 @@ static bool CopySystemPartitionToHiddenVolume (byte drive, byte &exitKey)
 	sectorOffset.HighPart = 0;
 
 	int fragmentSectorCount = 0x7f; // Maximum safe value supported by BIOS
-	int statCount;
+	int statCount = 0;
 
 	if (!CheckMemoryRequirements ())
 		goto err;
@@ -709,7 +709,7 @@ static void DecryptDrive (byte drive)
 	uint64 sector = EncryptedVirtualPartition.EndSector + 1;
 
 	int fragmentSectorCount = 0x7f; // Maximum safe value supported by BIOS
-	int statCount;
+	int statCount = 0;
 
 	bool skipBadSectors = false;
 
@@ -1081,7 +1081,7 @@ void main ()
 	// Check whether the user is not using the Rescue Disk to create a hidden system
 
 	if (ReadWriteMBR (false, BootDrive, true) == BiosResultSuccess
-		&& *(uint32 *) (SectorBuffer + 6) == 0x65757254
+		&& *(uint32 *) (SectorBuffer + 6) == 0x61726556
 		&& *(uint32 *) (SectorBuffer + 10) == 0x70797243
 		&& (SectorBuffer[TC_BOOT_SECTOR_CONFIG_OFFSET] & TC_BOOT_CFG_MASK_HIDDEN_OS_CREATION_PHASE) != TC_HIDDEN_OS_CREATION_PHASE_NONE)
 	{

src/Build/Include/Makefile.inc

@@ -0,0 +1,65 @@
+#
+# Copyright (c) 2008 TrueCrypt Developers Association. All rights reserved.
+#
+# Governed by the TrueCrypt License 3.0 the full text of which is contained in
+# the file License.txt included in TrueCrypt binary and source code distribution
+# packages.
+#
+
+$(NAME): $(NAME).a
+
+clean:
+	@echo Cleaning $(NAME)
+	rm -f $(APPNAME) $(NAME).a $(OBJS) $(OBJSEX) $(OBJS:.o=.d) *.gch
+
+%.o: %.c
+	@echo Compiling $(<F)
+	$(CC) $(CFLAGS) -c $< -o $@
+
+%.o: %.cpp
+	@echo Compiling $(<F)
+	$(CXX) $(CXXFLAGS) -c $< -o $@
+
+ifeq "$(PLATFORM)" "MacOSX"
+%.o: %.asm
+	@echo Assembling $(<F)
+	$(AS) $(ASFLAGS) -f macho32 -o $@.32 $<
+	$(AS) $(ASFLAGS) -f macho64 -o $@.64 $<
+	lipo -create $@.32 $@.64 -output $@
+else
+%.o: %.asm
+	@echo Assembling $(<F)
+	$(AS) $(ASFLAGS) -o $@ $<
+endif
+
+# Precompiled headers
+%.h.gch: %.h
+	@echo Precompiling $(<F)
+	$(CXX) $(CXXFLAGS) -g0 -c $< || (rm -f $(<F).gch && exit 1)
+
+
+# Embedded files
+OD_BIN := od -v -t u1 -A n
+TR_SED_BIN := tr '\n' ' ' | tr -s ' ' ',' | sed -e 's/^,//g' -e 's/,$$/n/' | tr 'n' '\n'
+
+%.xml.h: %.xml
+	@echo Converting $(<F)
+	$(OD_BIN) $< | $(TR_SED_BIN) >$@
+
+%.txt.h: %.txt
+	@echo Converting $(<F)
+	$(OD_BIN) $< | $(TR_SED_BIN) >$@
+	
+%.bmp.h: %.bmp
+	@echo Converting $(<F)
+	$(OD_BIN) $< | $(TR_SED_BIN) >$@
+
+
+# Dependencies
+-include $(OBJS:.o=.d) $(OBJSEX:.oo=.d)
+
+
+$(NAME).a: $(OBJS) $(OBJSEX)
+	@echo Updating library $@
+	$(AR) $(AFLAGS) -rcu $@ $(OBJS) $(OBJSEX)
+	$(RANLIB) $@

src/Build/Resources/MacOSX/Info.plist.xml

@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist SYSTEM "file://localhost/System/Library/DTDs/PropertyList.dtd">
+<plist version="0.9">
+<dict>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+
+	<key>CFBundleIdentifier</key>
+	<string>org.idrix.VeraCrypt</string>
+
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+
+	<key>CFBundleExecutable</key>
+	<string>VeraCrypt</string>
+
+	<key>CFBundleIconFile</key>
+	<string>VeraCrypt.icns</string>
+
+	<key>CFBundleName</key>
+	<string>VeraCrypt</string>
+
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+
+	<key>CFBundleSignature</key>
+	<string>TRUE</string>
+
+	<key>CFBundleVersion</key>
+	<string>0</string>
+
+	<key>CFBundleShortVersionString</key>
+	<string>_VERSION_</string>
+
+	<key>CFBundleLongVersionString</key>
+	<string>VeraCrypt _VERSION_</string>
+
+	<key>LSRequiresCarbon</key>
+	<true/>
+
+	<key>CSResourcesFileMapped</key>
+	<true/>
+</dict>
+</plist>

src/Common/Apidrvr.h

@@ -133,10 +133,6 @@ typedef struct
 	BOOL readOnly;
 	BOOL removable;
 	BOOL partitionInInactiveSysEncScope;
-#if 0
-	unsigned __int64 volumeCreationTime;	// Deprecated in v6.0
-	unsigned __int64 headerCreationTime;	// Deprecated in v6.0
-#endif
 	uint32 volumeHeaderFlags;
 	unsigned __int64 totalBytesRead;
 	unsigned __int64 totalBytesWritten;

src/Common/BaseCom.cpp

@@ -15,7 +15,7 @@
 #include "Dlgcode.h"
 #include "Registry.h"
 
-using namespace TrueCrypt;
+using namespace VeraCrypt;
 
 HRESULT CreateElevatedComObject (HWND hwnd, REFGUID guid, REFIID iid, void **ppv)
 {
@@ -83,9 +83,8 @@ DWORD BaseCom::CallDriver (DWORD ioctl, BSTR input, BSTR *output)
 
 DWORD BaseCom::CopyFile (BSTR sourceFile, BSTR destinationFile)
 {
-	USES_CONVERSION;
 
-	if (!::CopyFile (CW2A (sourceFile), CW2A (destinationFile), FALSE))
+	if (!::CopyFileW (sourceFile, destinationFile, FALSE))
 		return GetLastError();
 
 	return ERROR_SUCCESS;
@@ -94,9 +93,8 @@ DWORD BaseCom::CopyFile (BSTR sourceFile, BSTR destinationFile)
 
 DWORD BaseCom::DeleteFile (BSTR file)
 {
-	USES_CONVERSION;
 
-	if (!::DeleteFile (CW2A (file)))
+	if (!::DeleteFileW (file))
 		return GetLastError();
 
 	return ERROR_SUCCESS;
@@ -112,10 +110,15 @@ BOOL BaseCom::IsPagingFileActive (BOOL checkNonWindowsPartitionsOnly)
 DWORD BaseCom::ReadWriteFile (BOOL write, BOOL device, BSTR filePath, BSTR *bufferBstr, unsigned __int64 offset, unsigned __int32 size, DWORD *sizeDone)
 {
 	USES_CONVERSION;
+	CW2A szFilePathA(filePath);
+	if (!szFilePathA.m_psz)
+	{
+		return ERROR_NOT_ENOUGH_MEMORY;
+	}
 
 	try
 	{
-		auto_ptr <File> file (device ? new Device (string (CW2A (filePath)), !write) : new File (string (CW2A (filePath)), !write));
+		auto_ptr <File> file (device ? new Device (string (szFilePathA.m_psz), !write) : new File (string (szFilePathA.m_psz), !write));
 		file->SeekAt (offset);
 
 		if (write)
@@ -223,8 +226,7 @@ DWORD BaseCom::SetDriverServiceStartType (DWORD startType)
 
 DWORD BaseCom::WriteLocalMachineRegistryDwordValue (BSTR keyPath, BSTR valueName, DWORD value)
 {
-	USES_CONVERSION;
-	if (!::WriteLocalMachineRegistryDword (CW2A (keyPath), CW2A (valueName), value))
+	if (!::WriteLocalMachineRegistryDwordW (keyPath, valueName, value))
 		return GetLastError();
 
 	return ERROR_SUCCESS;

src/Common/BootEncryption.cpp

@@ -32,7 +32,9 @@
 #include "Mount/MainCom.h"
 #endif
 
-namespace TrueCrypt
+#include <Strsafe.h>
+
+namespace VeraCrypt
 {
 #if !defined (SETUP)
 
@@ -375,6 +377,13 @@ namespace TrueCrypt
 		SelectedEncryptionAlgorithmId (0),
 		VolumeHeaderValid (false)
 	{
+      HiddenOSCandidatePartition.IsGPT = FALSE;
+      HiddenOSCandidatePartition.Number = (size_t) -1;
+      DriveConfig.DriveNumber = -1;
+      DriveConfig.ExtraBootPartitionPresent = false;
+      DriveConfig.SystemLoaderPresent = false;
+      DriveConfig.InitialUnallocatedSpace = 0;
+      DriveConfig.TotalUnallocatedSpace = 0;
 		Elevator::AddReference();
 	}
 
@@ -597,7 +606,7 @@ namespace TrueCrypt
 		GetSystemDriveConfiguration();
 
 		ProbeRealDriveSizeRequest request;
-		_snwprintf (request.DeviceName, array_capacity (request.DeviceName), L"%hs", DriveConfig.DrivePartition.DevicePath.c_str());
+		StringCbPrintfW (request.DeviceName, sizeof (request.DeviceName), L"%hs", DriveConfig.DrivePartition.DevicePath.c_str());
 		
 		CallDriver (TC_IOCTL_PROBE_REAL_DRIVE_SIZE, &request, sizeof (request), &request, sizeof (request));
 		DriveConfig.DrivePartition.Info.PartitionLength = request.RealDriveSize;
@@ -626,7 +635,7 @@ namespace TrueCrypt
 			partPath << "\\Device\\Harddisk" << driveNumber << "\\Partition" << partNumber;
 
 			DISK_PARTITION_INFO_STRUCT diskPartInfo;
-			_snwprintf (diskPartInfo.deviceName, array_capacity (diskPartInfo.deviceName), L"%hs", partPath.str().c_str());
+			StringCbPrintfW (diskPartInfo.deviceName, sizeof (diskPartInfo.deviceName), L"%hs", partPath.str().c_str());
 
 			try
 			{
@@ -656,7 +665,7 @@ namespace TrueCrypt
 
 			// Volume ID
 			wchar_t volumePath[TC_MAX_PATH];
-			if (ResolveSymbolicLink ((wchar_t *) ws.str().c_str(), volumePath))
+			if (ResolveSymbolicLink ((wchar_t *) ws.str().c_str(), volumePath, sizeof(volumePath)))
 			{
 				wchar_t volumeName[TC_MAX_PATH];
 				HANDLE fh = FindFirstVolumeW (volumeName, array_capacity (volumeName));
@@ -735,8 +744,8 @@ namespace TrueCrypt
 			memset (&openTestStruct, 0, sizeof (openTestStruct));
 			DWORD dwResult;
 
-			strcpy ((char *) &openTestStruct.wszFileName[0], devicePath);
-			ToUNICODE ((char *) &openTestStruct.wszFileName[0]);
+			StringCbCopyA ((char *) &openTestStruct.wszFileName[0], sizeof(openTestStruct.wszFileName),devicePath);
+			ToUNICODE ((char *) &openTestStruct.wszFileName[0], sizeof(openTestStruct.wszFileName));
 
 			openTestStruct.bDetectTCBootLoader = TRUE;
 
@@ -837,7 +846,7 @@ namespace TrueCrypt
 	bool BootEncryption::SystemDriveIsDynamic ()
 	{
 		GetSystemDriveConfigurationRequest request;
-		_snwprintf (request.DevicePath, array_capacity (request.DevicePath), L"%hs", GetSystemDriveConfiguration().DeviceKernelPath.c_str());
+		StringCbPrintfW (request.DevicePath, sizeof (request.DevicePath), L"%hs", GetSystemDriveConfiguration().DeviceKernelPath.c_str());
 
 		CallDriver (TC_IOCTL_GET_SYSTEM_DRIVE_CONFIG, &request, sizeof (request), &request, sizeof (request));
 		return request.DriveIsDynamic ? true : false;
@@ -1088,7 +1097,7 @@ namespace TrueCrypt
 			throw ParameterIncorrect (SRC_POS);
 
 		GetSystemDriveConfigurationRequest request;
-		_snwprintf (request.DevicePath, array_capacity (request.DevicePath), L"%hs", GetSystemDriveConfiguration().DeviceKernelPath.c_str());
+		StringCbPrintfW (request.DevicePath, sizeof (request.DevicePath), L"%hs", GetSystemDriveConfiguration().DeviceKernelPath.c_str());
 
 		try
 		{
@@ -1395,8 +1404,10 @@ namespace TrueCrypt
 		memset (image, 0, RescueIsoImageSize);
 
 		// Primary volume descriptor
-		strcpy ((char *)image + 0x8000, "\001CD001\001");
-		strcpy ((char *)image + 0x7fff + 41, "VeraCrypt Rescue Disk           ");
+		const char* szPrimVolDesc = "\001CD001\001";
+		const char* szPrimVolLabel = "VeraCrypt Rescue Disk           ";
+		memcpy (image + 0x8000, szPrimVolDesc, strlen(szPrimVolDesc) + 1);
+		memcpy (image + 0x7fff + 41, szPrimVolLabel, strlen(szPrimVolLabel) + 1);
 		*(uint32 *) (image + 0x7fff + 81) = RescueIsoImageSize / 2048;
 		*(uint32 *) (image + 0x7fff + 85) = BE32 (RescueIsoImageSize / 2048);
 		image[0x7fff + 121] = 1;
@@ -1413,11 +1424,13 @@ namespace TrueCrypt
 		image[0x7fff + 159] = 0x18;
 
 		// Boot record volume descriptor
-		strcpy ((char *)image + 0x8801, "CD001\001EL TORITO SPECIFICATION");
+		const char* szBootRecDesc = "CD001\001EL TORITO SPECIFICATION";
+		memcpy (image + 0x8801, szBootRecDesc, strlen(szBootRecDesc) + 1);
 		image[0x8800 + 0x47] = 0x19;
 
 		// Volume descriptor set terminator
-		strcpy ((char *)image + 0x9000, "\377CD001\001");
+		const char* szVolDescTerm = "\377CD001\001";
+		memcpy (image + 0x9000, szVolDescTerm, strlen(szVolDescTerm) + 1);
 
 		// Path table
 		image[0xA000 + 0] = 1;
@@ -1715,7 +1728,7 @@ namespace TrueCrypt
 			DWORD size = sizeof (regKeyBuf) - strSize;
 
 			// SetupInstallFromInfSection() does not support prepending of values so we have to modify the registry directly
-			strncpy ((char *) regKeyBuf, filter.c_str(), sizeof (regKeyBuf));
+			StringCbCopyA ((char *) regKeyBuf, sizeof(regKeyBuf), filter.c_str());
 
 			if (RegQueryValueEx (regKey, filterReg.c_str(), NULL, NULL, regKeyBuf + strSize, &size) != ERROR_SUCCESS)
 				size = 1;
@@ -2047,7 +2060,7 @@ namespace TrueCrypt
 	}
 
 
-	int BootEncryption::ChangePassword (Password *oldPassword, Password *newPassword, int pkcs5)
+	int BootEncryption::ChangePassword (Password *oldPassword, Password *newPassword, int pkcs5, int wipePassCount)
 	{
 		BootEncryptionStatus encStatus = GetStatus();
 
@@ -2112,7 +2125,7 @@ namespace TrueCrypt
 		UserEnrichRandomPool (ParentWindow);
 		WaitCursor();
 
-		/* The header will be re-encrypted PRAND_DISK_WIPE_PASSES times to prevent adversaries from using 
+		/* The header will be re-encrypted wipePassCount times to prevent adversaries from using 
 		techniques such as magnetic force microscopy or magnetic force scanning tunnelling microscopy
 		to recover the overwritten header. According to Peter Gutmann, data should be overwritten 22
 		times (ideally, 35 times) using non-random patterns and pseudorandom data. However, as users might
@@ -2132,7 +2145,7 @@ namespace TrueCrypt
 			BOOL backupHeader = FALSE;
 			while (TRUE)
 			{
-				for (int wipePass = 0; wipePass < PRAND_DISK_WIPE_PASSES; wipePass++)
+				for (int wipePass = 0; wipePass < wipePassCount; wipePass++)
 				{
 					PCRYPTO_INFO tmpCryptoInfo = NULL;
 
@@ -2151,7 +2164,7 @@ namespace TrueCrypt
 						cryptoInfo->RequiredProgramVersion,
 						cryptoInfo->HeaderFlags | TC_HEADER_FLAG_ENCRYPTED_SYSTEM,
 						cryptoInfo->SectorSize,
-						wipePass < PRAND_DISK_WIPE_PASSES - 1);
+						wipePass < wipePassCount - 1);
 
 					if (tmpCryptoInfo)
 						crypto_close (tmpCryptoInfo);
@@ -2311,7 +2324,7 @@ namespace TrueCrypt
 	void BootEncryption::RestrictPagingFilesToSystemPartition ()
 	{
 		char pagingFiles[128];
-		strncpy (pagingFiles, "X:\\pagefile.sys 0 0", sizeof (pagingFiles));
+		StringCbCopyA (pagingFiles, sizeof(pagingFiles), "X:\\pagefile.sys 0 0");
 		pagingFiles[0] = GetWindowsDirectory()[0];
 
 		throw_sys_if (!WriteLocalMachineRegistryMultiString ("System\\CurrentControlSet\\Control\\Session Manager\\Memory Management", "PagingFiles", pagingFiles, strlen (pagingFiles) + 2));

src/Common/BootEncryption.h

@@ -17,12 +17,12 @@
 
 using namespace std;
 
-namespace TrueCrypt
+namespace VeraCrypt
 {
 	class File
 	{
 	public:
-		File () : FileOpen (false) { }
+		File () : Elevated (false), FileOpen (false), FilePointerPosition(0), Handle(NULL), IsDevice(false) { }
 		File (string path, bool readOnly = false, bool create = false);
 		~File () { Close(); }
 
@@ -141,7 +141,7 @@ namespace TrueCrypt
 		void AbortSetup ();
 		void AbortSetupWait ();
 		void CallDriver (DWORD ioctl, void *input = nullptr, DWORD inputSize = 0, void *output = nullptr, DWORD outputSize = 0);
-		int ChangePassword (Password *oldPassword, Password *newPassword, int pkcs5);
+		int ChangePassword (Password *oldPassword, Password *newPassword, int pkcs5, int wipePassCount);
 		void CheckDecoyOSWipeResult ();
 		void CheckEncryptionSetupResult ();
 		void CheckRequirements ();

src/Common/Cmdline.c

@@ -20,6 +20,7 @@
 #include "Apidrvr.h"
 #include "Dlgcode.h"
 #include "Language.h"
+#include <Strsafe.h>
 
 /* Except in response to the WM_INITDIALOG message, the dialog box procedure
    should return nonzero if it processes the message, and zero if it does
@@ -44,17 +45,19 @@ BOOL CALLBACK CommandHelpDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM
 
 		*tmp = 0;
 
-		strcpy (tmp, "Command line options:\n\n");
+		StringCbCopyA (tmp, 8192, "Command line options:\n\n");
 		for (i = 0; i < as->arg_cnt; i ++)
 		{
 			if (!as->args[i].Internal)
 			{
-				sprintf(tmp2, "%s\t%s\n", as->args[i].short_name, as->args[i].long_name);
-				strcat(tmp,tmp2);
+				StringCchPrintf(tmp2, MAX_PATH * 2, "%s\t%s\n", as->args[i].short_name, as->args[i].long_name);
+				StringCchCat(tmp, 8192, tmp2);
 			}
 		}
 
 		SetWindowText (GetDlgItem (hwndDlg, IDC_COMMANDHELP_TEXT), (char*) tmp);
+		
+		TCfree(tmp);
 		return 1;
 		}
 
@@ -218,7 +221,7 @@ int GetArgumentValue (char **lpszCommandLineArgs, int nArgPos, int *nArgIdx,
 	{
 		/* Handles the case of no space between parameter code and
 		   value */
-		strncpy (lpszValue, &lpszCommandLineArgs[*nArgIdx][nArgPos], nValueSize);
+		StringCbCopyA (lpszValue, nValueSize, &lpszCommandLineArgs[*nArgIdx][nArgPos]);
 		lpszValue[nValueSize - 1] = 0;
 		return HAS_ARGUMENT;
 	}
@@ -229,7 +232,7 @@ int GetArgumentValue (char **lpszCommandLineArgs, int nArgPos, int *nArgIdx,
 		{
 			/* Handles the case of space between parameter code
 			   and value */
-			strncpy (lpszValue, &lpszCommandLineArgs[*nArgIdx + 1][x], nValueSize);
+			StringCbCopyA (lpszValue, nValueSize, &lpszCommandLineArgs[*nArgIdx + 1][x]);
 			lpszValue[nValueSize - 1] = 0;
 			(*nArgIdx)++;
 			return HAS_ARGUMENT;

src/Common/Crypto.h

@@ -42,9 +42,6 @@ extern "C" {
 // Size of the volume header area containing concatenated master key(s) and secondary key(s) (XTS mode)
 #define MASTER_KEYDATA_SIZE			256
 
-// Size of the deprecated volume header item containing either an IV seed (CBC mode) or tweak key (LRW mode)
-#define LEGACY_VOL_IV_SIZE			32
-
 // The first PRF to try when mounting
 #define FIRST_PRF_ID		1	
 
@@ -55,7 +52,6 @@ enum
 #ifndef TC_WINDOWS_BOOT
 	SHA512,
 	WHIRLPOOL,
-	SHA1,				// Deprecated/legacy
 #endif
 	HASH_ENUM_END_ID
 };
@@ -66,9 +62,6 @@ enum
 #define RIPEMD160_BLOCKSIZE		64
 #define RIPEMD160_DIGESTSIZE	20
 
-#define SHA1_BLOCKSIZE			64	
-#define SHA1_DIGESTSIZE			20
-
 #define SHA512_BLOCKSIZE		128
 #define SHA512_DIGESTSIZE		64
 
@@ -89,12 +82,6 @@ enum
 	/* If you add/remove a mode, update the following: GetMaxPkcs5OutSize(), EAInitMode() */
 
 	XTS = FIRST_MODE_OF_OPERATION_ID,
-#ifndef TC_WINDOWS_BOOT
-	LRW,		// Deprecated/legacy
-	CBC,		// Deprecated/legacy
-	OUTER_CBC,	// Deprecated/legacy
-	INNER_CBC,	// Deprecated/legacy
-#endif
 	MODE_ENUM_END_ID
 };
 
@@ -115,12 +102,7 @@ enum
 	NONE = 0,
 	AES,
 	SERPENT,			
-	TWOFISH,			
-#ifndef TC_WINDOWS_BOOT
-	BLOWFISH,		// Deprecated/legacy
-	CAST,			// Deprecated/legacy
-	TRIPLEDES		// Deprecated/legacy
-#endif
+	TWOFISH
 };
 
 typedef struct
@@ -177,6 +159,9 @@ typedef struct
 #	define PRAND_DISK_WIPE_PASSES	256
 #endif
 
+/* specific value for volume header wipe used only when drive is fully wiped. */
+#define PRAND_HEADER_WIPE_PASSES	3
+
 #if !defined (TC_WINDOWS_BOOT) || defined (TC_WINDOWS_BOOT_AES)
 #	include "Aes.h"
 #else
@@ -184,15 +169,11 @@ typedef struct
 #endif
 
 #include "Aes_hw_cpu.h"
-#include "Blowfish.h"
-#include "Cast.h"
-#include "Des.h"
 #include "Serpent.h"
 #include "Twofish.h"
 
 #include "Rmd160.h"
 #ifndef TC_WINDOWS_BOOT
-#	include "Sha1.h"
 #	include "Sha2.h"
 #	include "Whirlpool.h"
 #endif
@@ -269,7 +250,7 @@ int CipherGetBlockSize (int cipher);
 int CipherGetKeySize (int cipher);
 int CipherGetKeyScheduleSize (int cipher);
 BOOL CipherSupportsIntraDataUnitParallelization (int cipher);
-char * CipherGetName (int cipher);
+const char * CipherGetName (int cipher);
 
 int CipherInit (int cipher, unsigned char *key, unsigned char *ks);
 int EAInit (int ea, unsigned char *key, unsigned char *ks);
@@ -302,7 +283,7 @@ int EAGetPreviousCipher (int ea, int previousCipherId);
 int EAIsFormatEnabled (int ea);
 BOOL EAIsModeSupported (int ea, int testedMode);
 
-char *HashGetName (int hash_algo_id);
+const char *HashGetName (int hash_algo_id);
 BOOL HashIsDeprecated (int hashId);
 
 int GetMaxPkcs5OutSize (void);
@@ -313,13 +294,6 @@ void DecryptDataUnits (unsigned __int8 *buf, const UINT64_STRUCT *structUnitNo,
 void DecryptDataUnitsCurrentThread (unsigned __int8 *buf, const UINT64_STRUCT *structUnitNo, TC_LARGEST_COMPILER_UINT nbrUnits, PCRYPTO_INFO ci);
 void EncryptBuffer (unsigned __int8 *buf, TC_LARGEST_COMPILER_UINT len, PCRYPTO_INFO cryptoInfo);
 void DecryptBuffer (unsigned __int8 *buf, TC_LARGEST_COMPILER_UINT len, PCRYPTO_INFO cryptoInfo);
-#ifndef TC_NO_COMPILER_INT64
-void EncryptBufferLRW128 (byte *buffer, uint64 length, uint64 blockIndex, PCRYPTO_INFO cryptoInfo);
-void DecryptBufferLRW128 (byte *buffer, uint64 length, uint64 blockIndex, PCRYPTO_INFO cryptoInfo);
-void EncryptBufferLRW64 (byte *buffer, uint64 length, uint64 blockIndex, PCRYPTO_INFO cryptoInfo);
-void DecryptBufferLRW64 (byte *buffer, uint64 length, uint64 blockIndex, PCRYPTO_INFO cryptoInfo);
-uint64 DataUnit2LRWIndex (uint64 dataUnit, int blockSize, PCRYPTO_INFO ci);
-#endif	// #ifndef TC_NO_COMPILER_INT64
 
 BOOL IsAesHwCpuSupported ();
 void EnableHwEncryption (BOOL enable);

src/Common/Dlgcode.h

@@ -218,13 +218,13 @@ typedef struct
 #define YES_NO MB_YESNO
 
 #define	ISO_BURNER_TOOL "isoburn.exe"
-#define PRINT_TOOL "notepad"
+#define PRINT_TOOL "notepad.exe"
 
 void cleanup ( void );
 void LowerCaseCopy ( char *lpszDest , const char *lpszSource );
-void UpperCaseCopy ( char *lpszDest , const char *lpszSource );
-void CreateFullVolumePath ( char *lpszDiskFile , const char *lpszFileName , BOOL *bDevice );
-int FakeDosNameForDevice ( const char *lpszDiskFile , char *lpszDosDevice , char *lpszCFDevice , BOOL bNameOnly );
+void UpperCaseCopy ( char *lpszDest , size_t cbDest, const char *lpszSource );
+void CreateFullVolumePath ( char *lpszDiskFile , size_t cbDiskFile, const char *lpszFileName , BOOL *bDevice );
+int FakeDosNameForDevice ( const char *lpszDiskFile , char *lpszDosDevice , size_t cbDosDevice, char *lpszCFDevice , size_t cbCFDevice, BOOL bNameOnly );
 int RemoveFakeDosName ( char *lpszDiskFile , char *lpszDosDevice );
 void AbortProcess ( char *stringId );
 void AbortProcessSilent ( void );
@@ -242,8 +242,8 @@ void CloseStaticModelessWaitDlg (void);
 BOOL IsButtonChecked ( HWND hButton );
 void CheckButton ( HWND hButton );
 void LeftPadString (char *szTmp, int len, int targetLen, char filler);
-void ToSBCS ( LPWSTR lpszText );
-void ToUNICODE ( char *lpszText );
+void ToSBCS ( LPWSTR lpszText, size_t cbSize );
+void ToUNICODE ( char *lpszText , size_t cbSize);
 void InitDialog ( HWND hwndDlg );
 void ProcessPaintMessages (HWND hwnd, int maxMessagesToProcess);
 HDC CreateMemBitmap ( HINSTANCE hInstance , HWND hwnd , char *resource );
@@ -259,7 +259,7 @@ void HandCursor ();
 void AddComboPair (HWND hComboBox, const char *lpszItem, int value);
 void AddComboPairW (HWND hComboBox, const wchar_t *lpszItem, int value);
 void SelectAlgo ( HWND hComboBox , int *nCipher );
-void PopulateWipeModeCombo (HWND hComboBox, BOOL bNA, BOOL bInPlaceEncryption);
+void PopulateWipeModeCombo (HWND hComboBox, BOOL bNA, BOOL bInPlaceEncryption, BOOL bHeaderWipe);
 wchar_t *GetWipeModeName (WipeAlgorithmId modeId);
 wchar_t *GetPathType (const char *path, BOOL bUpperCase, BOOL *bIsPartition);
 LRESULT CALLBACK CustomDlgProc ( HWND hwnd , UINT uMsg , WPARAM wParam , LPARAM lParam );
@@ -293,7 +293,7 @@ BOOL OpenDevice (const char *lpszPath, OPEN_TEST_STRUCT *driver, BOOL detectFile
 void NotifyDriverOfPortableMode (void);
 int GetAvailableFixedDisks ( HWND hComboBox , char *lpszRootPath );
 int GetAvailableRemovables ( HWND hComboBox , char *lpszRootPath );
-int IsSystemDevicePath (char *path, HWND hwndDlg, BOOL bReliableRequired);
+int IsSystemDevicePath (const char *path, HWND hwndDlg, BOOL bReliableRequired);
 BOOL CALLBACK RawDevicesDlgProc ( HWND hwndDlg , UINT msg , WPARAM wParam , LPARAM lParam );
 BOOL TextInfoDialogBox (int nID);
 BOOL CALLBACK TextInfoDialogBoxDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam);
@@ -333,7 +333,7 @@ int GetMountedVolumeDriveNo (char *volname);
 BOOL IsAdmin (void);
 BOOL IsBuiltInAdmin ();
 BOOL IsUacSupported ();
-BOOL ResolveSymbolicLink (const wchar_t *symLinkName, PWSTR targetName);
+BOOL ResolveSymbolicLink (const wchar_t *symLinkName, PWSTR targetName, size_t cbTargetName);
 int GetDiskDeviceDriveLetter (PWSTR deviceName);
 int FileSystemAppearsEmpty (const char *devicePath);
 __int64 GetStatsFreeSpaceOnPartition (const char *devicePath, float *percent, __int64 *occupiedBytes, BOOL silent);
@@ -346,7 +346,7 @@ BOOL TCCopyFile (char *sourceFileName, char *destinationFile);
 BOOL SaveBufferToFile (const char *inputBuffer, const char *destinationFile, DWORD inputLength, BOOL bAppend);
 BOOL TCFlushFile (FILE *f);
 BOOL PrintHardCopyTextUTF16 (wchar_t *text, char *title, int byteLen);
-void GetSpeedString (unsigned __int64 speed, wchar_t *str);
+void GetSpeedString (unsigned __int64 speed, wchar_t *str, size_t cbStr);
 BOOL IsNonInstallMode ();
 BOOL DriverUnload ();
 LRESULT SetCheckBox (HWND hwndDlg, int dlgItem, BOOL state);
@@ -362,7 +362,7 @@ LRESULT ListSubItemSet (HWND list, int index, int subIndex, char *string);
 LRESULT ListSubItemSetW (HWND list, int index, int subIndex, wchar_t *string);
 BOOL GetMountList (MOUNT_LIST_STRUCT *list);
 int GetDriverRefCount ();
-void GetSizeString (unsigned __int64 size, wchar_t *str);
+void GetSizeString (unsigned __int64 size, wchar_t *str, size_t cbStr);
 __int64 GetFileSize64 (const char *path);
 BOOL LoadInt16 (char *filePath, int *result, __int64 fileOffset);
 BOOL LoadInt32 (char *filePath, unsigned __int32 *result, __int64 fileOffset);
@@ -429,8 +429,8 @@ BOOL CALLBACK FindTCWindowEnum (HWND hwnd, LPARAM lParam);
 BYTE *MapResource (char *resourceType, int resourceId, PDWORD size);
 void InconsistencyResolved (char *msg);
 void ReportUnexpectedState (char *techInfo);
-BOOL SelectMultipleFiles (HWND hwndDlg, char *stringId, char *lpszFileName, BOOL keepHistory);
-BOOL SelectMultipleFilesNext (char *lpszFileName);
+BOOL SelectMultipleFiles (HWND hwndDlg, const char *stringId, char *lpszFileName, size_t cbFileName, BOOL keepHistory);
+BOOL SelectMultipleFilesNext (char *lpszFileName, size_t cbFileName);
 void OpenOnlineHelp ();
 BOOL GetPartitionInfo (const char *deviceName, PPARTITION_INFORMATION rpartInfo);
 BOOL GetDeviceInfo (const char *deviceName, DISK_PARTITION_INFO_STRUCT *info);
@@ -464,7 +464,7 @@ int AskNonSysInPlaceEncryptionResume ();
 BOOL RemoveDeviceWriteProtection (HWND hwndDlg, char *devicePath);
 void EnableElevatedCursorChange (HWND parent);
 BOOL DisableFileCompression (HANDLE file);
-BOOL VolumePathExists (char *volumePath);
+BOOL VolumePathExists (const char *volumePath);
 BOOL IsWindowsIsoBurnerAvailable ();
 BOOL LaunchWindowsIsoBurner (HWND hwnd, const char *isoPath);
 BOOL IsApplicationInstalled (const char *appName);
@@ -487,7 +487,8 @@ struct HostDevice
 		IsVirtualPartition (false),
 		HasUnencryptedFilesystem (false),
 		Removable (false),
-		Size (0)
+		Size (0),
+		SystemNumber((uint32) -1)
 	{
 	}
 

src/Common/EncryptionThreadPool.c

@@ -173,11 +173,6 @@ static TC_THREAD_PROC EncryptionThreadProc (void *threadArg)
 					workItem->KeyDerivation.IterationCount, workItem->KeyDerivation.DerivedKey, GetMaxPkcs5OutSize());
 				break;
 
-			case SHA1:
-				derive_key_sha1 (workItem->KeyDerivation.Password, workItem->KeyDerivation.PasswordLength, workItem->KeyDerivation.Salt, PKCS5_SALT_SIZE,
-					workItem->KeyDerivation.IterationCount, workItem->KeyDerivation.DerivedKey, GetMaxPkcs5OutSize());
-				break;
-
 			default:		
 				TC_THROW_FATAL_EXCEPTION;
 			} 

src/Common/Exception.h

@@ -12,7 +12,7 @@
 #include "Platform/PlatformBase.h"
 #include "Dlgcode.h"
 
-namespace TrueCrypt
+namespace VeraCrypt
 {
 	struct Exception
 	{
@@ -35,12 +35,12 @@ namespace TrueCrypt
 	struct ErrorException : public Exception
 	{
 		ErrorException (char *langId) : ErrLangId (langId) { }
-		ErrorException (const wstring &errMsg) : ErrMsg (errMsg) { }
+		ErrorException (const wstring &errMsg) : ErrLangId(NULL), ErrMsg (errMsg) { }
 
 		void Show (HWND parent) const
 		{
 			if (ErrMsg.empty())
-				::Error (ErrLangId);
+				::Error (ErrLangId? ErrLangId : "");
 			else
 				::ErrorDirect (ErrMsg.c_str());
 		}

src/Common/Format.c

@@ -29,6 +29,8 @@
 #include "Format/FormatCom.h"
 #include "Format/Tcformat.h"
 
+#include <Strsafe.h>
+
 int FormatWriteBufferSize = 1024 * 1024;
 static uint32 FormatSectorSize = 0;
 
@@ -129,8 +131,8 @@ int TCFormatVolume (volatile FORMAT_VOL_PARAMETERS *volParams)
 
 	if (volParams->bDevice)
 	{
-		strcpy ((char *)deviceName, volParams->volumePath);
-		ToUNICODE ((char *)deviceName);
+		StringCbCopyA ((char *)deviceName, sizeof(deviceName), volParams->volumePath);
+		ToUNICODE ((char *)deviceName, sizeof(deviceName));
 
 		driveLetter = GetDiskDeviceDriveLetter (deviceName);
 	}
@@ -170,7 +172,7 @@ begin_format:
 		DWORD dwResult;
 		int nPass;
 
-		if (FakeDosNameForDevice (volParams->volumePath, dosDev, devName, FALSE) != 0)
+		if (FakeDosNameForDevice (volParams->volumePath, dosDev, sizeof(dosDev), devName, sizeof(devName), FALSE) != 0)
 			return ERR_OS_ERROR;
 
 		if (IsDeviceMounted (devName))
@@ -795,10 +797,20 @@ BOOLEAN __stdcall FormatExCallback (int command, DWORD subCommand, PVOID paramet
 
 BOOL FormatNtfs (int driveNo, int clusterSize)
 {
+	char dllPath[MAX_PATH] = {0};
 	WCHAR dir[8] = { (WCHAR) driveNo + 'A', 0 };
 	PFORMATEX FormatEx;
-	HMODULE hModule = LoadLibrary ("fmifs.dll");
+	HMODULE hModule;
 	int i;
+	
+	if (GetSystemDirectory (dllPath, MAX_PATH))
+	{
+		StringCbCatA(dllPath, sizeof(dllPath), "\\fmifs.dll");
+	}
+	else
+		StringCbCopyA(dllPath, sizeof(dllPath), "C:\\Windows\\System32\\fmifs.dll");
+	
+	hModule = LoadLibrary (dllPath);
 
 	if (hModule == NULL)
 		return FALSE;
@@ -809,7 +821,7 @@ BOOL FormatNtfs (int driveNo, int clusterSize)
 		return FALSE;
 	}
 
-	wcscat (dir, L":\\");
+	StringCbCatW (dir, sizeof(dir), L":\\");
 
 	FormatExResult = FALSE;
 

src/Common/GfMul.c

@@ -651,43 +651,6 @@ int Gf128Tab64Init (unsigned __int8 *a, GfCtx *ctx)
 	return TRUE;
 }
 
-int Gf64TabInit (unsigned __int8 *a, GfCtx *ctx)
-{
-	/* Deprecated/legacy */
-
-	GfCtx4k64 *ctx4k;
-	unsigned __int8 am[8];
-	int i, j;
-
-	ctx4k = (GfCtx4k64 *) TCalloc (sizeof (GfCtx4k64));
-	if (!ctx4k)
-		return FALSE;
-
-	memcpy (am, a, 8);
-	MirrorBits64 (am);
-    compile_4k_table64 (am, ctx4k);
-
-	/* Convert LSB-first table to MSB-first */
-	for (i = 0; i < 16; i++) 
-	{
-		for (j = 0; j < 16; j++) 
-		{
-			int jm = 0;
-			jm |= (j & 0x1) << 3;
-			jm |= (j & 0x2) << 1;
-			jm |= (j & 0x4) >> 1;
-			jm |= (j & 0x8) >> 3;
-
-			memcpy (&ctx->gf_t64[i][jm], (unsigned char *)&ctx4k->gf_t4k[15-i][j], 8);
-			MirrorBits64 ((unsigned char *)&ctx->gf_t64[i][jm]);
-		}
-	}
-
-	burn (ctx4k,sizeof (*ctx4k));
-	burn (am, sizeof (am));
-	TCfree (ctx4k);
-	return TRUE;
-}
 
 #define xor_8kt64(i)   \
     xor_block_aligned(r, ctx->gf_t128[i + i][a[i] & 15]); \
@@ -718,36 +681,6 @@ void Gf128MulBy64Tab (unsigned __int8 a[8], unsigned __int8 p[16], GfCtx *ctx)
     move_block_aligned(p, r);
 }
 
-#define xor_8k64(i)   \
-    xor_block_aligned64(r, ctx->gf_t64[i + i][a[i] & 15]); \
-    xor_block_aligned64(r, ctx->gf_t64[i + i + 1][a[i] >> 4])
-
-/* Multiply two 64-bit numbers in the finite field GF(2^64) */
-void Gf64MulTab (unsigned char a[8], unsigned char p[8], GfCtx *ctx)
-{  
-	/* Deprecated/legacy */
-
-	unsigned __int32 r[CBLK_LEN8 >> 2];
-
-	move_block_aligned64(r, ctx->gf_t64[7*2][a[7] & 15]);
-    xor_block_aligned64(r,  ctx->gf_t64[7*2+1][a[7] >> 4]);
-
-	if (*(unsigned __int16 *)a)
-	{
-		xor_8k64(0);
-		xor_8k64(1);
-	}
-	if (a[2])
-	{
-		xor_8k64(2);
-	}
-	xor_8k64(3);
-    xor_8k64(4);
-	xor_8k64(5);
-	xor_8k64(6);
-
-    move_block_aligned64(p, r);
-}
 
 
 /* Basic algorithms for testing of optimized algorithms */
@@ -809,32 +742,6 @@ static void shl64 (unsigned __int8 *a)
 	}
 }
 
-static void GfMul64Basic (unsigned __int8 *a, unsigned __int8 *b, unsigned __int8* p)
-{
-	/* Deprecated/legacy */
-
-	int i;
-	unsigned __int8 la[8];
-	memcpy (la, a, 8);
-	memset (p, 0, 8);
-
-	for (i = 0; i < 64; i++)
-	{
-		if (IsBitSet64 (i, b))
-			xor64 ((uint64 *)p, (uint64 *)la);
-
-		if (la[0] & 0x80)
-		{
-			shl64 (la);
-			la[7] ^= 0x1b;
-		}
-		else
-		{
-			shl64 (la);
-		}
-	}
-}
-
 
 BOOL GfMulSelfTest ()
 {
@@ -849,23 +756,6 @@ BOOL GfMulSelfTest ()
 	if (!gfCtx)
 		return FALSE;
 
-	/* GF(2^64) - deprecated/legacy */
-	for (i = 0; i < 0x100; i++)
-	{
-		for (j = 0; j < 8; j++)
-		{
-			a[j] = (unsigned __int8) i;
-			b[j] = a[j] ^ 0xff;
-		}
-
-		GfMul64Basic (a, b, p1);
-	
-		Gf64TabInit (a, gfCtx);
-		Gf64MulTab (b, p2, gfCtx);
-
-		if (memcmp (p1, p2, 8) != 0)
-			result = FALSE;
-	}
 
 	/* GF(2^128) */
 	for (i = 0; i < 0x100; i++)

src/Common/GfMul.h

@@ -63,8 +63,6 @@ void GfMul128 (void *a, const void* b);
 void GfMul128Tab(unsigned char a[16], GfCtx8k *ctx);
 int Gf128Tab64Init (unsigned __int8 *a, GfCtx *ctx);
 void Gf128MulBy64Tab (unsigned __int8 a[8], unsigned __int8 p[16], GfCtx *ctx);
-int Gf64TabInit (unsigned __int8 *a, GfCtx *ctx);
-void Gf64MulTab (unsigned char a[8], unsigned char p[8], GfCtx *ctx);
 void MirrorBits128 (unsigned __int8 *a);
 void MirrorBits64 (unsigned __int8 *a);
 BOOL GfMulSelfTest ();

src/Common/Keyfiles.c

@@ -23,11 +23,12 @@
 #include "Platform/Finally.h"
 #include "Platform/ForEach.h"
 
-using namespace TrueCrypt;
+#include <Strsafe.h>
+
+using namespace VeraCrypt;
 
 #define stat _stat
 #define S_IFDIR _S_IFDIR
-#define snprintf _snprintf
 
 
 BOOL HiddenFilesPresentInKeyfilePath = FALSE;
@@ -97,13 +98,16 @@ void KeyFileRemoveAll (KeyFile **firstKeyFile)
 
 KeyFile *KeyFileClone (KeyFile *keyFile)
 {
-	KeyFile *clone;
+	KeyFile *clone = NULL;
 
 	if (keyFile == NULL) return NULL;
 
 	clone = (KeyFile *) malloc (sizeof (KeyFile));
-	strcpy (clone->FileName, keyFile->FileName);
-	clone->Next = NULL;
+	if (clone)
+	{
+		StringCbCopyA (clone->FileName, sizeof(clone->FileName), keyFile->FileName);
+		clone->Next = NULL;
+	}
 	return clone;
 }
 
@@ -298,7 +302,7 @@ BOOL KeyFilesApply (Password *password, KeyFile *firstKeyFile)
 			/* Find and process all keyfiles in the directory */
 			int keyfileCount = 0;
 
-			snprintf (searchPath, sizeof (searchPath), "%s\\*.*", kf->FileName);
+			StringCbPrintfA (searchPath, sizeof (searchPath), "%s\\*.*", kf->FileName);
 			if ((searchHandle = _findfirst (searchPath, &fBuf)) == -1)
 			{
 				handleWin32Error (MainDlg);
@@ -311,7 +315,7 @@ BOOL KeyFilesApply (Password *password, KeyFile *firstKeyFile)
 			{
 				WIN32_FILE_ATTRIBUTE_DATA fileAttributes;
 
-				snprintf (kfSub->FileName, sizeof(kfSub->FileName), "%s%c%s", kf->FileName,
+				StringCbPrintfA (kfSub->FileName, sizeof(kfSub->FileName), "%s%c%s", kf->FileName,
 					'\\',
 					fBuf.name
 					);
@@ -462,18 +466,21 @@ BOOL CALLBACK KeyFilesDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 		if (lw == IDC_KEYADD)
 		{
 			KeyFile *kf = (KeyFile *) malloc (sizeof (KeyFile));
-			if (SelectMultipleFiles (hwndDlg, "SELECT_KEYFILE", kf->FileName, bHistory))
+			if (kf)
 			{
-				do
+				if (SelectMultipleFiles (hwndDlg, "SELECT_KEYFILE", kf->FileName, sizeof(kf->FileName),bHistory))
 				{
-					param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
-					LoadKeyList (hwndDlg, param->FirstKeyFile);
+					do
+					{
+						param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
+						LoadKeyList (hwndDlg, param->FirstKeyFile);
 
-					kf = (KeyFile *) malloc (sizeof (KeyFile));
-				} while (SelectMultipleFilesNext (kf->FileName));
+						kf = (KeyFile *) malloc (sizeof (KeyFile));
+					} while (SelectMultipleFilesNext (kf->FileName, sizeof(kf->FileName)));
+				}
+
+				free (kf);
 			}
-
-			free (kf);
 			return 1;
 		}
 
@@ -501,10 +508,13 @@ BOOL CALLBACK KeyFilesDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 				foreach (const SecurityTokenKeyfilePath &keyPath, selectedTokenKeyfiles)
 				{
 					KeyFile *kf = (KeyFile *) malloc (sizeof (KeyFile));
-					strcpy_s (kf->FileName, sizeof (kf->FileName), WideToSingleString (keyPath).c_str());
+					if (kf)
+					{
+						strcpy_s (kf->FileName, sizeof (kf->FileName), WideToSingleString (keyPath).c_str());
 
-					param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
-					LoadKeyList (hwndDlg, param->FirstKeyFile);
+						param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
+						LoadKeyList (hwndDlg, param->FirstKeyFile);
+					}
 				}
 			}
 
@@ -574,9 +584,12 @@ BOOL CALLBACK KeyFilesDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 			while (count-- > 0)
 			{
 				KeyFile *kf = (KeyFile *) malloc (sizeof (KeyFile));
-				DragQueryFile (hdrop, i++, kf->FileName, sizeof (kf->FileName));
-				param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
-				LoadKeyList (hwndDlg, param->FirstKeyFile);
+				if (kf)
+				{
+					DragQueryFile (hdrop, i++, kf->FileName, sizeof (kf->FileName));
+					param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
+					LoadKeyList (hwndDlg, param->FirstKeyFile);
+				}
 			}
 
 			DragFinish (hdrop);
@@ -614,6 +627,8 @@ BOOL CALLBACK KeyFilesDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 BOOL KeyfilesPopupMenu (HWND hwndDlg, POINT popupPosition, KeyFilesDlgParam *param)
 {
 	HMENU popup = CreatePopupMenu ();
+	if (!popup)
+		return FALSE;
 	int sel;
 	BOOL status = FALSE;
 
@@ -628,35 +643,40 @@ BOOL KeyfilesPopupMenu (HWND hwndDlg, POINT popupPosition, KeyFilesDlgParam *par
 	case IDM_KEYFILES_POPUP_ADD_FILES:
 		{
 			KeyFile *kf = (KeyFile *) malloc (sizeof (KeyFile));
-			if (SelectMultipleFiles (hwndDlg, "SELECT_KEYFILE", kf->FileName, bHistory))
+			if (kf)
 			{
-				do
+				if (SelectMultipleFiles (hwndDlg, "SELECT_KEYFILE", kf->FileName, sizeof(kf->FileName),bHistory))
 				{
-					param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
-					kf = (KeyFile *) malloc (sizeof (KeyFile));
-				} while (SelectMultipleFilesNext (kf->FileName));
+					do
+					{
+						param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
+						kf = (KeyFile *) malloc (sizeof (KeyFile));
+					} while (SelectMultipleFilesNext (kf->FileName, sizeof(kf->FileName)));
 
-				param->EnableKeyFiles = TRUE;
-				status = TRUE;
+					param->EnableKeyFiles = TRUE;
+					status = TRUE;
+				}
+
+				free (kf);
 			}
-
-			free (kf);
 		}
 		break;
 
 	case IDM_KEYFILES_POPUP_ADD_DIR:
 		{
 			KeyFile *kf = (KeyFile *) malloc (sizeof (KeyFile));
-
-			if (BrowseDirectories (hwndDlg,"SELECT_KEYFILE_PATH", kf->FileName))
+			if (kf)
 			{
-				param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
-				param->EnableKeyFiles = TRUE;
-				status = TRUE;
-			}
-			else
-			{
-				free (kf);
+				if (BrowseDirectories (hwndDlg,"SELECT_KEYFILE_PATH", kf->FileName))
+				{
+					param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
+					param->EnableKeyFiles = TRUE;
+					status = TRUE;
+				}
+				else
+				{
+					free (kf);
+				}
 			}
 		}
 		break;
@@ -669,11 +689,14 @@ BOOL KeyfilesPopupMenu (HWND hwndDlg, POINT popupPosition, KeyFilesDlgParam *par
 				foreach (const SecurityTokenKeyfilePath &keyPath, selectedTokenKeyfiles)
 				{
 					KeyFile *kf = (KeyFile *) malloc (sizeof (KeyFile));
-					strcpy_s (kf->FileName, sizeof (kf->FileName), WideToSingleString (keyPath).c_str());
+					if (kf)
+					{
+						strcpy_s (kf->FileName, sizeof (kf->FileName), WideToSingleString (keyPath).c_str());
 
-					param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
-					param->EnableKeyFiles = TRUE;
-					status = TRUE;
+						param->FirstKeyFile = KeyFileAdd (param->FirstKeyFile, kf);
+						param->EnableKeyFiles = TRUE;
+						status = TRUE;
+					}
 				}
 			}
 		}

src/Common/Keyfiles.h

@@ -20,7 +20,7 @@ extern "C" {
 
 typedef struct KeyFileStruct
 {
-	char FileName[MAX_PATH];
+	char FileName[MAX_PATH + 1];
 	struct KeyFileStruct *Next;
 } KeyFile;
 

src/Common/Language.c

@@ -26,6 +26,8 @@
 #include "../Setup/Resource.h"
 #endif
 
+#include <Strsafe.h>
+
 BOOL LocalizationActive;
 int LocalizationSerialNo;
 
@@ -68,8 +70,9 @@ static char *MapNextLanguageFile ()
 		GetModuleFileNameW (NULL, f, sizeof (f) / sizeof (f[0]));
 		t = wcsrchr (f, L'\\');
 		if (t == NULL) return NULL;
-
-		wcscpy (t, L"\\Language*.xml");
+		
+		*t = 0;
+		StringCbCatW (f, sizeof(f), L"\\Language*.xml");
 
 		LanguageFileFindHandle = FindFirstFileW (f, &find);
 	}
@@ -88,14 +91,29 @@ static char *MapNextLanguageFile ()
 
 	GetModuleFileNameW (NULL, f, sizeof (f) / sizeof(f[0]));
 	t = wcsrchr (f, L'\\');
-	wcscpy (t + 1, find.cFileName);
+	if (t == NULL)
+	{
+		free(LanguageFileBuffer);
+		return NULL;
+	}
+
+	t[1] = 0;
+	StringCbCatW (f, sizeof(f),find.cFileName);
 
 	file = CreateFileW (f, GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, NULL);
-	if (file == INVALID_HANDLE_VALUE) return NULL;
+	if (file == INVALID_HANDLE_VALUE)
+	{
+		free(LanguageFileBuffer);
+		return NULL;
+	}
 
 	ReadFile (file, LanguageFileBuffer, find.nFileSizeLow, &read, NULL);
 	CloseHandle (file);
-	if (read != find.nFileSizeLow) return NULL;
+	if (read != find.nFileSizeLow)
+	{
+		free(LanguageFileBuffer);
+		return NULL;
+	}
 
 	return LanguageFileBuffer;
 }
@@ -130,7 +148,7 @@ BOOL LoadLanguageFile ()
 	ClearDictionaryPool ();
 
 	if (PreferredLangId[0] != 0)
-		strcpy (langId, PreferredLangId);
+		StringCbCopyA (langId, sizeof(langId), PreferredLangId);
 
 	// Parse all available language files until preferred language is found
 	for (res = MapFirstLanguageFile (); res != NULL; res = MapNextLanguageFile ())
@@ -147,7 +165,7 @@ BOOL LoadLanguageFile ()
 		if (defaultLangParsed && strcmp (attr, VERSION_STRING) && strcmp (attr, "DEBUG"))
 		{
 			wchar_t m[2048];
-			swprintf (m, L"The installed language pack is incompatible with this version of VeraCrypt (the language pack is for VeraCrypt %hs). A newer version may be available at www.idrix.fr.\n\nTo prevent this message from being displayed, do any of the following:\n\n- Select 'Settings' > 'Language'; then select 'English' and click 'OK'.\n\n- Remove or replace the language pack with a compatible version (the language pack may reside e.g. in 'C:\\Program Files\\VeraCrypt' or '%%LOCALAPPDATA%%\\VirtualStore\\Program Files\\VeraCrypt', etc.)", attr);
+			StringCbPrintfW (m, sizeof(m), L"The installed language pack is incompatible with this version of VeraCrypt (the language pack is for VeraCrypt %hs). A newer version may be available at www.idrix.fr.\n\nTo prevent this message from being displayed, do any of the following:\n\n- Select 'Settings' > 'Language'; then select 'English' and click 'OK'.\n\n- Remove or replace the language pack with a compatible version (the language pack may reside e.g. in 'C:\\Program Files\\VeraCrypt' or '%%LOCALAPPDATA%%\\VirtualStore\\Program Files\\VeraCrypt', etc.)", attr);
 			MessageBoxW (NULL, m, L"VeraCrypt", MB_ICONERROR);
 			continue;
 		}
@@ -189,7 +207,7 @@ BOOL LoadLanguageFile ()
 				XmlGetAttributeText (xml, "size", attr, sizeof (attr));
 				sscanf (attr, "%d", &font.Size);
 
-				strcpy (attr, "font_");
+				StringCbCopyA (attr, sizeof(attr), "font_");
 				XmlGetAttributeText (xml, "class", attr + 5, sizeof (attr) - 5);
 				AddDictionaryEntry (
 					AddPoolData ((void *) attr, strlen (attr) + 1), 0,
@@ -298,7 +316,7 @@ BOOL LoadLanguageFile ()
 
 		do
 		{
-			if (sscanf (header, "#define %s %d", key, &intKey) == 2)
+			if (sscanf (header, "#define %127s %d", key, &intKey) == 2)
 			{
 				WCHAR *str = GetString (key);
 
@@ -375,13 +393,13 @@ BOOL CALLBACK LanguageDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 								// Language pack version 
 								if (!ActiveLangPackVersion[0] || memcmp (ActiveLangPackVersion, "0.0.0", 5) == 0)
 								{
-									swprintf (szVers, GetString("LANG_PACK_VERSION"), L"--");
+									StringCbPrintfW (szVers, sizeof(szVers), GetString("LANG_PACK_VERSION"), L"--");
 								}
 								else
 								{
 									nLen = MultiByteToWideChar (CP_UTF8, 0, ActiveLangPackVersion, -1, wversion, sizeof (wversion) / sizeof(wversion[0]));
 									if (nLen != 0 && nLen != ERROR_NO_UNICODE_TRANSLATION)
-										swprintf (szVers, GetString("LANG_PACK_VERSION"), wversion);
+										StringCbPrintfW (szVers, sizeof(szVers),GetString("LANG_PACK_VERSION"), wversion);
 								}
 								SetWindowTextW (GetDlgItem (hwndDlg, IDC_LANGPACK_VERSION), szVers);
 
@@ -394,7 +412,7 @@ BOOL CALLBACK LanguageDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 								}
 							}
 
-							strcpy (lastLangId, attr);
+							StringCbCopyA (lastLangId, sizeof(lastLangId),attr);
 							langCount++;
 						}
 					}
@@ -410,7 +428,7 @@ BOOL CALLBACK LanguageDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 					EndDialog (hwndDlg, IDCANCEL);
 
 				if (langCount == 2)
-					strcpy (PreferredLangId, lastLangId);
+					StringCbCopyA (PreferredLangId, sizeof(PreferredLangId), lastLangId);
 				
 				EndDialog (hwndDlg, IDOK);
 			}
@@ -446,7 +464,7 @@ BOOL CALLBACK LanguageDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 					}	
 		
 					if (SendDlgItemMessage (hwndDlg, IDC_LANGLIST, LB_GETCOUNT, 0, 0) > 1)
-						strcpy (PreferredLangId, l);
+						StringCbCopyA (PreferredLangId, sizeof(PreferredLangId), l);
 				}
 			}
 
@@ -465,7 +483,7 @@ BOOL CALLBACK LanguageDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 			char tmpstr [256];
 
 			if (strlen (ActiveLangPackVersion) > 0 && strlen (GetPreferredLangId()) > 0)
-				sprintf (tmpstr, "&langpackversion=%s&lang=%s", ActiveLangPackVersion, GetPreferredLangId());
+				StringCbPrintfA (tmpstr, sizeof(tmpstr), "&langpackversion=%s&lang=%s", ActiveLangPackVersion, GetPreferredLangId());
 			else
 				tmpstr[0] = 0;
 
@@ -488,7 +506,7 @@ char *GetPreferredLangId ()
 
 void SetPreferredLangId (char *langId)
 {
-	strncpy (PreferredLangId, langId, 5);
+	StringCbCopyA (PreferredLangId, sizeof(PreferredLangId), langId);
 }
 
 
@@ -503,7 +521,7 @@ wchar_t *GetString (const char *stringId)
 	WCHAR *str = (WCHAR *) GetDictionaryValue (stringId);
 	if (str != NULL) return str;
 
-	wsprintfW (UnknownString, UNKNOWN_STRING_ID L"%hs" UNKNOWN_STRING_ID, stringId);
+	StringCbPrintfW (UnknownString, sizeof(UnknownString), UNKNOWN_STRING_ID L"%hs" UNKNOWN_STRING_ID, stringId);
 	return UnknownString;
 }
 

src/Common/Language.xml

@@ -1049,6 +1049,7 @@
     <string lang="en" key="WIPE_MODE_3_DOD_5220">3-pass (US DoD 5220.22-M)</string>
     <string lang="en" key="WIPE_MODE_7_DOD_5220">7-pass (US DoD 5220.22-M)</string>
     <string lang="en" key="WIPE_MODE_35_GUTMANN">35-pass ("Gutmann")</string>
+    <string lang="en" key="WIPE_MODE_256">256-pass</string>
     <string lang="en" key="SYS_MULTI_BOOT_MODE_TITLE">Number of Operating Systems</string>
     <string lang="en" key="MULTI_BOOT_FOR_ADVANCED_ONLY">WARNING: Inexperienced users should never attempt to encrypt Windows in multi-boot configurations.\n\nContinue?</string>
     <string lang="en" key="HIDDEN_OS_MULTI_BOOT">When creating/using a hidden operating system, VeraCrypt supports multi-boot configurations only when the following conditions are met:\n\n- The currently running operating system must be installed on the boot drive, which must not contain any other operating systems.\n\n- Operating systems installed on other drives must not use any boot loader residing on the drive on which the currently running operating system is installed.\n\nAre the above conditions met?</string>

src/Common/Password.c

@@ -66,15 +66,20 @@ BOOL CheckPasswordCharEncoding (HWND hPassword, Password *ptrPw)
 	
 	if (hPassword == NULL)
 	{
-		unsigned char *pw;
-		len = ptrPw->Length;
-		pw = (unsigned char *) ptrPw->Text;
-
-		for (i = 0; i < len; i++)
+		if (ptrPw)
 		{
-			if (pw[i] >= 0x7f || pw[i] < 0x20)	// A non-ASCII or non-printable character?
-				return FALSE;
+			unsigned char *pw;
+			len = ptrPw->Length;
+			pw = (unsigned char *) ptrPw->Text;
+
+			for (i = 0; i < len; i++)
+			{
+				if (pw[i] >= 0x7f || pw[i] < 0x20)	// A non-ASCII or non-printable character?
+					return FALSE;
+			}
 		}
+		else
+			return FALSE;
 	}
 	else
 	{
@@ -114,7 +119,7 @@ BOOL CheckPasswordLength (HWND hwndDlg, HWND hwndItem)
 	return TRUE;
 }
 
-int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, int pkcs5, HWND hwndDlg)
+int ChangePwd (const char *lpszVolume, Password *oldPassword, Password *newPassword, int pkcs5, int wipePassCount, HWND hwndDlg)
 {
 	int nDosLinkCreated = 1, nStatus = ERR_OS_ERROR;
 	char szDiskFile[TC_MAX_PATH], szCFDevice[TC_MAX_PATH];
@@ -138,9 +143,16 @@ int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, i
 
 	if (oldPassword->Length == 0 || newPassword->Length == 0) return -1;
 
+   if (!lpszVolume)
+   {
+      nStatus = ERR_OUTOFMEMORY;
+      handleError (hwndDlg, nStatus);
+      return nStatus;
+   }
+
 	WaitCursor ();
 
-	CreateFullVolumePath (szDiskFile, lpszVolume, &bDevice);
+	CreateFullVolumePath (szDiskFile, sizeof(szDiskFile), lpszVolume, &bDevice);
 
 	if (bDevice == FALSE)
 	{
@@ -148,7 +160,7 @@ int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, i
 	}
 	else
 	{
-		nDosLinkCreated = FakeDosNameForDevice (szDiskFile, szDosDevice, szCFDevice, FALSE);
+		nDosLinkCreated = FakeDosNameForDevice (szDiskFile, szDosDevice, sizeof(szDosDevice), szCFDevice, sizeof(szCFDevice),FALSE);
 		
 		if (nDosLinkCreated != 0)
 			goto error;
@@ -311,7 +323,7 @@ int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, i
 
 	while (TRUE)
 	{
-		/* The header will be re-encrypted PRAND_DISK_WIPE_PASSES times to prevent adversaries from using 
+		/* The header will be re-encrypted wipePassCount times to prevent adversaries from using 
 		techniques such as magnetic force microscopy or magnetic force scanning tunnelling microscopy
 		to recover the overwritten header. According to Peter Gutmann, data should be overwritten 22
 		times (ideally, 35 times) using non-random patterns and pseudorandom data. However, as users might
@@ -323,7 +335,7 @@ int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, i
 		of the header to differ substantially and in a random manner from the versions written during the
 		other passes. */
 
-		for (wipePass = 0; wipePass < PRAND_DISK_WIPE_PASSES; wipePass++)
+		for (wipePass = 0; wipePass < wipePassCount; wipePass++)
 		{
 			// Prepare new volume header
 			nStatus = CreateVolumeHeaderInMemory (FALSE,
@@ -341,7 +353,7 @@ int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, i
 				cryptoInfo->RequiredProgramVersion,
 				cryptoInfo->HeaderFlags,
 				cryptoInfo->SectorSize,
-				wipePass < PRAND_DISK_WIPE_PASSES - 1);
+				wipePass < wipePassCount - 1);
 
 			if (ci != NULL)
 				crypto_close (ci);

src/Common/Password.h

@@ -35,7 +35,7 @@ typedef struct
 void VerifyPasswordAndUpdate ( HWND hwndDlg , HWND hButton , HWND hPassword , HWND hVerify , unsigned char *szPassword , char *szVerify, BOOL keyFilesEnabled );
 BOOL CheckPasswordLength (HWND hwndDlg, HWND hwndItem);		
 BOOL CheckPasswordCharEncoding (HWND hPassword, Password *ptrPw);			
-int ChangePwd (char *lpszVolume, Password *oldPassword, Password *newPassword, int pkcs5, HWND hwndDlg);
+int ChangePwd (const char *lpszVolume, Password *oldPassword, Password *newPassword, int pkcs5, int wipePassCount, HWND hwndDlg);
 
 #endif	// defined(_WIN32) && !defined(TC_WINDOWS_DRIVER)
 

src/Common/Pkcs5.c

@@ -14,7 +14,6 @@
 #include <memory.h>
 #include "Rmd160.h"
 #ifndef TC_WINDOWS_BOOT
-#include "Sha1.h"
 #include "Sha2.h"
 #include "Whirlpool.h"
 #endif
@@ -175,150 +174,6 @@ void derive_key_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, int it
 	burn (u, sizeof(u));
 }
 
-
-/* Deprecated/legacy */
-void hmac_sha1
-(
-	  char *k,		/* secret key */
-	  int lk,		/* length of the key in bytes */
-	  char *d,		/* data */
-	  int ld,		/* length of data in bytes */
-	  char *out,		/* output buffer, at least "t" bytes */
-	  int t
-)
-{
-	sha1_ctx ictx, octx;
-	char isha[SHA1_DIGESTSIZE], osha[SHA1_DIGESTSIZE];
-	char key[SHA1_DIGESTSIZE];
-	char buf[SHA1_BLOCKSIZE];
-	int i;
-
-    /* If the key is longer than the hash algorithm block size,
-	   let key = sha1(key), as per HMAC specifications. */
-	if (lk > SHA1_BLOCKSIZE)
-	{
-		sha1_ctx tctx;
-
-		sha1_begin (&tctx);
-		sha1_hash ((unsigned char *) k, lk, &tctx);
-		sha1_end ((unsigned char *) key, &tctx);
-
-		k = key;
-		lk = SHA1_DIGESTSIZE;
-
-		burn (&tctx, sizeof(tctx));		// Prevent leaks
-	}
-
-	/**** Inner Digest ****/
-
-	sha1_begin (&ictx);
-
-	/* Pad the key for inner digest */
-	for (i = 0; i < lk; ++i)
-		buf[i] = (char) (k[i] ^ 0x36);
-	for (i = lk; i < SHA1_BLOCKSIZE; ++i)
-		buf[i] = 0x36;
-
-	sha1_hash ((unsigned char *) buf, SHA1_BLOCKSIZE, &ictx);
-	sha1_hash ((unsigned char *) d, ld, &ictx);
-
-	sha1_end ((unsigned char *) isha, &ictx);
-
-	/**** Outer Digest ****/
-
-	sha1_begin (&octx);
-
-	for (i = 0; i < lk; ++i)
-		buf[i] = (char) (k[i] ^ 0x5C);
-	for (i = lk; i < SHA1_BLOCKSIZE; ++i)
-		buf[i] = 0x5C;
-
-	sha1_hash ((unsigned char *) buf, SHA1_BLOCKSIZE, &octx);
-	sha1_hash ((unsigned char *) isha, SHA1_DIGESTSIZE, &octx);
-
-	sha1_end ((unsigned char *) osha, &octx);
-
-	/* truncate and print the results */
-	t = t > SHA1_DIGESTSIZE ? SHA1_DIGESTSIZE : t;
-	hmac_truncate (osha, out, t);
-
-	/* Prevent leaks */
-	burn (&ictx, sizeof(ictx));
-	burn (&octx, sizeof(octx));
-	burn (isha, sizeof(isha));
-	burn (osha, sizeof(osha));
-	burn (buf, sizeof(buf));
-	burn (key, sizeof(key));
-}
-
-
-/* Deprecated/legacy */
-void derive_u_sha1 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b)
-{
-	char j[SHA1_DIGESTSIZE], k[SHA1_DIGESTSIZE];
-	char init[128];
-	char counter[4];
-	int c, i;
-
-	/* iteration 1 */
-	memset (counter, 0, 4);
-	counter[3] = (char) b;
-	memcpy (init, salt, salt_len);	/* salt */
-	memcpy (&init[salt_len], counter, 4);	/* big-endian block number */
-	hmac_sha1 (pwd, pwd_len, init, salt_len + 4, j, SHA1_DIGESTSIZE);
-	memcpy (u, j, SHA1_DIGESTSIZE);
-
-	/* remaining iterations */
-	for (c = 1; c < iterations; c++)
-	{
-		hmac_sha1 (pwd, pwd_len, j, SHA1_DIGESTSIZE, k, SHA1_DIGESTSIZE);
-		for (i = 0; i < SHA1_DIGESTSIZE; i++)
-		{
-			u[i] ^= k[i];
-			j[i] = k[i];
-		}
-	}
-
-	/* Prevent possible leaks. */
-	burn (j, sizeof(j));
-	burn (k, sizeof(k));
-}
-
-
-/* Deprecated/legacy */
-void derive_key_sha1 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen)
-{
-	char u[SHA1_DIGESTSIZE];
-	int b, l, r;
-
-	if (dklen % SHA1_DIGESTSIZE)
-	{
-		l = 1 + dklen / SHA1_DIGESTSIZE;
-	}
-	else
-	{
-		l = dklen / SHA1_DIGESTSIZE;
-	}
-
-	r = dklen - (l - 1) * SHA1_DIGESTSIZE;
-
-	/* first l - 1 blocks */
-	for (b = 1; b < l; b++)
-	{
-		derive_u_sha1 (pwd, pwd_len, salt, salt_len, iterations, u, b);
-		memcpy (dk, u, SHA1_DIGESTSIZE);
-		dk += SHA1_DIGESTSIZE;
-	}
-
-	/* last block */
-	derive_u_sha1 (pwd, pwd_len, salt, salt_len, iterations, u, b);
-	memcpy (dk, u, r);
-
-
-	/* Prevent possible leaks. */
-	burn (u, sizeof(u));
-}
-
 #endif // TC_WINDOWS_BOOT
 
 void hmac_ripemd160 (char *key, int keylen, char *input, int len, char *digest)
@@ -393,7 +248,7 @@ void derive_u_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int
 	char init[128];
 	char counter[4];
 	int c, i, l;
-   int EnhanceSecurityLoops = (bNotTest)? 10 : 1;
+   int EnhanceSecurityLoops = (bNotTest)? 20 : 1;
 
 	/* iteration 1 */
 	memset (counter, 0, 4);
@@ -417,6 +272,21 @@ void derive_u_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int
 		}
 	}
 
+   /* add extra 10 loops to ensure backward compatibilty with the previous count (327661 for boot, 655331 for normal) */
+   if (iterations == 32767)
+   {
+      /* case of normal partition : add 10 iterations to have a total of 655331 = (32767 - 1)*20 + 1 + 10 */
+		for (c = 0; c < 10; c++)
+		{
+			hmac_ripemd160 (pwd, pwd_len, j, RIPEMD160_DIGESTSIZE, k);
+			for (i = 0; i < RIPEMD160_DIGESTSIZE; i++)
+			{
+				u[i] ^= k[i];
+				j[i] = k[i];
+			}
+		}
+   }
+
 	/* Prevent possible leaks. */
 	burn (j, sizeof(j));
 	burn (k, sizeof(k));
@@ -603,9 +473,6 @@ char *get_pkcs5_prf_name (int pkcs5_prf_id)
 	case SHA512:	
 		return "HMAC-SHA-512";
 
-	case SHA1:	// Deprecated/legacy
-		return "HMAC-SHA-1";
-
 	case RIPEMD160:	
 		return "HMAC-RIPEMD-160";
 
@@ -624,19 +491,14 @@ int get_pkcs5_iteration_count (int pkcs5_prf_id, BOOL bBoot)
 {
 	switch (pkcs5_prf_id)
 	{
-#ifdef TC_WINDOWS_BOOT
-	case RIPEMD160:	
-		return 32767; /* we multiply this number by 10 inside derive_u_ripemd160 */
 
-#else
 	case RIPEMD160:	
-		return bBoot? 32767 : 65534; /* we multiply this number by 10 inside derive_u_ripemd160 */
+		return bBoot? 16384 : 32767; /* we multiply this number by 10 inside derive_u_ripemd160 */
+
+#ifndef TC_WINDOWS_BOOT
 
 	case SHA512:	
-		return 500000;			
-
-	case SHA1:		// Deprecated/legacy		
-		return 1000000;			
+		return 500000;
 
 	case WHIRLPOOL:	
 		return 500000;

src/Common/Pkcs5.h

@@ -22,9 +22,6 @@ extern "C"
 void hmac_sha512 (char *k, int lk, char *d, int ld, char *out, int t);
 void derive_u_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b);
 void derive_key_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen);
-void hmac_sha1 (char *k, int lk, char *d, int ld, char *out, int t);
-void derive_u_sha1 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b);
-void derive_key_sha1 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen);
 void hmac_ripemd160 (char *key, int keylen, char *input, int len, char *digest);
 void derive_u_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b);
 void derive_key_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen);

src/Common/Progress.c

@@ -17,6 +17,8 @@
 #include "../Format/FormatCom.h"
 #include "../Format/resource.h"
 
+#include <Strsafe.h>
+
 static ULONG prevTime, startTime;
 static __int64 TotalSize;
 static __int64 resumedPointBytesDone;
@@ -74,31 +76,31 @@ BOOL UpdateProgressBarProc (__int64 byteOffset)
 		double perc = (double) (100.0 * (bProgressBarReverse ? ((double) (TotalSize - byteOffset)) : ((double) byteOffset)) / (TotalSize == 0 ? 0.0001 : ((double) TotalSize)));
 
 		if (perc > 99.999999999)
-			wcscpy (text, GetString ("PROCESSED_PORTION_100_PERCENT"));
+			StringCbCopyW (text,sizeof(text),  GetString ("PROCESSED_PORTION_100_PERCENT"));
 		else
-			_snwprintf (text, sizeof text/2, GetString ("PROCESSED_PORTION_X_PERCENT"), perc);
+			StringCbPrintfW (text, sizeof text, GetString ("PROCESSED_PORTION_X_PERCENT"), perc);
 
-		wcscat (speed, L" ");
+		StringCbCatW (speed, sizeof(speed), L" ");
 	}
 	else
 	{
-		GetSizeString (bytesDone, text);
+		GetSizeString (bytesDone, text, sizeof(text));
 		if (bytesDone < (unsigned __int64) BYTES_PER_MB * 1000000)
-			swprintf(text, L"%I64d %s ", bytesDone / BYTES_PER_MB, GetString ("MB"));
+			StringCbPrintfW(text, sizeof(text), L"%I64d %s ", bytesDone / BYTES_PER_MB, GetString ("MB"));
 		else if (bytesDone < (unsigned __int64) BYTES_PER_GB * 1000000)
-			swprintf(text, L"%I64d %s ", bytesDone / BYTES_PER_GB, GetString ("GB"));
+			StringCbPrintfW(text, sizeof(text), L"%I64d %s ", bytesDone / BYTES_PER_GB, GetString ("GB"));
 		else if (bytesDone < (unsigned __int64) BYTES_PER_TB * 1000000)
-			swprintf(text, L"%I64d %s ", bytesDone / BYTES_PER_TB, GetString ("TB"));
+			StringCbPrintfW(text, sizeof(text), L"%I64d %s ", bytesDone / BYTES_PER_TB, GetString ("TB"));
 		else
-			swprintf(text, L"%I64d %s ", bytesDone / BYTES_PER_PB, GetString ("PB"));
+			StringCbPrintfW(text, sizeof(text), L"%I64d %s ", bytesDone / BYTES_PER_PB, GetString ("PB"));
 	}
 
 	SetWindowTextW (GetDlgItem (hCurPage, IDC_BYTESWRITTEN), text);
 
 	if (!bShowStatus)
 	{
-		GetSpeedString (bRWThroughput ? bytesPerSec*2 : bytesPerSec, speed);
-		wcscat (speed, L" ");
+		GetSpeedString (bRWThroughput ? bytesPerSec*2 : bytesPerSec, speed, sizeof(speed));
+		StringCbCatW (speed, sizeof(speed), L" ");
 		SetWindowTextW (GetDlgItem (hCurPage, IDC_WRITESPEED), speed);
 	}
 
@@ -107,15 +109,15 @@ BOOL UpdateProgressBarProc (__int64 byteOffset)
 		int64 sec = (int64) ((bProgressBarReverse ? byteOffset : (TotalSize - byteOffset)) / (bytesPerSec == 0 ? 0.001 : bytesPerSec));
 
 		if (bytesPerSec == 0 || sec > 60 * 60 * 24 * 999)
-			swprintf (text, L"%s ", GetString ("NOT_APPLICABLE_OR_NOT_AVAILABLE"));
+			StringCbPrintfW (text, sizeof(text), L"%s ", GetString ("NOT_APPLICABLE_OR_NOT_AVAILABLE"));
 		else if (sec >= 60 * 60 * 24 * 2)
-			swprintf (text, L"%I64d %s ", sec / (60 * 24 * 60), days);
+			StringCbPrintfW (text, sizeof(text), L"%I64d %s ", sec / (60 * 24 * 60), days);
 		else if (sec >= 120 * 60)
-			swprintf (text, L"%I64d %s ", sec / (60 * 60), hours);
+			StringCbPrintfW (text, sizeof(text), L"%I64d %s ", sec / (60 * 60), hours);
 		else if (sec >= 120)
-			swprintf (text, L"%I64d %s ", sec / 60, minutes);
+			StringCbPrintfW (text, sizeof(text), L"%I64d %s ", sec / 60, minutes);
 		else
-			swprintf (text, L"%I64d %s ", sec, seconds);
+			StringCbPrintfW (text, sizeof(text), L"%I64d %s ", sec, seconds);
 
 		SetWindowTextW (GetDlgItem (hCurPage, IDC_TIMEREMAIN), text);
 	}

src/Common/Random.c

@@ -12,6 +12,7 @@
 #include "Tcdefs.h"
 #include "Crc.h"
 #include "Random.h"
+#include <Strsafe.h>
 
 static unsigned __int8 buffer[RNG_POOL_SIZE];
 static unsigned char *pRandPool = NULL;
@@ -573,7 +574,15 @@ BOOL SlowPoll (void)
 	{
 		/* Obtain a handle to the module containing the Lan Manager
 		   functions */
-		hNetAPI32 = LoadLibrary ("NETAPI32.DLL");
+		char dllPath[MAX_PATH];
+		if (GetSystemDirectory (dllPath, MAX_PATH))
+		{
+			StringCbCatA(dllPath, sizeof(dllPath), "\\NETAPI32.DLL");
+		}
+		else
+			StringCbCopyA(dllPath, sizeof(dllPath), "C:\\Windows\\System32\\NETAPI32.DLL");
+
+		hNetAPI32 = LoadLibrary (dllPath);
 		if (hNetAPI32 != NULL)
 		{
 			/* Now get pointers to the functions */
@@ -622,7 +631,7 @@ BOOL SlowPoll (void)
 		char szDevice[24];
 
 		/* Check whether we can access this device */
-		sprintf (szDevice, "\\\\.\\PhysicalDrive%d", nDrive);
+		StringCbPrintfA (szDevice, sizeof(szDevice), "\\\\.\\PhysicalDrive%d", nDrive);
 		hDevice = CreateFile (szDevice, 0, FILE_SHARE_READ | FILE_SHARE_WRITE,
 				      NULL, OPEN_EXISTING, 0, NULL);
 		if (hDevice == INVALID_HANDLE_VALUE)

src/Common/Registry.c

@@ -8,6 +8,7 @@
 
 #include "Tcdefs.h"
 #include "Registry.h"
+#include <Strsafe.h>
 
 BOOL ReadLocalMachineRegistryDword (char *subKey, char *name, DWORD *value)
 {
@@ -104,13 +105,14 @@ char *ReadRegistryString (char *subKey, char *name, char *defaultValue, char *st
 	char value[MAX_PATH*4];
 	DWORD size = sizeof (value);
 
-	strncpy (str, defaultValue, maxLen-1);
+   str[maxLen-1] = 0;
+	StringCbCopyA (str, maxLen, defaultValue);
 
 	ZeroMemory (value, sizeof value);
 	if (RegOpenKeyEx (HKEY_CURRENT_USER, subKey,
 		0, KEY_READ, &hkey) == ERROR_SUCCESS)
-		if (RegQueryValueEx (hkey, name, 0,	0, (LPBYTE) &value,	&size) == ERROR_SUCCESS)
-			strncpy (str, value, maxLen-1);
+		if (RegQueryValueEx (hkey, name, 0,	0, (LPBYTE) value,	&size) == ERROR_SUCCESS)
+			StringCbCopyA (str, maxLen,value);
 
 	RegCloseKey (hkey);
 	return str;
@@ -168,6 +170,30 @@ BOOL WriteLocalMachineRegistryDword (char *subKey, char *name, DWORD value)
 	return TRUE;
 }
 
+BOOL WriteLocalMachineRegistryDwordW (WCHAR *subKey, WCHAR *name, DWORD value)
+{
+	HKEY hkey = 0;
+	DWORD disp;
+	LONG status;
+
+	if ((status = RegCreateKeyExW (HKEY_LOCAL_MACHINE, subKey,
+		0, NULL, REG_OPTION_NON_VOLATILE, KEY_WRITE, NULL, &hkey, &disp)) != ERROR_SUCCESS)
+	{
+		SetLastError (status);
+		return FALSE;
+	}
+
+	if ((status = RegSetValueExW (hkey, name, 0, REG_DWORD, (BYTE *) &value, sizeof value)) != ERROR_SUCCESS)
+	{
+		RegCloseKey (hkey);
+		SetLastError (status);
+		return FALSE;
+	}
+
+	RegCloseKey (hkey);
+	return TRUE;
+}
+
 BOOL WriteLocalMachineRegistryMultiString (char *subKey, char *name, char *multiString, DWORD size)
 {
 	HKEY hkey = 0;
@@ -278,9 +304,9 @@ void DeleteRegistryValue (char *subKey, char *name)
 }
 
 
-void GetStartupRegKeyName (char *regk)
+void GetStartupRegKeyName (char *regk, size_t cbRegk)
 {
 	// The string is split in order to prevent some antivirus packages from falsely reporting  
 	// TrueCrypt.exe to contain a possible Trojan horse because of this string (heuristic scan).
-	sprintf (regk, "%s%s", "Software\\Microsoft\\Windows\\Curren", "tVersion\\Run");
+	StringCbPrintfA (regk, cbRegk,"%s%s", "Software\\Microsoft\\Windows\\Curren", "tVersion\\Run");
 }

src/Common/Registry.h

@@ -19,13 +19,14 @@ char *ReadRegistryString (char *subKey, char *name, char *defaultValue, char *st
 DWORD ReadRegistryBytes (char *path, char *name, char *value, int maxLen);
 void WriteRegistryInt (char *subKey, char *name, int value);
 BOOL WriteLocalMachineRegistryDword (char *subKey, char *name, DWORD value);
+BOOL WriteLocalMachineRegistryDwordW (WCHAR *subKey, WCHAR *name, DWORD value);
 BOOL WriteLocalMachineRegistryMultiString (char *subKey, char *name, char *multiString, DWORD size);
 BOOL WriteLocalMachineRegistryString (char *subKey, char *name, char *str, BOOL expandable);
 void WriteRegistryString (char *subKey, char *name, char *str);
 BOOL WriteRegistryBytes (char *path, char *name, char *str, DWORD size);
 BOOL DeleteLocalMachineRegistryKey (char *parentKey, char *subKeyToDelete);
 void DeleteRegistryValue (char *subKey, char *name);
-void GetStartupRegKeyName (char *regk);
+void GetStartupRegKeyName (char *regk, size_t cbRegk);
 
 #ifdef  __cplusplus
 }

src/Common/SecurityToken.cpp

@@ -30,7 +30,7 @@
 
 using namespace std;
 
-namespace TrueCrypt
+namespace VeraCrypt
 {
 	SecurityTokenKeyfile::SecurityTokenKeyfile (const SecurityTokenKeyfilePath &path)
 	{

src/Common/SecurityToken.h

@@ -49,7 +49,7 @@
 #define TC_SECURITY_TOKEN_KEYFILE_URL_SLOT L"slot"
 #define TC_SECURITY_TOKEN_KEYFILE_URL_FILE L"file"
 
-namespace TrueCrypt
+namespace VeraCrypt
 {
 	struct SecurityTokenInfo
 	{
@@ -69,7 +69,7 @@ namespace TrueCrypt
 
 	struct SecurityTokenKeyfile
 	{
-		SecurityTokenKeyfile () { }
+		SecurityTokenKeyfile () : Handle(CK_INVALID_HANDLE), SlotId(CK_UNAVAILABLE_INFORMATION) { Token.SlotId = CK_UNAVAILABLE_INFORMATION; Token.Flags = 0; }
 		SecurityTokenKeyfile (const SecurityTokenKeyfilePath &path);
 
 		operator SecurityTokenKeyfilePath () const;
@@ -85,7 +85,8 @@ namespace TrueCrypt
 	{
 		Pkcs11Exception (CK_RV errorCode = (CK_RV) -1)
 			: ErrorCode (errorCode),
-			SubjectErrorCodeValid (false)
+			SubjectErrorCodeValid (false),
+			SubjectErrorCode( (uint64) -1)
 		{
 		}
 
@@ -155,7 +156,7 @@ namespace TrueCrypt
 
 	struct Pkcs11Session
 	{
-		Pkcs11Session () : UserLoggedIn (false) { }
+		Pkcs11Session () : Handle (CK_UNAVAILABLE_INFORMATION), UserLoggedIn (false) { }
 
 		CK_SESSION_HANDLE Handle;
 		bool UserLoggedIn;

src/Common/Tcdefs.h

@@ -15,15 +15,15 @@
 #define TC_APP_NAME						"VeraCrypt"
 
 // Version displayed to user 
-#define VERSION_STRING					"1.0b"
+#define VERSION_STRING					"1.0d"
 
 // Version number to compare against driver
-#define VERSION_NUM						0x010b
+#define VERSION_NUM						0x010d
 
 // Release date
-#define TC_STR_RELEASE_DATE				"June 26, 2013"
-#define TC_RELEASE_DATE_YEAR			2013
-#define TC_RELEASE_DATE_MONTH			6
+#define TC_STR_RELEASE_DATE				"June 3, 2014"
+#define TC_RELEASE_DATE_YEAR			2014
+#define TC_RELEASE_DATE_MONTH			06
 
 #define BYTES_PER_KB                    1024LL
 #define BYTES_PER_MB                    1048576LL
@@ -197,7 +197,7 @@ typedef int BOOL;
 #		ifdef DEVICE_DRIVER
 #			define trace_msg Dump
 #		elif defined (_WIN32)
-#			define trace_msg(...) do { char msg[2048]; _snprintf (msg, sizeof (msg), __VA_ARGS__); OutputDebugString (msg); } while (0)
+#			define trace_msg(...) do { char msg[2048]; StringCbPrintfA (msg, sizeof (msg), __VA_ARGS__); OutputDebugString (msg); } while (0)
 #		endif
 #		define trace_point trace_msg (__FUNCTION__ ":" TC_TO_STRING(__LINE__) "\n")
 #	else
@@ -252,8 +252,8 @@ void EraseMemory (void *memory, int size);
 #define MAX_URL_LENGTH	2084 /* Internet Explorer limit. Includes the terminating null character. */
 
 #define TC_HOMEPAGE "http://www.idrix.fr/"
-#define TC_APPLINK "http://www.idrix.fr/"
-#define TC_APPLINK_SECURE "https://www.idrix.fr/"
+#define TC_APPLINK "http://sourceforge.net/projects/veracrypt/"
+#define TC_APPLINK_SECURE "https://sourceforge.net/projects/veracrypt/"
 
 enum
 {

src/Common/Tests.c

@@ -290,91 +290,6 @@ BOOL XTSAesTest (PCRYPTO_INFO ci)
 	return TRUE;
 }
 
-/* Blowfish Test Vectors (deprecated/legacy) */
-
-/* Blowfish test vectors from www.counterpane.com/blowfish.html */
-
-#define BF_TEST_COUNT 34
-
-typedef struct {
-	unsigned char key[8];
-	unsigned char plaintext[8];
-	unsigned char ciphertext[8];
-	} BF_TEST;
-
-#pragma warning(disable:4295)
-
-BF_TEST bf_ecb_vectors[BF_TEST_COUNT] = {
-"\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00","\x4E\xF9\x97\x45\x61\x98\xDD\x78",
-"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF","\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF","\x51\x86\x6F\xD5\xB8\x5E\xCB\x8A",
-"\x30\x00\x00\x00\x00\x00\x00\x00","\x10\x00\x00\x00\x00\x00\x00\x01","\x7D\x85\x6F\x9A\x61\x30\x63\xF2",
-"\x11\x11\x11\x11\x11\x11\x11\x11","\x11\x11\x11\x11\x11\x11\x11\x11","\x24\x66\xDD\x87\x8B\x96\x3C\x9D",
-"\x01\x23\x45\x67\x89\xAB\xCD\xEF","\x11\x11\x11\x11\x11\x11\x11\x11","\x61\xF9\xC3\x80\x22\x81\xB0\x96",
-"\x11\x11\x11\x11\x11\x11\x11\x11","\x01\x23\x45\x67\x89\xAB\xCD\xEF","\x7D\x0C\xC6\x30\xAF\xDA\x1E\xC7",
-"\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00","\x4E\xF9\x97\x45\x61\x98\xDD\x78",
-"\xFE\xDC\xBA\x98\x76\x54\x32\x10","\x01\x23\x45\x67\x89\xAB\xCD\xEF","\x0A\xCE\xAB\x0F\xC6\xA0\xA2\x8D",
-"\x7C\xA1\x10\x45\x4A\x1A\x6E\x57","\x01\xA1\xD6\xD0\x39\x77\x67\x42","\x59\xC6\x82\x45\xEB\x05\x28\x2B",
-"\x01\x31\xD9\x61\x9D\xC1\x37\x6E","\x5C\xD5\x4C\xA8\x3D\xEF\x57\xDA","\xB1\xB8\xCC\x0B\x25\x0F\x09\xA0",
-"\x07\xA1\x13\x3E\x4A\x0B\x26\x86","\x02\x48\xD4\x38\x06\xF6\x71\x72","\x17\x30\xE5\x77\x8B\xEA\x1D\xA4",
-"\x38\x49\x67\x4C\x26\x02\x31\x9E","\x51\x45\x4B\x58\x2D\xDF\x44\x0A","\xA2\x5E\x78\x56\xCF\x26\x51\xEB",
-"\x04\xB9\x15\xBA\x43\xFE\xB5\xB6","\x42\xFD\x44\x30\x59\x57\x7F\xA2","\x35\x38\x82\xB1\x09\xCE\x8F\x1A",
-"\x01\x13\xB9\x70\xFD\x34\xF2\xCE","\x05\x9B\x5E\x08\x51\xCF\x14\x3A","\x48\xF4\xD0\x88\x4C\x37\x99\x18",
-"\x01\x70\xF1\x75\x46\x8F\xB5\xE6","\x07\x56\xD8\xE0\x77\x47\x61\xD2","\x43\x21\x93\xB7\x89\x51\xFC\x98",
-"\x43\x29\x7F\xAD\x38\xE3\x73\xFE","\x76\x25\x14\xB8\x29\xBF\x48\x6A","\x13\xF0\x41\x54\xD6\x9D\x1A\xE5",
-"\x07\xA7\x13\x70\x45\xDA\x2A\x16","\x3B\xDD\x11\x90\x49\x37\x28\x02","\x2E\xED\xDA\x93\xFF\xD3\x9C\x79",
-"\x04\x68\x91\x04\xC2\xFD\x3B\x2F","\x26\x95\x5F\x68\x35\xAF\x60\x9A","\xD8\x87\xE0\x39\x3C\x2D\xA6\xE3",
-"\x37\xD0\x6B\xB5\x16\xCB\x75\x46","\x16\x4D\x5E\x40\x4F\x27\x52\x32","\x5F\x99\xD0\x4F\x5B\x16\x39\x69",
-"\x1F\x08\x26\x0D\x1A\xC2\x46\x5E","\x6B\x05\x6E\x18\x75\x9F\x5C\xCA","\x4A\x05\x7A\x3B\x24\xD3\x97\x7B",
-"\x58\x40\x23\x64\x1A\xBA\x61\x76","\x00\x4B\xD6\xEF\x09\x17\x60\x62","\x45\x20\x31\xC1\xE4\xFA\xDA\x8E",
-"\x02\x58\x16\x16\x46\x29\xB0\x07","\x48\x0D\x39\x00\x6E\xE7\x62\xF2","\x75\x55\xAE\x39\xF5\x9B\x87\xBD",
-"\x49\x79\x3E\xBC\x79\xB3\x25\x8F","\x43\x75\x40\xC8\x69\x8F\x3C\xFA","\x53\xC5\x5F\x9C\xB4\x9F\xC0\x19",
-"\x4F\xB0\x5E\x15\x15\xAB\x73\xA7","\x07\x2D\x43\xA0\x77\x07\x52\x92","\x7A\x8E\x7B\xFA\x93\x7E\x89\xA3",
-"\x49\xE9\x5D\x6D\x4C\xA2\x29\xBF","\x02\xFE\x55\x77\x81\x17\xF1\x2A","\xCF\x9C\x5D\x7A\x49\x86\xAD\xB5",
-"\x01\x83\x10\xDC\x40\x9B\x26\xD6","\x1D\x9D\x5C\x50\x18\xF7\x28\xC2","\xD1\xAB\xB2\x90\x65\x8B\xC7\x78",
-"\x1C\x58\x7F\x1C\x13\x92\x4F\xEF","\x30\x55\x32\x28\x6D\x6F\x29\x5A","\x55\xCB\x37\x74\xD1\x3E\xF2\x01",
-"\x01\x01\x01\x01\x01\x01\x01\x01","\x01\x23\x45\x67\x89\xAB\xCD\xEF","\xFA\x34\xEC\x48\x47\xB2\x68\xB2",
-"\x1F\x1F\x1F\x1F\x0E\x0E\x0E\x0E","\x01\x23\x45\x67\x89\xAB\xCD\xEF","\xA7\x90\x79\x51\x08\xEA\x3C\xAE",
-"\xE0\xFE\xE0\xFE\xF1\xFE\xF1\xFE","\x01\x23\x45\x67\x89\xAB\xCD\xEF","\xC3\x9E\x07\x2D\x9F\xAC\x63\x1D",
-"\x00\x00\x00\x00\x00\x00\x00\x00","\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF","\x01\x49\x33\xE0\xCD\xAF\xF6\xE4",
-"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF","\x00\x00\x00\x00\x00\x00\x00\x00","\xF2\x1E\x9A\x77\xB7\x1C\x49\xBC",
-"\x01\x23\x45\x67\x89\xAB\xCD\xEF","\x00\x00\x00\x00\x00\x00\x00\x00","\x24\x59\x46\x88\x57\x54\x36\x9A",
-"\xFE\xDC\xBA\x98\x76\x54\x32\x10","\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF","\x6B\x5C\x5A\x9C\x5D\x9E\x0A\x5A"
-};
-
-
-#define TRIPLEDES_TEST_COUNT 1
-
-typedef struct {
-	unsigned char key[24];
-	unsigned char plaintext[8];
-	unsigned char ciphertext[8];
-	} TRIPLEDES_TEST;
-
-TRIPLEDES_TEST tripledes_vectors[TRIPLEDES_TEST_COUNT] = {
-0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0xfe, 0xdc, 0xba, 0x98,
-0x76, 0x54, 0x32, 0x10, 0x89, 0xab, 0xcd, 0xef, 0x01, 0x23, 0x45, 0x67,
-                              
-0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xe7,
-
-0xde, 0x0b, 0x7c, 0x06, 0xae, 0x5e, 0x0e, 0xd5
-};
-
-/* CAST-128 Test Vectors from RFC2144 (deprecated/legacy) */
-
-#define CAST_TEST_COUNT 1
-
-typedef struct {
-	unsigned char key[16];
-	unsigned char plaintext[8];
-	unsigned char ciphertext[8];
-	} CAST_TEST;
-
-
-CAST_TEST cast_ecb_vectors[CAST_TEST_COUNT] = {
-	"\x01\x23\x45\x67\x12\x34\x56\x78\x23\x45\x67\x89\x34\x56\x78\x9A",
-	"\x01\x23\x45\x67\x89\xAB\xCD\xEF",
-	"\x23\x8B\x4F\xE5\x84\x7E\x44\xB2"
-	};
 
 // AES ECB test vectors FIPS-197
 
@@ -463,35 +378,6 @@ char *hmac_sha512_test_vectors[] =
 	"\xe3\x7b\x6a\x77\x5d\xc8\x7d\xba\xa4\xdf\xa9\xf9\x6e\x5e\x3f\xfd\xde\xbd\x71\xf8\x86\x72\x89\x86\x5d\xf5\xa3\x2d\x20\xcd\xc9\x44\xb6\x02\x2c\xac\x3c\x49\x82\xb1\x0d\x5e\xeb\x55\xc3\xe4\xde\x15\x13\x46\x76\xfb\x6d\xe0\x44\x60\x65\xc9\x74\x40\xfa\x8c\x6a\x58",
 };
 
-char *hmac_sha1_test_keys[] =
-{
-	// Deprecated/legacy
-	"\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3",
-	"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b",
-	"Jefe",
-	"\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA"
-};
-
-char *hmac_sha1_test_data[] =
-{
-	// Deprecated/legacy
-	"Sample #3",
-	"Hi There",
-	"what do ya want for nothing?",
-	"\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
-      "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
-	"\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
-};
-
-char *hmac_sha1_test_vectors[] =
-{
-	// Deprecated/legacy
-	"\xbc\xf4\x1e\xab\x8b\xb2\xd8\x02\xf3\xd0\x5c\xaf\x7c\xb0\x92\xec\xf8\xd1\xa3\xaa",
-	"\xb6\x17\x31\x86\x55\x05\x72\x64\xe2\x8b\xc0\xb6\xfb\x37\x8c\x8e\xf1\x46\xbe\x00",
-	"\xef\xfc\xdf\x6a\xe5\xeb\x2f\xa2\xd2\x74\x16\xd5\xf1\x84\xdf\x9c\x25\x9a\x7c\x79",
-	"\x12\x5d\x73\x42\xb9\xac\x11\xcd\x91\xa3\x9a\xf4\x8a\xa1\x7b\x4f\x63\xf1\x75\xd3"
-};
-
 char *hmac_ripemd160_test_keys[] =
 {
 	"\x00\x11\x22\x33\x44\x55\x66\x77\x88\x99\xaa\xbb\xcc\xdd\xee\xff\x01\x23\x45\x67",
@@ -534,29 +420,15 @@ void CipherInit2(int cipher, void* key, void* ks, int key_len)
 {
 	switch (cipher)
 	{
-	case BLOWFISH:
-		/* Deprecated/legacy */
-		BlowfishSetKey (ks, key_len,  key); 
-		break;
 
 	case AES:
 		CipherInit(cipher,key,ks);
 		break;
 
-	case CAST:
-		/* Deprecated/legacy */
-		CipherInit(cipher,key,ks);
-		break;
-
 	case SERPENT:
 		CipherInit(cipher,key,ks);
 		break;
 
-	case TRIPLEDES:
-		/* Deprecated/legacy */
-		CipherInit(cipher,key,ks);
-		break;
-
 	case TWOFISH:
 		CipherInit(cipher,key,ks);
 		break;
@@ -568,72 +440,6 @@ void CipherInit2(int cipher, void* key, void* ks, int key_len)
 }
 
 
-/* Deprecated/legacy */
-typedef struct {
-	unsigned __int8 key1[32];
-	unsigned __int8 key2[16];
-	unsigned __int8 index[16];
-	unsigned __int8 plaintext[16];
-	unsigned __int8 ciphertext[16];
-} LRW_TEST;
-
-#define LRW_TEST_COUNT 2
-
-/* Deprecated/legacy */
-LRW_TEST lrw_vectors[LRW_TEST_COUNT] = {
-	{
-		{ 0xf8, 0xd4, 0x76, 0xff, 0xd6, 0x46, 0xee, 0x6c, 0x23, 0x84, 0xcb, 0x1c, 0x77, 0xd6, 0x19, 0x5d,
-		  0xfe, 0xf1, 0xa9, 0xf3, 0x7b, 0xbc, 0x8d, 0x21, 0xa7, 0x9c, 0x21, 0xf8, 0xcb, 0x90, 0x02, 0x89 },
-		{ 0xa8, 0x45, 0x34, 0x8e, 0xc8, 0xc5, 0xb5, 0xf1, 0x26, 0xf5, 0x0e, 0x76, 0xfe, 0xfd, 0x1b, 0x1e },
-		{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 },
-		{ 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46 },
-		{ 0xbd, 0x06, 0xb8, 0xe1, 0xdb, 0x98, 0x89, 0x9e, 0xc4, 0x98, 0xe4, 0x91, 0xcf, 0x1c, 0x70, 0x2b }
-	},
-	{
-		{ 0xfb, 0x76, 0x15, 0xb2, 0x3d, 0x80, 0x89, 0x1d, 0xd4, 0x70, 0x98, 0x0b, 0xc7, 0x95, 0x84, 0xc8,
-		  0xb2, 0xfb, 0x64, 0xce, 0x60, 0x97, 0x87, 0x8d, 0x17, 0xfc, 0xe4, 0x5a, 0x49, 0xe8, 0x30, 0xb7 },
-		{ 0x6e, 0x78, 0x17, 0xe7, 0x2d, 0x5e, 0x12, 0xd4, 0x60, 0x64, 0x04, 0x7a, 0xf1, 0x2f, 0x9e, 0x0c },
-		{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00 },
-		{ 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46 },
-		{ 0x5b, 0x90, 0x8e, 0xc1, 0xab, 0xdd, 0x67, 0x5f, 0x3d, 0x69, 0x8a, 0x95, 0x53, 0xc8, 0x9c, 0xe5 }
-	}
-};
-
-
-BOOL LRWAesTest (PCRYPTO_INFO ci)
-{
-	/* Deprecated/legacy */
-
-	unsigned __int8 p[16];
-	int i;
-
-	for (i = 0; i < LRW_TEST_COUNT; i++)
-	{
-		ci->ea = EAGetByName ("AES");
-		if (ci->ea == 0)
-			return FALSE;
-
-		ci->mode = LRW;
-
-		if (EAInit (ci->ea, lrw_vectors[i].key1, ci->ks) != ERR_SUCCESS)
-			return FALSE;
-
-		memcpy (&ci->k2, lrw_vectors[i].key2, sizeof (lrw_vectors[i].key2));
-		if (!EAInitMode (ci))
-			return FALSE;
-
-		memcpy (p, lrw_vectors[i].plaintext, sizeof (p));
-
-		EncryptBufferLRW128 (p, sizeof (p), BE64(((unsigned __int64 *)(lrw_vectors[i].index))[1]), ci);
-
-		if (memcmp (lrw_vectors[i].ciphertext, p, sizeof (p)) != 0)
-			return FALSE;
-	}
-
-	return TRUE;
-}
-
-
 BOOL TestSectorBufEncryption (PCRYPTO_INFO ci)
 {
 	unsigned char buf [ENCRYPTION_DATA_UNIT_SIZE * 4];
@@ -653,15 +459,12 @@ BOOL TestSectorBufEncryption (PCRYPTO_INFO ci)
 		0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13
 	};
 
-	if (!TestLegacySectorBufEncryption (ci))
-		return FALSE;
-
 
 	/* Encryption/decryption of data units (typically, volume data sectors) */
 
 	nbrUnits = sizeof (buf) / ENCRYPTION_DATA_UNIT_SIZE;
 
-	ci->mode = XTS;	// Other modes of operation are tested in TestLegacySectorBufEncryption()
+	ci->mode = XTS;	// we only implement XTS
 
 	/* The buffer can accommodate 4 data units and we'll test 4 cases by "scrolling". The data unit 0xFFFFFFFFFF
 	will "move" from the start of the buffer to its end. For a 512-byte data unit, the byte offset 562949953420800
@@ -1029,340 +832,6 @@ BOOL TestSectorBufEncryption (PCRYPTO_INFO ci)
 	return (nTestsPerformed == 80);
 }
 
-
-BOOL TestLegacySectorBufEncryption (PCRYPTO_INFO ci)
-{
-	unsigned char buf [ENCRYPTION_DATA_UNIT_SIZE * 2];
-	unsigned int i;
-	char name[64];
-	unsigned __int32 crc;
-	UINT64_STRUCT unitNo;
-	uint32 nbrUnits;
-	int blockSize;
-	BOOL lrw64InitDone = FALSE;
-	BOOL lrw128InitDone = FALSE;
-	int nTestsPerformed = 0;
-
-	unitNo.Value = 0x0234567890ABCDEFull;
-	nbrUnits = sizeof (buf) / ENCRYPTION_DATA_UNIT_SIZE;
-
-	for (i = 0; i < sizeof (buf); i++)
-		buf[i] = (unsigned char) i;
-
-	for (i = 0; i < sizeof (ci->k2); i++)
-		ci->k2[i] = (unsigned char) i;
-
-	// Test all EAs
-	for (ci->ea = EAGetFirst (); ci->ea != 0; ci->ea = EAGetNext (ci->ea))
-	{
-		EAGetName (name, ci->ea);
-		blockSize = CipherGetBlockSize (EAGetFirstCipher (ci->ea));
-
-		if (EAInit (ci->ea, (unsigned char *)buf, ci->ks) == ERR_CIPHER_INIT_FAILURE)
-			return FALSE;
-
-		// Test all deprecated modes of operation
-		for (ci->mode = EAGetFirstMode (ci->ea);
-			ci->mode != 0;
-			ci->mode = EAGetNextMode (ci->ea, ci->mode))
-		{
-			// Skip modes that are not deprecated
-			if (ci->mode == XTS)
-				continue;
-
-			if (ci->mode == LRW
-				&& (blockSize == 8 && !lrw64InitDone || blockSize == 16 && !lrw128InitDone ))
-			{
-				if (!EAInitMode (ci))
-					return FALSE;
-
-				if (blockSize == 8)
-					lrw64InitDone = TRUE;
-				else if (blockSize == 16)
-					lrw128InitDone = TRUE;
-			}
-
-			EncryptDataUnits (buf, &unitNo, nbrUnits, ci);
-			crc = GetCrc32 (buf, sizeof (buf));
-
-			switch (ci->mode)
-			{
-			case LRW:		// Deprecated/legacy
-				if (strcmp (name, "AES") == 0)
-				{
-					if (crc != 0x5237acf9)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Blowfish") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0xf94d5300)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "CAST5") == 0)		// Deprecated/legacy
-				{
-					if (crc != 0x33971e82)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent") == 0)
-				{
-					if (crc != 0x7fb86805)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Triple DES") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0x2b20bb84)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Twofish") == 0)
-				{
-					if (crc != 0xa9de0f0b)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Twofish") == 0)
-				{
-					if (crc != 0x4ed0fd80)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Twofish-Serpent") == 0)
-				{
-					if (crc != 0xea04b3cf)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent-AES") == 0)
-				{
-					if (crc != 0x0d33596a)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent-Twofish-AES") == 0)
-				{
-					if (crc != 0x2845d0e3)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Twofish-Serpent") == 0)
-				{
-					if (crc != 0xca65c5cd)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				break;
-
-			case CBC:		// Deprecated/legacy
-			case INNER_CBC:	// Deprecated/legacy
-			case OUTER_CBC:	// Deprecated/legacy
-				if (strcmp (name, "AES") == 0)
-				{
-					if (crc != 0x2274f53d)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Blowfish") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0x033899a1)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "CAST5") == 0)		// Deprecated/legacy
-				{
-					if (crc != 0x331cecc7)	
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent") == 0)
-				{
-					if (crc != 0x42dff3d4)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Triple DES") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0xfe497d0c)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Blowfish") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0xa7a80c84)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Blowfish-Serpent") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0xa0584562)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Twofish") == 0)
-				{
-					if (crc != 0x3c226444)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Twofish-Serpent") == 0)
-				{
-					if (crc != 0x5e5e77fd)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent-AES") == 0)
-				{
-					if (crc != 0x57c612d5)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent-Twofish-AES") == 0)
-				{
-					if (crc != 0x081e045a)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Twofish-Serpent") == 0)
-				{
-					if (crc != 0xa7b659f3)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				break;
-			}
-
-			if (crc == 0xb70b4c26)
-				return FALSE;
-
-			DecryptDataUnits (buf, &unitNo, nbrUnits, ci);
-
-			if (GetCrc32 (buf, sizeof (buf)) != 0xb70b4c26)
-				return FALSE;
-
-			nTestsPerformed++;
-
-			EncryptBuffer (buf, sizeof (buf), ci);
-			crc = GetCrc32 (buf, sizeof (buf));
-
-			switch (ci->mode)
-			{
-			case LRW:		// Deprecated/legacy
-				if (strcmp (name, "AES") == 0)
-				{
-					if (crc != 0x5ae1e3d8)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Blowfish") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0x2738426f)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Twofish-Serpent") == 0)
-				{
-					if (crc != 0x14f2948a)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				break;
-
-			case CBC:		// Deprecated/legacy
-			case INNER_CBC:	// Deprecated/legacy
-			case OUTER_CBC:	// Deprecated/legacy
-				if (strcmp (name, "AES") == 0)
-				{
-					if (crc != 0x960f740e)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Blowfish") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0x7e1cfabb)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "CAST5") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0xeaae21c8)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent") == 0)
-				{
-					if (crc != 0xa8139d62)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Triple DES") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0xecf5d7d0)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Blowfish") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0xb70171b6)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Blowfish-Serpent") == 0)	// Deprecated/legacy
-				{
-					if (crc != 0x1e749a87)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Twofish") == 0)
-				{
-					if (crc != 0xb4b8bb9b)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "AES-Twofish-Serpent") == 0)
-				{
-					if (crc != 0x76b6c1cb)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent-AES") == 0)
-				{
-					if (crc != 0x634f12ed)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Serpent-Twofish-AES") == 0)
-				{
-					if (crc != 0xe54bc1b9)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				else if (strcmp (name, "Twofish-Serpent") == 0)
-				{
-					if (crc != 0x21cdb382)
-						return FALSE;
-					nTestsPerformed++;
-				}
-				break;
-			}
-
-			if (crc == 0xb70b4c26)
-				return FALSE;
-
-			DecryptBuffer (buf, sizeof (buf), ci);
-
-			if (GetCrc32 (buf, sizeof (buf)) != 0xb70b4c26)
-				return FALSE;
-
-			nTestsPerformed++;
-		}
-	}
-	return (nTestsPerformed == 86);
-}
-
-
 static BOOL DoAutoTestAlgorithms (void)
 {
 	PCRYPTO_INFO ci;
@@ -1377,74 +846,6 @@ static BOOL DoAutoTestAlgorithms (void)
 
 	memset (ci, 0, sizeof (*ci));
 
-	/* Blowfish (deprecated/legacy) */
-
-	for (i=0;i<BF_TEST_COUNT;i++)
-	{		
-		memcpy(key, bf_ecb_vectors[i].key, 8);
-		memcpy(tmp, bf_ecb_vectors[i].plaintext, 8);
-		CipherInit2(BLOWFISH, key, ks_tmp, 8);
-
-		((uint32 *)tmp)[0] = BE32 (((uint32 *)tmp)[0]);
-		((uint32 *)tmp)[1] = BE32 (((uint32 *)tmp)[1]);
-
-		BlowfishEncryptLE (tmp,tmp,(BF_KEY *)ks_tmp,1);
-		BlowfishEncryptLE (tmp,tmp,(BF_KEY *)ks_tmp,0);
-		BlowfishEncryptLE (tmp,tmp,(BF_KEY *)ks_tmp,1);
-
-		((uint32 *)tmp)[0] = BE32 (((uint32 *)tmp)[0]);
-		((uint32 *)tmp)[1] = BE32 (((uint32 *)tmp)[1]);
-
-		if (memcmp(bf_ecb_vectors[i].ciphertext,tmp,8)!=0)
-			break;
-	}
-
-	if (i != BF_TEST_COUNT)
-		bFailed = TRUE;
-
-	/* CAST5 (deprecated/legacy) */
-
-	for (i=0;i<CAST_TEST_COUNT;i++)
-	{			
-		int cipher = CAST;
-		memcpy(key, cast_ecb_vectors[i].key, 16);
-		memcpy(tmp, cast_ecb_vectors[i].plaintext, 8);
-		CipherInit2(cipher, key, ks_tmp, 16);
-
-		EncipherBlock(cipher, tmp, ks_tmp);
-		DecipherBlock(cipher, tmp, ks_tmp);
-		EncipherBlock(cipher, tmp, ks_tmp);
-
-		if (memcmp(cast_ecb_vectors[i].ciphertext, tmp,8)!=0)
-			break;
-	}
-
-	if (i!=CAST_TEST_COUNT)
-		bFailed = TRUE;
-
-
-	/* Triple DES (TECB, EDE) - deprecated/legacy */
-
-	for (i = 0; i < TRIPLEDES_TEST_COUNT; i++)
-	{			
-		int cipher = TRIPLEDES;
-		memcpy(key, tripledes_vectors[i].key, sizeof(tripledes_vectors->key));
-		memcpy(tmp, tripledes_vectors[i].plaintext, sizeof(tripledes_vectors->plaintext));
-
-		CipherInit(cipher, key, ks_tmp);
-
-		EncipherBlock(cipher, tmp, ks_tmp);
-		if (memcmp(tripledes_vectors[i].ciphertext, tmp, sizeof(tripledes_vectors->ciphertext)) != 0)
-			break;
-
-		DecipherBlock(cipher, tmp, ks_tmp);
-		if (memcmp(tripledes_vectors[i].plaintext, tmp, sizeof(tripledes_vectors->plaintext)) != 0)
-			break;
-	}
-	if (i != TRIPLEDES_TEST_COUNT)
-		bFailed = TRUE;
-
-
 	/* AES */
 
 	for (i = 0; i < AES_TEST_COUNT; i++)
@@ -1550,10 +951,6 @@ static BOOL DoAutoTestAlgorithms (void)
 	if (!XTSAesTest (ci))
 		bFailed = TRUE;
 
-	/* LRW-AES (deprecated/legacy) */
-	if (!LRWAesTest (ci))
-		bFailed = TRUE;
-
 	/* Sector and buffer related algorithms */
 	if (!TestSectorBufEncryption (ci))
 		bFailed = TRUE;
@@ -1601,26 +998,6 @@ BOOL test_hmac_sha512 ()
 	return (nTestsPerformed == 6);
 }
 
-BOOL test_hmac_sha1 ()
-{
-	// Deprecated/legacy
-
-	int nTestsPerformed = 0;
-	int i;
-
-	for (i = 0; i < 3; i++)
-	{
-		char digest[SHA1_DIGESTSIZE];
-		hmac_sha1 (hmac_sha1_test_keys[i], (int) strlen (hmac_sha1_test_keys[i]), hmac_sha1_test_data[i], (int) strlen (hmac_sha1_test_data[i]), digest, SHA1_DIGESTSIZE);
-		if (memcmp (digest, hmac_sha1_test_vectors[i], SHA1_DIGESTSIZE) != 0)
-			return FALSE;
-		else
-			nTestsPerformed++;
-	}
-
-	return (nTestsPerformed == 3);
-}
-
 BOOL test_hmac_ripemd160 ()
 {
 	int nTestsPerformed = 0;
@@ -1658,10 +1035,6 @@ BOOL test_pkcs5 ()
 	if (!test_hmac_sha512())
 		return FALSE;
 
-	/* HMAC-SHA-1 tests (deprecated/legacy)  */
-	if (test_hmac_sha1() == FALSE)
-		return FALSE;
-
 	/* HMAC-RIPEMD-160 tests */
 	if (test_hmac_ripemd160() == FALSE)
 		return FALSE;
@@ -1681,23 +1054,6 @@ BOOL test_pkcs5 ()
 	if (memcmp (dk, "\x13\x64\xae\xf8\x0d\xf5\x57\x6c\x30\xd5\x71\x4c\xa7\x75\x3f\xfd\x00\xe5\x25\x8b\x39\xc7\x44\x7f\xce\x23\x3d\x08\x75\xe0\x2f\x48\xd6\x30\xd7\x00\xb6\x24\xdb\xe0\x5a\xd7\x47\xef\x52\xca\xa6\x34\x83\x47\xe5\xcb\xe9\x87\xf1\x20\x59\x6a\xe6\xa9\xcf\x51\x78\xc6\xb6\x23\xa6\x74\x0d\xe8\x91\xbe\x1a\xd0\x28\xcc\xce\x16\x98\x9a\xbe\xfb\xdc\x78\xc9\xe1\x7d\x72\x67\xce\xe1\x61\x56\x5f\x96\x68\xe6\xe1\xdd\xf4\xbf\x1b\x80\xe0\x19\x1c\xf4\xc4\xd3\xdd\xd5\xd5\x57\x2d\x83\xc7\xa3\x37\x87\xf4\x4e\xe0\xf6\xd8\x6d\x65\xdc\xa0\x52\xa3\x13\xbe\x81\xfc\x30\xbe\x7d\x69\x58\x34\xb6\xdd\x41\xc6", 144) != 0)
 		return FALSE;
 
-	/* PKCS-5 test 1 with HMAC-SHA-1 (deprecated/legacy) used as the PRF (derives a key longer than the underlying hash) */
-	derive_key_sha1 ("password", 8, "\x12\x34\x56\x78", 4, 5, dk, 48);
-	if (memcmp (dk, "\x5c\x75\xce\xf0\x1a\x96\x0d\xf7\x4c\xb6\xb4\x9b\x9e\x38\xe6\xb5\x3b\x11\x80\xe3\x2f\xf7\xe0\xdd\xaa\xca\x8f\x81\x27\xf6\x9f\x4f\x1d\xc8\x2f\x48\x2d\xdb\x1a\x0a\xca\x90\xcb\x80\xb9\x2e\x90\x9e", 48) != 0)
-		return FALSE;
-
-	/* PKCS-5 test 2 with HMAC-SHA-1 (deprecated/legacy) used as the PRF */
-	derive_key_sha1 ("password", 8, "\x12\x34\x56\x78", 4, 5, dk, 4);
-	if (memcmp (dk, "\x5c\x75\xce\xf0", 4) != 0)
-		return FALSE;
-
-#if 0	// This test is disabled because it uses 1200 iterations (to prevent startup slowdown)
-	/* PKCS-5 test 3 with HMAC-SHA-1 (deprecated/legacy) used as the PRF */
-	derive_key_sha1 ("password", 8, "ATHENA.MIT.EDUraeburn", 21, 1200, dk, 16);
-	if (memcmp (dk, "\x5c\x08\xeb\x61\xfd\xf7\x1e\x4e\x4e\xc3\xcf\x6b\xa1\xf5\x51\x2b", 16) != 0)
-		return FALSE;
-#endif
-
 	/* PKCS-5 test 1 with HMAC-RIPEMD-160 used as the PRF */
 	derive_key_ripemd160 (FALSE, "password", 8, "\x12\x34\x56\x78", 4, 5, dk, 4);
 	if (memcmp (dk, "\x7a\x3d\x7c\x03", 4) != 0)

src/Common/Tests.h

@@ -17,7 +17,6 @@ extern unsigned char ks_tmp[MAX_EXPANDED_KEY];
 
 void CipherInit2(int cipher, void* key, void* ks, int key_len);
 BOOL test_hmac_sha512 (void);
-BOOL test_hmac_sha1 (void);
 BOOL test_hmac_ripemd160 (void);
 BOOL test_hmac_whirlpool (void);
 BOOL test_pkcs5 (void);

src/Common/Volumes.c

@@ -33,6 +33,9 @@
 #include "Volumes.h"
 #include "Pkcs5.h"
 
+#ifdef _WIN32
+#include <Strsafe.h>
+#endif
 
 /* Volume header v5 structure (used since TrueCrypt 7.0): */
 //
@@ -41,7 +44,7 @@
 // Unencrypted:
 // 0		64		Salt
 // Encrypted:
-// 64		4		ASCII string 'TRUE'
+// 64		4		ASCII string 'VERA'
 // 68		2		Header version
 // 70		2		Required program version
 // 72		4		CRC-32 checksum of the (decrypted) bytes 256-511
@@ -64,7 +67,7 @@
 // Unencrypted:
 // 0		64		Salt
 // Encrypted:
-// 64		4		ASCII string 'TRUE'
+// 64		4		ASCII string 'VERA'
 // 68		2		Header version
 // 70		2		Required program version
 // 72		4		CRC-32 checksum of the (decrypted) bytes 256-511
@@ -86,7 +89,7 @@
 // Unencrypted:
 // 0		64		Salt
 // Encrypted:
-// 64		4		ASCII string 'TRUE'
+// 64		4		ASCII string 'VERA'
 // 68		2		Header version
 // 70		2		Required program version
 // 72		4		CRC-32 checksum of the (decrypted) bytes 256-511
@@ -107,7 +110,7 @@
 // Unencrypted:
 // 0		64		Salt
 // Encrypted:
-// 64		4		ASCII string 'TRUE'
+// 64		4		ASCII string 'VERA'
 // 68		2		Header version
 // 70		2		Required program version
 // 72		4		CRC-32 checksum of the (decrypted) bytes 256-511
@@ -187,6 +190,9 @@ int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, PCR
 	}
 	else
 	{
+      if (!retInfo)
+         return ERR_PARAMETER_INCORRECT;
+
 		cryptoInfo = *retInfo = crypto_open ();
 		if (cryptoInfo == NULL)
 			return ERR_OUTOFMEMORY;
@@ -234,10 +240,7 @@ int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, PCR
 
 	// Test all available PKCS5 PRFs
 	for (enqPkcs5Prf = FIRST_PRF_ID; enqPkcs5Prf <= LAST_PRF_ID || queuedWorkItems > 0; ++enqPkcs5Prf)
-	{
-		BOOL lrw64InitDone = FALSE;		// Deprecated/legacy
-		BOOL lrw128InitDone = FALSE;	// Deprecated/legacy
-
+	{	
 		if (encryptionThreadCount > 1)
 		{
 			// Enqueue key derivation on thread pool
@@ -308,12 +311,6 @@ KeyReady:	;
 					PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
 				break;
 
-			case SHA1:
-				// Deprecated/legacy
-				derive_key_sha1 (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
-					PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
-				break;
-
 			case WHIRLPOOL:
 				derive_key_whirlpool (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
 					PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
@@ -332,16 +329,6 @@ KeyReady:	;
 		{
 			switch (cryptoInfo->mode)
 			{
-			case LRW:
-			case CBC:
-			case INNER_CBC:
-			case OUTER_CBC:
-
-				// For LRW (deprecated/legacy), copy the tweak key 
-				// For CBC (deprecated/legacy), copy the IV/whitening seed 
-				memcpy (cryptoInfo->k2, dk, LEGACY_VOL_IV_SIZE);
-				primaryKeyOffset = LEGACY_VOL_IV_SIZE;
-				break;
 
 			default:
 				primaryKeyOffset = 0;
@@ -377,21 +364,9 @@ KeyReady:	;
 						goto err;
 					}
 				}
-				else if (cryptoInfo->mode == LRW
-					&& (blockSize == 8 && !lrw64InitDone || blockSize == 16 && !lrw128InitDone))
+				else
 				{
-					// Deprecated/legacy
-
-					if (!EAInitMode (cryptoInfo))
-					{
-						status = ERR_MODE_INIT_FAILED;
-						goto err;
-					}
-
-					if (blockSize == 8)
-						lrw64InitDone = TRUE;
-					else if (blockSize == 16)
-						lrw128InitDone = TRUE;
+					continue;
 				}
 
 				// Copy the header for decryption
@@ -401,7 +376,7 @@ KeyReady:	;
 
 				DecryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, cryptoInfo);
 
-				// Magic 'TRUE'
+				// Magic 'VERA'
 				if (GetHeaderField32 (header, TC_HEADER_OFFSET_MAGIC) != 0x56455241)
 					continue;
 
@@ -513,15 +488,6 @@ KeyReady:	;
 
 				switch (cryptoInfo->mode)
 				{
-				case LRW:
-				case CBC:
-				case INNER_CBC:
-				case OUTER_CBC:
-
-					// For LRW (deprecated/legacy), the tweak key
-					// For CBC (deprecated/legacy), the IV/whitening seed
-					memcpy (cryptoInfo->k2, keyInfo.master_keydata, LEGACY_VOL_IV_SIZE);
-					break;
 
 				default:
 					// The secondary master key (if cascade, multiple concatenated)
@@ -596,7 +562,7 @@ int ReadVolumeHeader (BOOL bBoot, char *header, Password *password, PCRYPTO_INFO
 
 	// PKCS5 PRF
 	derive_key_ripemd160 (TRUE, password->Text, (int) password->Length, header + HEADER_SALT_OFFSET,
-		PKCS5_SALT_SIZE, 32767, dk, sizeof (dk));
+		PKCS5_SALT_SIZE, bBoot ? 16384 : 32767, dk, sizeof (dk));
 
 	// Mode of operation
 	cryptoInfo->mode = FIRST_MODE_OF_OPERATION_ID;
@@ -614,7 +580,7 @@ int ReadVolumeHeader (BOOL bBoot, char *header, Password *password, PCRYPTO_INFO
 		// Try to decrypt header 
 		DecryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, cryptoInfo);
 		
-		// Check magic 'TRUE' and CRC-32 of header fields and master keydata
+		// Check magic 'VERA' and CRC-32 of header fields and master keydata
 		if (GetHeaderField32 (header, TC_HEADER_OFFSET_MAGIC) != 0x56455241
 			|| (GetHeaderField16 (header, TC_HEADER_OFFSET_VERSION) >= 4 && GetHeaderField32 (header, TC_HEADER_OFFSET_HEADER_CRC) != GetCrc32 (header + TC_HEADER_OFFSET_MAGIC, TC_HEADER_OFFSET_HEADER_CRC - TC_HEADER_OFFSET_MAGIC))
 			|| GetHeaderField32 (header, TC_HEADER_OFFSET_KEY_AREA_CRC) != GetCrc32 (header + HEADER_MASTER_KEYDATA_OFFSET, MASTER_KEYDATA_SIZE))
@@ -715,18 +681,6 @@ int CreateVolumeHeaderInMemory (BOOL bBoot, char *header, int ea, int mode, Pass
 
 		switch (mode)
 		{
-		case LRW:
-		case CBC:
-		case INNER_CBC:
-		case OUTER_CBC:
-
-			// Deprecated/legacy modes of operation
-			bytesNeeded = LEGACY_VOL_IV_SIZE + EAGetKeySize (ea);
-
-			// In fact, this should never be the case since volumes being newly created are not
-			// supposed to use any deprecated mode of operation.
-			TC_THROW_FATAL_EXCEPTION;
-			break;
 
 		default:
 			bytesNeeded = EAGetKeySize (ea) * 2;	// Size of primary + secondary key(s)
@@ -764,12 +718,6 @@ int CreateVolumeHeaderInMemory (BOOL bBoot, char *header, int ea, int mode, Pass
 			PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
 		break;
 
-	case SHA1:
-		// Deprecated/legacy
-		derive_key_sha1 (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
-			PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
-		break;
-
 	case RIPEMD160:
 		derive_key_ripemd160 (TRUE, keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
 			PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
@@ -853,16 +801,6 @@ int CreateVolumeHeaderInMemory (BOOL bBoot, char *header, int ea, int mode, Pass
 
 	switch (mode)
 	{
-	case LRW:
-	case CBC:
-	case INNER_CBC:
-	case OUTER_CBC:
-
-		// For LRW (deprecated/legacy), the tweak key
-		// For CBC (deprecated/legacy), the IV/whitening seed
-		memcpy (cryptoInfo->k2, dk, LEGACY_VOL_IV_SIZE);
-		primaryKeyOffset = LEGACY_VOL_IV_SIZE;
-		break;
 
 	default:
 		// The secondary key (if cascade, multiple concatenated)
@@ -896,15 +834,6 @@ int CreateVolumeHeaderInMemory (BOOL bBoot, char *header, int ea, int mode, Pass
 
 	switch (cryptoInfo->mode)
 	{
-	case LRW:
-	case CBC:
-	case INNER_CBC:
-	case OUTER_CBC:
-
-		// For LRW (deprecated/legacy), the tweak key
-		// For CBC (deprecated/legacy), the IV/whitening seed
-		memcpy (cryptoInfo->k2, keyInfo.master_keydata, LEGACY_VOL_IV_SIZE);
-		break;
 
 	default:
 		// The secondary master key (if cascade, multiple concatenated)
@@ -934,16 +863,16 @@ int CreateVolumeHeaderInMemory (BOOL bBoot, char *header, int ea, int mode, Pass
 		for (i = 0; i < j; i++)
 		{
 			char tmp2[8] = {0};
-			sprintf (tmp2, "%02X", (int) (unsigned char) keyInfo.master_keydata[i + primaryKeyOffset]);
-			strcat (MasterKeyGUIView, tmp2);
+			StringCbPrintfA (tmp2, sizeof(tmp2), "%02X", (int) (unsigned char) keyInfo.master_keydata[i + primaryKeyOffset]);
+			StringCbCatA (MasterKeyGUIView, sizeof(MasterKeyGUIView), tmp2);
 		}
 
 		HeaderKeyGUIView[0] = 0;
 		for (i = 0; i < NBR_KEY_BYTES_TO_DISPLAY; i++)
 		{
 			char tmp2[8];
-			sprintf (tmp2, "%02X", (int) (unsigned char) dk[primaryKeyOffset + i]);
-			strcat (HeaderKeyGUIView, tmp2);
+			StringCbPrintfA (tmp2, sizeof(tmp2), "%02X", (int) (unsigned char) dk[primaryKeyOffset + i]);
+			StringCbCatA (HeaderKeyGUIView, sizeof(HeaderKeyGUIView), tmp2);
 		}
 
 		if (dots3)

src/Common/Volumes.h

@@ -21,11 +21,11 @@ extern "C" {
 
 // Version number written to volume header during format;
 // specifies the minimum program version required to mount the volume
-#define TC_VOLUME_MIN_REQUIRED_PROGRAM_VERSION	0x0100
+#define TC_VOLUME_MIN_REQUIRED_PROGRAM_VERSION	0x010b
 
 // Version number written (encrypted) to the key data area of an encrypted system partition/drive;
 // specifies the minimum program version required to decrypt the system partition/drive
-#define TC_SYSENC_KEYSCOPE_MIN_REQ_PROG_VERSION	0x0100
+#define TC_SYSENC_KEYSCOPE_MIN_REQ_PROG_VERSION	0x010b
 
 // Current volume format version (created by TrueCrypt 6.0+)
 #define TC_VOLUME_FORMAT_VERSION				2

src/Common/Wipe.c

@@ -155,6 +155,9 @@ int GetWipePassCount (WipeAlgorithmId algorithm)
 	case TC_WIPE_35_GUTMANN:
 		return 35;
 
+	case TC_WIPE_256:
+		return 256;
+
 	default:
 		TC_THROW_FATAL_EXCEPTION;
 	}
@@ -168,6 +171,7 @@ BOOL WipeBuffer (WipeAlgorithmId algorithm, byte randChars[TC_WIPE_RAND_CHAR_COU
 	switch (algorithm)
 	{
 	case TC_WIPE_1_RAND:
+	case TC_WIPE_256:
 		return Wipe1PseudoRandom (pass, buffer, size);
 
 	case TC_WIPE_3_DOD_5220:

src/Common/Wipe.h

@@ -24,7 +24,8 @@ typedef enum
 	TC_WIPE_1_RAND = 100,
 	TC_WIPE_3_DOD_5220 = 300,
 	TC_WIPE_7_DOD_5220 = 700,
-	TC_WIPE_35_GUTMANN = 3500
+	TC_WIPE_35_GUTMANN = 3500,
+	TC_WIPE_256 = 25600
 
 } WipeAlgorithmId;
 

src/Core/Core.h

@@ -0,0 +1,20 @@
+/*
+ Copyright (c) 2008 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_Core_Core
+#define TC_HEADER_Core_Core
+
+#include "CoreBase.h"
+
+namespace VeraCrypt
+{
+	extern auto_ptr <CoreBase> Core;
+	extern auto_ptr <CoreBase> CoreDirect;
+}
+
+#endif // TC_HEADER_Core_Core

src/Core/Core.make

@@ -0,0 +1,27 @@
+#
+# Copyright (c) 2008 TrueCrypt Developers Association. All rights reserved.
+#
+# Governed by the TrueCrypt License 3.0 the full text of which is contained in
+# the file License.txt included in TrueCrypt binary and source code distribution
+# packages.
+#
+
+OBJS :=
+OBJS += CoreBase.o
+OBJS += CoreException.o
+OBJS += FatFormatter.o
+OBJS += HostDevice.o
+OBJS += MountOptions.o
+OBJS += RandomNumberGenerator.o
+OBJS += VolumeCreator.o
+OBJS += Unix/CoreService.o
+OBJS += Unix/CoreServiceRequest.o
+OBJS += Unix/CoreServiceResponse.o
+OBJS += Unix/CoreUnix.o
+OBJS += Unix/$(PLATFORM)/Core$(PLATFORM).o
+OBJS += Unix/$(PLATFORM)/Core$(PLATFORM).o
+ifeq "$(PLATFORM)" "MacOSX"
+OBJS += Unix/FreeBSD/CoreFreeBSD.o
+endif
+
+include $(BUILD_INC)/Makefile.inc

src/Core/CoreBase.cpp

@@ -0,0 +1,279 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#include <set>
+
+#include "CoreBase.h"
+#include "RandomNumberGenerator.h"
+#include "Volume/Volume.h"
+
+namespace VeraCrypt
+{
+	CoreBase::CoreBase ()
+		: DeviceChangeInProgress (false)
+	{
+	}
+
+	CoreBase::~CoreBase ()
+	{
+	}
+
+	void CoreBase::ChangePassword (shared_ptr <Volume> openVolume, shared_ptr <VolumePassword> newPassword, shared_ptr <KeyfileList> newKeyfiles, shared_ptr <Pkcs5Kdf> newPkcs5Kdf, int wipeCount) const
+	{
+		if ((!newPassword || newPassword->Size() < 1) && (!newKeyfiles || newKeyfiles->empty()))
+			throw PasswordEmpty (SRC_POS);
+
+		if (!newPkcs5Kdf)
+			newPkcs5Kdf = openVolume->GetPkcs5Kdf();
+
+		if ((openVolume->GetHeader()->GetFlags() & TC_HEADER_FLAG_ENCRYPTED_SYSTEM) != 0
+			&& openVolume->GetType() == VolumeType::Hidden
+			&& openVolume->GetPath().IsDevice())
+		{
+			throw EncryptedSystemRequired (SRC_POS);
+		}
+
+		RandomNumberGenerator::SetHash (newPkcs5Kdf->GetHash());
+
+		SecureBuffer newSalt (openVolume->GetSaltSize());
+		SecureBuffer newHeaderKey (VolumeHeader::GetLargestSerializedKeySize());
+
+		shared_ptr <VolumePassword> password (Keyfile::ApplyListToPassword (newKeyfiles, newPassword));
+
+		bool backupHeader = false;
+		while (true)
+		{
+			for (int i = 1; i <= wipeCount; i++)
+			{
+				if (i == wipeCount)
+					RandomNumberGenerator::GetData (newSalt);
+				else
+					RandomNumberGenerator::GetDataFast (newSalt);
+
+				newPkcs5Kdf->DeriveKey (newHeaderKey, *password, newSalt);
+
+				openVolume->ReEncryptHeader (backupHeader, newSalt, newHeaderKey, newPkcs5Kdf);
+				openVolume->GetFile()->Flush();
+			}
+
+			if (!openVolume->GetLayout()->HasBackupHeader() || backupHeader)
+				break;
+
+			backupHeader = true;
+		}
+	}
+		
+	void CoreBase::ChangePassword (shared_ptr <VolumePath> volumePath, bool preserveTimestamps, shared_ptr <VolumePassword> password, shared_ptr <KeyfileList> keyfiles, shared_ptr <VolumePassword> newPassword, shared_ptr <KeyfileList> newKeyfiles, shared_ptr <Pkcs5Kdf> newPkcs5Kdf, int wipeCount) const
+	{
+		shared_ptr <Volume> volume = OpenVolume (volumePath, preserveTimestamps, password, keyfiles);
+		ChangePassword (volume, newPassword, newKeyfiles, newPkcs5Kdf, wipeCount);
+	}
+
+	void CoreBase::CoalesceSlotNumberAndMountPoint (MountOptions &options) const
+	{
+		if (options.SlotNumber < GetFirstSlotNumber())
+		{
+			if (options.MountPoint && !options.MountPoint->IsEmpty())
+				options.SlotNumber = MountPointToSlotNumber (*options.MountPoint);
+			else
+				options.SlotNumber = GetFirstFreeSlotNumber();
+		}
+
+		if (!IsSlotNumberAvailable (options.SlotNumber))
+#ifdef TC_WINDOWS
+			throw DriveLetterUnavailable (SRC_POS);
+#else
+			throw VolumeSlotUnavailable (SRC_POS);
+#endif
+		if (!options.NoFilesystem && (!options.MountPoint || options.MountPoint->IsEmpty()))
+			options.MountPoint.reset (new DirectoryPath (SlotNumberToMountPoint (options.SlotNumber)));
+	}
+
+	void CoreBase::CreateKeyfile (const FilePath &keyfilePath) const
+	{
+		SecureBuffer keyfileBuffer (VolumePassword::MaxSize);
+		RandomNumberGenerator::GetData (keyfileBuffer);
+
+		File keyfile;
+		keyfile.Open (keyfilePath, File::CreateWrite);
+		keyfile.Write (keyfileBuffer);
+	}
+
+	VolumeSlotNumber CoreBase::GetFirstFreeSlotNumber (VolumeSlotNumber startFrom) const
+	{
+		if (startFrom < GetFirstSlotNumber())
+			startFrom = GetFirstSlotNumber();
+
+		set <VolumeSlotNumber> usedSlotNumbers;
+
+		foreach_ref (const VolumeInfo &volume, GetMountedVolumes())
+			usedSlotNumbers.insert (volume.SlotNumber);
+
+		for (VolumeSlotNumber slotNumber = startFrom; slotNumber <= GetLastSlotNumber(); ++slotNumber)
+		{
+			if (usedSlotNumbers.find (slotNumber) == usedSlotNumbers.end()
+				&& IsMountPointAvailable (SlotNumberToMountPoint (slotNumber)))
+				return slotNumber;
+		}
+#ifdef TC_WINDOWS
+		throw DriveLetterUnavailable (SRC_POS);
+#else
+		throw VolumeSlotUnavailable (SRC_POS);
+#endif
+	}
+
+	uint64 CoreBase::GetMaxHiddenVolumeSize (shared_ptr <Volume> outerVolume) const
+	{
+		uint32 sectorSize = outerVolume->GetSectorSize();
+
+		SecureBuffer bootSectorBuffer (sectorSize);
+		outerVolume->ReadSectors (bootSectorBuffer, 0);
+
+		int fatType;
+		byte *bootSector = bootSectorBuffer.Ptr(); 
+
+		if (memcmp (bootSector + 54, "FAT12", 5) == 0)
+			fatType = 12;
+		else if (memcmp (bootSector + 54, "FAT16", 5) == 0)
+			fatType = 16;
+		else if (memcmp (bootSector + 82, "FAT32", 5) == 0)
+			fatType = 32;
+		else
+			throw ParameterIncorrect (SRC_POS);
+
+		uint32 clusterSize = bootSector[13] * sectorSize;
+		uint32 reservedSectorCount = Endian::Little (*(uint16 *) (bootSector + 14));
+		uint32 fatCount = bootSector[16];
+
+		uint64 fatSectorCount;
+		if (fatType == 32)
+			fatSectorCount = Endian::Little (*(uint32 *) (bootSector + 36));
+		else
+			fatSectorCount = Endian::Little (*(uint16 *) (bootSector + 22));
+		uint64 fatSize = fatSectorCount * sectorSize;
+
+		uint64 fatStartOffset = reservedSectorCount * sectorSize;
+		uint64 dataAreaOffset = reservedSectorCount * sectorSize + fatSize * fatCount;
+
+		if (fatType < 32)
+			dataAreaOffset += Endian::Little (*(uint16 *) (bootSector + 17)) * 32;
+
+		SecureBuffer sector (sectorSize);
+
+		// Find last used cluster
+		for (uint64 readOffset = fatStartOffset + fatSize - sectorSize;
+			readOffset >= fatStartOffset;
+			readOffset -= sectorSize)
+		{
+			outerVolume->ReadSectors (sector, readOffset);
+
+			for (int offset = sectorSize - 4; offset >= 0; offset -= 4)
+			{
+				if (*(uint32 *) (sector.Ptr() + offset))
+				{
+					uint64 clusterNumber = readOffset - fatStartOffset + offset;
+
+					if (fatType == 12)
+						clusterNumber = (clusterNumber * 8) / 12;
+					else if (fatType == 16)
+						clusterNumber /= 2;
+					else if (fatType == 32)
+						clusterNumber /= 4;
+
+					uint64 maxSize = outerVolume->GetSize() - dataAreaOffset;
+
+					// Some FAT entries may span over sector boundaries
+					if (maxSize >= clusterSize)
+						maxSize -= clusterSize;
+
+					uint64 clusterOffset = clusterNumber * clusterSize;
+					if (maxSize < clusterOffset)
+						return 0;
+
+					return maxSize - clusterOffset;
+				}
+			}
+		}
+
+		return 0;
+	}
+
+	shared_ptr <VolumeInfo> CoreBase::GetMountedVolume (const VolumePath &volumePath) const
+	{
+		VolumeInfoList volumes = GetMountedVolumes (volumePath);
+		if (volumes.empty())
+			return shared_ptr <VolumeInfo> ();
+		else
+			return volumes.front();
+	}
+
+	shared_ptr <VolumeInfo> CoreBase::GetMountedVolume (VolumeSlotNumber slot) const
+	{
+		foreach (shared_ptr <VolumeInfo> volume, GetMountedVolumes())
+		{
+			if (volume->SlotNumber == slot)
+				return volume;
+		}
+
+		return shared_ptr <VolumeInfo> ();
+	}
+
+	bool CoreBase::IsSlotNumberAvailable (VolumeSlotNumber slotNumber) const
+	{
+		if (!IsMountPointAvailable (SlotNumberToMountPoint (slotNumber)))
+			return false;
+
+		foreach_ref (const VolumeInfo &volume, GetMountedVolumes())
+		{
+			if (volume.SlotNumber == slotNumber)
+				return false;
+		}
+
+		return true;
+	}
+
+	bool CoreBase::IsVolumeMounted (const VolumePath &volumePath) const
+	{
+		return GetMountedVolume (volumePath);
+	}
+
+	shared_ptr <Volume> CoreBase::OpenVolume (shared_ptr <VolumePath> volumePath, bool preserveTimestamps, shared_ptr <VolumePassword> password, shared_ptr <KeyfileList> keyfiles, VolumeProtection::Enum protection, shared_ptr <VolumePassword> protectionPassword, shared_ptr <KeyfileList> protectionKeyfiles, bool sharedAccessAllowed, VolumeType::Enum volumeType, bool useBackupHeaders, bool partitionInSystemEncryptionScope) const
+	{
+		make_shared_auto (Volume, volume);
+		volume->Open (*volumePath, preserveTimestamps, password, keyfiles, protection, protectionPassword, protectionKeyfiles, sharedAccessAllowed, volumeType, useBackupHeaders, partitionInSystemEncryptionScope);
+		return volume;
+	}
+	
+	void CoreBase::RandomizeEncryptionAlgorithmKey (shared_ptr <EncryptionAlgorithm> encryptionAlgorithm) const
+	{
+		SecureBuffer eaKey (encryptionAlgorithm->GetKeySize());
+		RandomNumberGenerator::GetData (eaKey);
+		encryptionAlgorithm->SetKey (eaKey);
+
+		SecureBuffer modeKey (encryptionAlgorithm->GetMode()->GetKeySize());
+		RandomNumberGenerator::GetData (modeKey);
+		encryptionAlgorithm->GetMode()->SetKey (modeKey);
+	}
+
+	void CoreBase::ReEncryptVolumeHeaderWithNewSalt (const BufferPtr &newHeaderBuffer, shared_ptr <VolumeHeader> header, shared_ptr <VolumePassword> password, shared_ptr <KeyfileList> keyfiles) const
+	{
+		shared_ptr <Pkcs5Kdf> pkcs5Kdf = header->GetPkcs5Kdf();
+
+		RandomNumberGenerator::SetHash (pkcs5Kdf->GetHash());
+
+		SecureBuffer newSalt (header->GetSaltSize());
+		SecureBuffer newHeaderKey (VolumeHeader::GetLargestSerializedKeySize());
+
+		shared_ptr <VolumePassword> passwordKey (Keyfile::ApplyListToPassword (keyfiles, password));
+
+		RandomNumberGenerator::GetData (newSalt);
+		pkcs5Kdf->DeriveKey (newHeaderKey, *passwordKey, newSalt);
+
+		header->EncryptNew (newHeaderBuffer, newSalt, newHeaderKey, pkcs5Kdf);
+	}
+}

src/Core/CoreBase.h

@@ -0,0 +1,98 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_Core_CoreBase
+#define TC_HEADER_Core_CoreBase
+
+#include "Platform/Platform.h"
+#include "Platform/Functor.h"
+#include "Platform/User.h"
+#include "Common/Crypto.h"
+#include "Volume/Keyfile.h"
+#include "Volume/VolumeInfo.h"
+#include "Volume/Volume.h"
+#include "Volume/VolumePassword.h"
+#include "CoreException.h"
+#include "HostDevice.h"
+#include "MountOptions.h"
+
+namespace VeraCrypt
+{
+	class CoreBase
+	{
+	public:
+		virtual ~CoreBase ();
+
+		virtual void ChangePassword (shared_ptr <Volume> openVolume, shared_ptr <VolumePassword> newPassword, shared_ptr <KeyfileList> newKeyfiles, shared_ptr <Pkcs5Kdf> newPkcs5Kdf = shared_ptr <Pkcs5Kdf> (), int wipeCount = PRAND_HEADER_WIPE_PASSES) const;
+		virtual void ChangePassword (shared_ptr <VolumePath> volumePath, bool preserveTimestamps, shared_ptr <VolumePassword> password, shared_ptr <KeyfileList> keyfiles, shared_ptr <VolumePassword> newPassword, shared_ptr <KeyfileList> newKeyfiles, shared_ptr <Pkcs5Kdf> newPkcs5Kdf = shared_ptr <Pkcs5Kdf> (), int wipeCount = PRAND_HEADER_WIPE_PASSES) const;
+		virtual void CheckFilesystem (shared_ptr <VolumeInfo> mountedVolume, bool repair = false) const = 0; 
+		virtual void CoalesceSlotNumberAndMountPoint (MountOptions &options) const;
+		virtual void CreateKeyfile (const FilePath &keyfilePath) const;
+		virtual void DismountFilesystem (const DirectoryPath &mountPoint, bool force) const = 0;
+		virtual shared_ptr <VolumeInfo> DismountVolume (shared_ptr <VolumeInfo> mountedVolume, bool ignoreOpenFiles = false, bool syncVolumeInfo = false) = 0;
+		virtual bool FilesystemSupportsLargeFiles (const FilePath &filePath) const = 0;
+		virtual DirectoryPath GetDeviceMountPoint (const DevicePath &devicePath) const = 0;
+		virtual uint32 GetDeviceSectorSize (const DevicePath &devicePath) const = 0;
+		virtual uint64 GetDeviceSize (const DevicePath &devicePath) const = 0;
+		virtual VolumeSlotNumber GetFirstFreeSlotNumber (VolumeSlotNumber startFrom = 0) const;
+		virtual VolumeSlotNumber GetFirstSlotNumber () const { return 1; }
+		virtual VolumeSlotNumber GetLastSlotNumber () const { return 64; }
+		virtual HostDeviceList GetHostDevices (bool pathListOnly = false) const = 0;
+		virtual FilePath GetApplicationExecutablePath () const { return ApplicationExecutablePath; }
+		virtual uint64 GetMaxHiddenVolumeSize (shared_ptr <Volume> outerVolume) const;
+		virtual int GetOSMajorVersion () const = 0;
+		virtual int GetOSMinorVersion () const = 0;
+		virtual shared_ptr <VolumeInfo> GetMountedVolume (const VolumePath &volumePath) const;
+		virtual shared_ptr <VolumeInfo> GetMountedVolume (VolumeSlotNumber slot) const;
+		virtual VolumeInfoList GetMountedVolumes (const VolumePath &volumePath = VolumePath()) const = 0;
+		virtual bool HasAdminPrivileges () const = 0;
+		virtual void Init () { }
+		virtual bool IsDeviceChangeInProgress () const { return DeviceChangeInProgress; }
+		virtual bool IsDevicePresent (const DevicePath &device) const = 0;
+		virtual bool IsInPortableMode () const = 0;
+		virtual bool IsMountPointAvailable (const DirectoryPath &mountPoint) const = 0;
+		virtual bool IsOSVersion (int major, int minor) const = 0;
+		virtual bool IsOSVersionLower (int major, int minor) const = 0;
+		virtual bool IsPasswordCacheEmpty () const = 0;
+		virtual bool IsSlotNumberAvailable (VolumeSlotNumber slotNumber) const;
+		virtual bool IsSlotNumberValid (VolumeSlotNumber slotNumber) const { return slotNumber >= GetFirstSlotNumber() && slotNumber <= GetLastSlotNumber(); }
+		virtual bool IsVolumeMounted (const VolumePath &volumePath) const;
+		virtual VolumeSlotNumber MountPointToSlotNumber (const DirectoryPath &mountPoint) const = 0;
+		virtual shared_ptr <VolumeInfo> MountVolume (MountOptions &options) = 0;
+		virtual shared_ptr <Volume> OpenVolume (shared_ptr <VolumePath> volumePath, bool preserveTimestamps, shared_ptr <VolumePassword> password, shared_ptr <KeyfileList> keyfiles, VolumeProtection::Enum protection = VolumeProtection::None, shared_ptr <VolumePassword> protectionPassword = shared_ptr <VolumePassword> (), shared_ptr <KeyfileList> protectionKeyfiles = shared_ptr <KeyfileList> (), bool sharedAccessAllowed = false, VolumeType::Enum volumeType = VolumeType::Unknown, bool useBackupHeaders = false, bool partitionInSystemEncryptionScope = false) const;
+		virtual void RandomizeEncryptionAlgorithmKey (shared_ptr <EncryptionAlgorithm> encryptionAlgorithm) const;
+		virtual void ReEncryptVolumeHeaderWithNewSalt (const BufferPtr &newHeaderBuffer, shared_ptr <VolumeHeader> header, shared_ptr <VolumePassword> password, shared_ptr <KeyfileList> keyfiles) const;
+		virtual void SetAdminPasswordCallback (shared_ptr <GetStringFunctor> functor) { }
+		virtual void SetApplicationExecutablePath (const FilePath &path) { ApplicationExecutablePath = path; }
+		virtual void SetFileOwner (const FilesystemPath &path, const UserId &owner) const = 0;
+		virtual DirectoryPath SlotNumberToMountPoint (VolumeSlotNumber slotNumber) const = 0;
+		virtual void WipePasswordCache () const = 0;
+
+		Event VolumeDismountedEvent;
+		Event VolumeMountedEvent;
+		Event WarningEvent;
+
+	protected:
+		CoreBase ();
+
+		bool DeviceChangeInProgress;
+		FilePath ApplicationExecutablePath;
+
+	private:
+		CoreBase (const CoreBase &);
+		CoreBase &operator= (const CoreBase &);
+	};
+
+	struct VolumeEventArgs : EventArgs
+	{
+		VolumeEventArgs (shared_ptr <VolumeInfo> volume) : mVolume (volume) { }
+		shared_ptr <VolumeInfo> mVolume;
+	};
+}
+
+#endif // TC_HEADER_Core_CoreBase

src/Core/CoreException.cpp

@@ -0,0 +1,29 @@
+/*
+ Copyright (c) 2008 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#include "CoreException.h"
+#include "Platform/SerializerFactory.h"
+
+namespace VeraCrypt
+{
+	void ElevationFailed::Deserialize (shared_ptr <Stream> stream)
+	{
+		ExecutedProcessFailed::Deserialize (stream);
+	}
+
+	void ElevationFailed::Serialize (shared_ptr <Stream> stream) const
+	{
+		ExecutedProcessFailed::Serialize (stream);
+	}
+
+#define TC_EXCEPTION(TYPE) TC_SERIALIZER_FACTORY_ADD(TYPE)
+#undef TC_EXCEPTION_NODECL
+#define TC_EXCEPTION_NODECL(TYPE) TC_SERIALIZER_FACTORY_ADD(TYPE)
+
+	TC_SERIALIZER_FACTORY_ADD_EXCEPTION_SET (CoreException);
+}

src/Core/CoreException.h

@@ -0,0 +1,52 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_Core_CoreException
+#define TC_HEADER_Core_CoreException
+
+#include "Platform/Platform.h"
+
+namespace VeraCrypt
+{
+	struct ElevationFailed : public ExecutedProcessFailed
+	{
+		ElevationFailed () { }
+		ElevationFailed (const string &message, const string &command, int exitCode, const string &errorOutput)
+			: ExecutedProcessFailed (message, command, exitCode, errorOutput) { }
+		TC_SERIALIZABLE_EXCEPTION (ElevationFailed);
+	};
+
+	TC_EXCEPTION_DECL (RootDeviceUnavailable, SystemException);
+
+#define TC_EXCEPTION(NAME) TC_EXCEPTION_DECL(NAME,Exception)
+
+#undef TC_EXCEPTION_SET
+#define TC_EXCEPTION_SET \
+	TC_EXCEPTION_NODECL (ElevationFailed); \
+	TC_EXCEPTION_NODECL (RootDeviceUnavailable); \
+	TC_EXCEPTION (DriveLetterUnavailable); \
+	TC_EXCEPTION (DriverError); \
+	TC_EXCEPTION (EncryptedSystemRequired); \
+	TC_EXCEPTION (HigherFuseVersionRequired); \
+	TC_EXCEPTION (KernelCryptoServiceTestFailed); \
+	TC_EXCEPTION (LoopDeviceSetupFailed); \
+	TC_EXCEPTION (MountPointRequired); \
+	TC_EXCEPTION (MountPointUnavailable); \
+	TC_EXCEPTION (NoDriveLetterAvailable); \
+	TC_EXCEPTION (TemporaryDirectoryFailure); \
+	TC_EXCEPTION (UnsupportedSectorSizeHiddenVolumeProtection); \
+	TC_EXCEPTION (UnsupportedSectorSizeNoKernelCrypto); \
+	TC_EXCEPTION (VolumeAlreadyMounted); \
+	TC_EXCEPTION (VolumeSlotUnavailable);
+
+	TC_EXCEPTION_SET;
+
+#undef TC_EXCEPTION
+}
+
+#endif // TC_HEADER_Core_CoreException

src/Core/FatFormatter.cpp

@@ -0,0 +1,384 @@
+/*
+ Legal Notice: Some portions of the source code contained in this file were
+ derived from the source code of Encryption for the Masses 2.02a, which is
+ Copyright (c) 1998-2000 Paul Le Roux and which is governed by the 'License
+ Agreement for Encryption for the Masses'. Modifications and additions to
+ the original source code (contained in this file) and all other portions
+ of this file are Copyright (c) 2003-2010 TrueCrypt Developers Association
+ and are governed by the TrueCrypt License 3.0 the full text of which is
+ contained in the file License.txt included in TrueCrypt binary and source
+ code distribution packages. */
+
+#include "Common/Tcdefs.h"
+#include "Platform/Platform.h"
+#include "Volume/VolumeHeader.h"
+#include "FatFormatter.h"
+#include "RandomNumberGenerator.h"
+
+namespace VeraCrypt
+{
+	struct fatparams
+	{
+		char volume_name[11];
+		uint32 num_sectors;	/* total number of sectors */
+		uint32 cluster_count;	/* number of clusters */
+		uint32 size_root_dir;	/* size of the root directory in bytes */
+		uint32 size_fat;		/* size of FAT */
+		uint32 fats;
+		uint32 media;
+		uint32 cluster_size;
+		uint32 fat_length;
+		uint16 dir_entries;
+		uint16 sector_size;
+		uint32 hidden;
+		uint16 reserved;
+		uint16 sectors;
+		uint32 total_sect;
+
+		uint16 heads;
+		uint16 secs_track;
+
+	};
+
+	static void GetFatParams (fatparams * ft)
+	{
+		uint64 volumeSize = (uint64) ft->num_sectors * ft->sector_size;
+		unsigned int fatsecs;
+
+		if(ft->cluster_size == 0)	// 'Default' cluster size
+		{
+			uint32 clusterSize;
+
+			// Determine optimal cluster size to minimize FAT size (mounting delay), maximize number of files, keep 4 KB alignment, etc.
+			if (volumeSize >= 2 * BYTES_PER_TB)
+				clusterSize = 256 * BYTES_PER_KB;
+			else if (volumeSize >= 512 * BYTES_PER_GB)
+				clusterSize = 128 * BYTES_PER_KB;
+			else if (volumeSize >= 128 * BYTES_PER_GB)
+				clusterSize = 64 * BYTES_PER_KB;
+			else if (volumeSize >= 64 * BYTES_PER_GB)
+				clusterSize = 32 * BYTES_PER_KB;
+			else if (volumeSize >= 32 * BYTES_PER_GB)
+				clusterSize = 16 * BYTES_PER_KB;
+			else if (volumeSize >= 16 * BYTES_PER_GB)
+				clusterSize = 8 * BYTES_PER_KB;
+			else if (volumeSize >= 512 * BYTES_PER_MB)
+				clusterSize = 4 * BYTES_PER_KB;
+			else if (volumeSize >= 256 * BYTES_PER_MB)
+				clusterSize = 2 * BYTES_PER_KB;
+			else if (volumeSize >= 1 * BYTES_PER_MB)
+				clusterSize = 1 * BYTES_PER_KB;
+			else
+				clusterSize = 512;
+
+			ft->cluster_size = clusterSize / ft->sector_size;
+
+			if (ft->cluster_size == 0)
+				ft->cluster_size = 1;
+
+			if (ft->cluster_size * ft->sector_size > TC_MAX_FAT_CLUSTER_SIZE)
+				ft->cluster_size = TC_MAX_FAT_CLUSTER_SIZE / ft->sector_size;
+
+			if (ft->cluster_size > 128)
+				ft->cluster_size = 128;
+		}
+
+		if (volumeSize <= TC_MAX_FAT_CLUSTER_SIZE * 4)
+			ft->cluster_size = 1;
+
+		// Geometry always set to SECTORS/1/1
+		ft->secs_track = 1; 
+		ft->heads = 1; 
+
+		ft->dir_entries = 512;
+		ft->fats = 2;
+		ft->media = 0xf8;
+		ft->hidden = 0;
+
+		ft->size_root_dir = ft->dir_entries * 32;
+
+		// FAT12
+		ft->size_fat = 12;
+		ft->reserved = 2;
+		fatsecs = ft->num_sectors - (ft->size_root_dir + ft->sector_size - 1) / ft->sector_size - ft->reserved;
+		ft->cluster_count = (int) (((int64) fatsecs * ft->sector_size) / (ft->cluster_size * ft->sector_size));
+		ft->fat_length = (((ft->cluster_count * 3 + 1) >> 1) + ft->sector_size - 1) / ft->sector_size;
+
+		if (ft->cluster_count >= 4085) // FAT16
+		{
+			ft->size_fat = 16;
+			ft->reserved = 2;
+			fatsecs = ft->num_sectors - (ft->size_root_dir + ft->sector_size - 1) / ft->sector_size - ft->reserved;
+			ft->cluster_count = (int) (((int64) fatsecs * ft->sector_size) / (ft->cluster_size * ft->sector_size));
+			ft->fat_length = (ft->cluster_count * 2 + ft->sector_size - 1) / ft->sector_size;
+		}
+
+		if(ft->cluster_count >= 65525) // FAT32
+		{
+			ft->size_fat = 32;
+			ft->reserved = 32 - 1;
+
+			do
+			{
+				ft->reserved++;
+
+				fatsecs = ft->num_sectors - ft->reserved;
+				ft->size_root_dir = ft->cluster_size * ft->sector_size;
+				ft->cluster_count = (int) (((int64) fatsecs * ft->sector_size) / (ft->cluster_size * ft->sector_size));
+				ft->fat_length = (ft->cluster_count * 4 + ft->sector_size - 1) / ft->sector_size;
+
+				// Align data area on TC_MAX_VOLUME_SECTOR_SIZE
+
+			} while (ft->sector_size == TC_SECTOR_SIZE_LEGACY
+				&& (ft->reserved * ft->sector_size + ft->fat_length * ft->fats * ft->sector_size) % TC_MAX_VOLUME_SECTOR_SIZE != 0);
+		}
+
+		ft->cluster_count -= ft->fat_length * ft->fats / ft->cluster_size;
+
+		if (ft->num_sectors >= 65536 || ft->size_fat == 32)
+		{
+			ft->sectors = 0;
+			ft->total_sect = ft->num_sectors;
+		}
+		else
+		{
+			ft->sectors = (uint16) ft->num_sectors;
+			ft->total_sect = 0;
+		}
+	}
+
+	static void PutBoot (fatparams * ft, byte *boot, uint32 volumeId)
+	{
+		int cnt = 0;
+
+		boot[cnt++] = 0xeb;	/* boot jump */
+		boot[cnt++] = 0x3c;
+		boot[cnt++] = 0x90;
+		memcpy (boot + cnt, "MSDOS5.0", 8); /* system id */
+		cnt += 8;
+		*(int16 *)(boot + cnt) = Endian::Little (ft->sector_size);	/* bytes per sector */
+		cnt += 2;
+		boot[cnt++] = (int8) ft->cluster_size;			/* sectors per cluster */
+		*(int16 *)(boot + cnt) = Endian::Little (ft->reserved);		/* reserved sectors */
+		cnt += 2;
+		boot[cnt++] = (int8) ft->fats;					/* 2 fats */
+
+		if(ft->size_fat == 32)
+		{
+			boot[cnt++] = 0x00;
+			boot[cnt++] = 0x00;
+		}
+		else
+		{
+			*(int16 *)(boot + cnt) = Endian::Little (ft->dir_entries);	/* 512 root entries */
+			cnt += 2;
+		}
+
+		*(int16 *)(boot + cnt) = Endian::Little (ft->sectors);		/* # sectors */
+		cnt += 2;
+		boot[cnt++] = (int8) ft->media;					/* media byte */
+
+		if(ft->size_fat == 32)	
+		{
+			boot[cnt++] = 0x00;
+			boot[cnt++] = 0x00;
+		}
+		else 
+		{ 
+			*(uint16 *)(boot + cnt) = Endian::Little ((uint16) ft->fat_length);	/* fat size */
+			cnt += 2;
+		}
+
+		*(int16 *)(boot + cnt) = Endian::Little (ft->secs_track);	/* # sectors per track */
+		cnt += 2;
+		*(int16 *)(boot + cnt) = Endian::Little (ft->heads);			/* # heads */
+		cnt += 2;
+		*(int32 *)(boot + cnt) = Endian::Little (ft->hidden);		/* # hidden sectors */
+		cnt += 4;
+		*(int32 *)(boot + cnt) = Endian::Little (ft->total_sect);	/* # huge sectors */
+		cnt += 4;
+
+		if(ft->size_fat == 32)
+		{
+			*(int32 *)(boot + cnt) = Endian::Little (ft->fat_length); cnt += 4;	/* fat size 32 */
+			boot[cnt++] = 0x00;	/* ExtFlags */
+			boot[cnt++] = 0x00;
+			boot[cnt++] = 0x00;	/* FSVer */
+			boot[cnt++] = 0x00;
+			boot[cnt++] = 0x02;	/* RootClus */
+			boot[cnt++] = 0x00;
+			boot[cnt++] = 0x00;
+			boot[cnt++] = 0x00;
+			boot[cnt++] = 0x01;	/* FSInfo */
+			boot[cnt++] = 0x00;
+			boot[cnt++] = 0x06;	/* BkBootSec */
+			boot[cnt++] = 0x00;
+			memset(boot+cnt, 0, 12); cnt+=12;	/* Reserved */
+		}
+
+		boot[cnt++] = 0x00;	/* drive number */   // FIXED 80 > 00
+		boot[cnt++] = 0x00;	/* reserved */
+		boot[cnt++] = 0x29;	/* boot sig */
+
+		*(int32 *)(boot + cnt) = volumeId;
+		cnt += 4;
+
+		memcpy (boot + cnt, ft->volume_name, 11);	/* vol title */
+		cnt += 11;
+
+		switch(ft->size_fat) /* filesystem type */
+		{
+		case 12: memcpy (boot + cnt, "FAT12   ", 8); break;
+		case 16: memcpy (boot + cnt, "FAT16   ", 8); break;
+		case 32: memcpy (boot + cnt, "FAT32   ", 8); break;
+		}
+		cnt += 8;
+
+		memset (boot + cnt, 0, ft->size_fat==32 ? 420:448);	/* boot code */
+		cnt += ft->size_fat==32 ? 420:448;
+		boot[cnt++] = 0x55;
+		boot[cnt++] = 0xaa;	/* boot sig */
+	}
+
+
+	/* FAT32 FSInfo */
+	static void PutFSInfo (byte *sector, fatparams *ft)
+	{
+		memset (sector, 0, ft->sector_size);
+		sector[3] = 0x41; /* LeadSig */
+		sector[2] = 0x61; 
+		sector[1] = 0x52; 
+		sector[0] = 0x52; 
+		sector[484+3] = 0x61; /* StrucSig */
+		sector[484+2] = 0x41; 
+		sector[484+1] = 0x72; 
+		sector[484+0] = 0x72; 
+
+		// Free cluster count
+		*(uint32 *)(sector + 488) = Endian::Little (ft->cluster_count - ft->size_root_dir / ft->sector_size / ft->cluster_size);
+
+		// Next free cluster
+		*(uint32 *)(sector + 492) = Endian::Little ((uint32) 2);
+
+		sector[508+3] = 0xaa; /* TrailSig */
+		sector[508+2] = 0x55;
+		sector[508+1] = 0x00;
+		sector[508+0] = 0x00;
+	}
+
+	void FatFormatter::Format (WriteSectorCallback &writeSector, uint64 deviceSize, uint32 clusterSize, uint32 sectorSize)
+	{
+		fatparams fatParams;
+
+#if TC_MAX_VOLUME_SECTOR_SIZE > 0xFFFF
+#error TC_MAX_VOLUME_SECTOR_SIZE > 0xFFFF
+#endif
+		fatParams.sector_size = (uint16) sectorSize;
+
+		if (deviceSize / fatParams.sector_size > 0xffffFFFF)
+			throw ParameterIncorrect (SRC_POS);
+
+		fatParams.num_sectors = (uint32) (deviceSize / fatParams.sector_size);
+		fatParams.cluster_size = clusterSize / fatParams.sector_size;
+		memcpy (fatParams.volume_name, "NO NAME    ", 11);
+		GetFatParams (&fatParams); 
+		fatparams *ft = &fatParams;
+
+		SecureBuffer sector (ft->sector_size);
+		uint32 sectorNumber = 0;
+
+		/* Write the data area */
+
+		sector.Zero();
+
+		uint32 volumeId;
+		RandomNumberGenerator::GetDataFast (BufferPtr ((byte *) &volumeId, sizeof (volumeId)));
+
+		PutBoot (ft, (byte *) sector, volumeId);
+		writeSector (sector); ++sectorNumber;
+
+		/* fat32 boot area */
+		if (ft->size_fat == 32)				
+		{
+			/* fsinfo */
+			PutFSInfo((byte *) sector, ft);
+			writeSector (sector); ++sectorNumber;
+
+			/* reserved */
+			while (sectorNumber < 6)
+			{
+				sector.Zero();
+				sector[508+3] = 0xaa; /* TrailSig */
+				sector[508+2] = 0x55;
+				writeSector (sector); ++sectorNumber;
+			}
+
+			/* bootsector backup */
+			sector.Zero();
+			PutBoot (ft, (byte *) sector, volumeId);
+			writeSector (sector); ++sectorNumber;
+
+			PutFSInfo((byte *) sector, ft);
+			writeSector (sector); ++sectorNumber;
+		}
+
+		/* reserved */
+		while (sectorNumber < (uint32)ft->reserved)
+		{
+			sector.Zero();
+			writeSector (sector); ++sectorNumber;
+		}
+
+		/* write fat */
+		for (uint32 x = 1; x <= ft->fats; x++)
+		{
+			for (uint32 n = 0; n < ft->fat_length; n++)
+			{
+				sector.Zero();
+
+				if (n == 0)
+				{
+					byte fat_sig[12];
+					if (ft->size_fat == 32)
+					{
+						fat_sig[0] = (byte) ft->media;
+						fat_sig[1] = fat_sig[2] = 0xff;
+						fat_sig[3] = 0x0f;
+						fat_sig[4] = fat_sig[5] = fat_sig[6] = 0xff;
+						fat_sig[7] = 0x0f;
+						fat_sig[8] = fat_sig[9] = fat_sig[10] = 0xff;
+						fat_sig[11] = 0x0f;
+						memcpy (sector, fat_sig, 12);
+					}				
+					else if (ft->size_fat == 16)
+					{
+						fat_sig[0] = (byte) ft->media;
+						fat_sig[1] = 0xff;
+						fat_sig[2] = 0xff;
+						fat_sig[3] = 0xff;
+						memcpy (sector, fat_sig, 4);
+					}
+					else if (ft->size_fat == 12)
+					{
+						fat_sig[0] = (byte) ft->media;
+						fat_sig[1] = 0xff;
+						fat_sig[2] = 0xff;
+						fat_sig[3] = 0x00;
+						memcpy (sector, fat_sig, 4);
+					}
+				}
+
+				if (!writeSector (sector))
+					return;
+			}
+		}
+
+		/* write rootdir */
+		for (uint32 x = 0; x < ft->size_root_dir / ft->sector_size; x++)
+		{
+			sector.Zero();
+			if (!writeSector (sector))
+				return;
+		}
+	}
+}

src/Core/FatFormatter.h

@@ -0,0 +1,29 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_Core_FatFormatter
+#define TC_HEADER_Core_FatFormatter
+
+#include "Platform/Platform.h"
+
+namespace VeraCrypt
+{
+	class FatFormatter
+	{
+	public:
+		struct WriteSectorCallback
+		{
+			virtual ~WriteSectorCallback () { }
+			virtual bool operator() (const BufferPtr &sector) = 0;
+		};
+
+		static void Format (WriteSectorCallback &writeSector, uint64 deviceSize, uint32 clusterSize, uint32 sectorSize);
+	};
+}
+
+#endif // TC_HEADER_Core_FatFormatter

src/Core/HostDevice.cpp

@@ -0,0 +1,47 @@
+/*
+ Copyright (c) 2008 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#include "HostDevice.h"
+#include "Platform/SerializerFactory.h"
+
+namespace VeraCrypt
+{
+	void HostDevice::Deserialize (shared_ptr <Stream> stream)
+	{
+		Serializer sr (stream);
+		MountPoint = sr.DeserializeWString ("MountPoint");
+		sr.Deserialize ("Name", Name);
+		Path = sr.DeserializeWString ("Path");
+		sr.Deserialize ("Removable", Removable);
+		sr.Deserialize ("Size", Size);
+		sr.Deserialize ("SystemNumber", SystemNumber);
+
+		uint32 partitionCount;
+		sr.Deserialize ("Partitions", partitionCount);
+		for (uint32 i = 0; i < partitionCount; i++)
+			Partitions.push_back (Serializable::DeserializeNew <HostDevice> (stream));
+	}
+
+	void HostDevice::Serialize (shared_ptr <Stream> stream) const
+	{
+		Serializable::Serialize (stream);
+		Serializer sr (stream);
+		sr.Serialize ("MountPoint", wstring (MountPoint));
+		sr.Serialize ("Name", Name);
+		sr.Serialize ("Path", wstring (Path));
+		sr.Serialize ("Removable", Removable);
+		sr.Serialize ("Size", Size);
+		sr.Serialize ("SystemNumber", SystemNumber);
+		
+		sr.Serialize ("Partitions", (uint32) Partitions.size());
+		foreach_ref (const HostDevice &partition, Partitions)
+			partition.Serialize (stream);
+	}
+
+	TC_SERIALIZER_FACTORY_ADD_CLASS (HostDevice);
+}

src/Core/HostDevice.h

@@ -0,0 +1,45 @@
+/*
+ Copyright (c) 2008 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_Core_HostDevice
+#define TC_HEADER_Core_HostDevice
+
+#include "Platform/Platform.h"
+#include "Platform/Serializable.h"
+
+namespace VeraCrypt
+{
+	struct HostDevice;
+	typedef list < shared_ptr <HostDevice> > HostDeviceList;
+
+	struct HostDevice : public Serializable
+	{
+		HostDevice ()
+			: Removable (false),
+			Size (0)
+		{
+		}
+
+		virtual ~HostDevice ()
+		{
+		}
+
+		TC_SERIALIZABLE (HostDevice);
+
+		DirectoryPath MountPoint;
+		wstring Name;
+		DevicePath Path;
+		bool Removable;
+		uint64 Size;
+		uint32 SystemNumber;
+
+		HostDeviceList Partitions;
+	};
+}
+
+#endif // TC_HEADER_Core_HostDevice

src/Core/MountOptions.cpp

@@ -0,0 +1,129 @@
+/*
+ Copyright (c) 2008 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#include "MountOptions.h"
+#include "Platform/MemoryStream.h"
+#include "Platform/SerializerFactory.h"
+
+namespace VeraCrypt
+{
+	void MountOptions::CopyFrom (const MountOptions &other)
+	{
+#define TC_CLONE(NAME) NAME = other.NAME
+#define TC_CLONE_SHARED(TYPE,NAME) NAME = other.NAME ? make_shared <TYPE> (*other.NAME) : shared_ptr <TYPE> ()
+
+		TC_CLONE (CachePassword);
+		TC_CLONE (FilesystemOptions);
+		TC_CLONE (FilesystemType);
+		TC_CLONE_SHARED (KeyfileList, Keyfiles);
+		TC_CLONE_SHARED (DirectoryPath, MountPoint);
+		TC_CLONE (NoFilesystem);
+		TC_CLONE (NoHardwareCrypto);
+		TC_CLONE (NoKernelCrypto);
+		TC_CLONE_SHARED (VolumePassword, Password);
+		TC_CLONE_SHARED (VolumePath, Path);
+		TC_CLONE (PartitionInSystemEncryptionScope);
+		TC_CLONE (PreserveTimestamps);
+		TC_CLONE (Protection);
+		TC_CLONE_SHARED (VolumePassword, ProtectionPassword);
+		TC_CLONE_SHARED (KeyfileList, ProtectionKeyfiles);
+		TC_CLONE (Removable);
+		TC_CLONE (SharedAccessAllowed);
+		TC_CLONE (SlotNumber);
+		TC_CLONE (UseBackupHeaders);
+	}
+
+	void MountOptions::Deserialize (shared_ptr <Stream> stream)
+	{
+		Serializer sr (stream);
+
+		sr.Deserialize ("CachePassword", CachePassword);
+		sr.Deserialize ("FilesystemOptions", FilesystemOptions);
+		sr.Deserialize ("FilesystemType", FilesystemType);
+
+		Keyfiles = Keyfile::DeserializeList (stream, "Keyfiles");
+
+		if (!sr.DeserializeBool ("MountPointNull"))
+			MountPoint.reset (new DirectoryPath (sr.DeserializeWString ("MountPoint")));
+		else
+			MountPoint.reset();
+
+		sr.Deserialize ("NoFilesystem", NoFilesystem);
+		sr.Deserialize ("NoHardwareCrypto", NoHardwareCrypto);
+		sr.Deserialize ("NoKernelCrypto", NoKernelCrypto);
+
+		if (!sr.DeserializeBool ("PasswordNull"))
+			Password = Serializable::DeserializeNew <VolumePassword> (stream);
+		else
+			Password.reset();
+
+		if (!sr.DeserializeBool ("PathNull"))
+			Path.reset (new VolumePath (sr.DeserializeWString ("Path")));
+		else
+			Path.reset();
+
+		sr.Deserialize ("PartitionInSystemEncryptionScope", PartitionInSystemEncryptionScope);
+		sr.Deserialize ("PreserveTimestamps", PreserveTimestamps);
+
+		Protection = static_cast <VolumeProtection::Enum> (sr.DeserializeInt32 ("Protection"));
+
+		if (!sr.DeserializeBool ("ProtectionPasswordNull"))
+			ProtectionPassword = Serializable::DeserializeNew <VolumePassword> (stream);
+		else
+			ProtectionPassword.reset();
+
+		ProtectionKeyfiles = Keyfile::DeserializeList (stream, "ProtectionKeyfiles");
+		sr.Deserialize ("Removable", Removable);
+		sr.Deserialize ("SharedAccessAllowed", SharedAccessAllowed);
+		sr.Deserialize ("SlotNumber", SlotNumber);
+		sr.Deserialize ("UseBackupHeaders", UseBackupHeaders);
+	}
+
+	void MountOptions::Serialize (shared_ptr <Stream> stream) const
+	{
+		Serializable::Serialize (stream);
+		Serializer sr (stream);
+
+		sr.Serialize ("CachePassword", CachePassword);
+		sr.Serialize ("FilesystemOptions", FilesystemOptions);
+		sr.Serialize ("FilesystemType", FilesystemType);
+		Keyfile::SerializeList (stream, "Keyfiles", Keyfiles);
+
+		sr.Serialize ("MountPointNull", MountPoint == nullptr);
+		if (MountPoint)
+			sr.Serialize ("MountPoint", wstring (*MountPoint));
+
+		sr.Serialize ("NoFilesystem", NoFilesystem);
+		sr.Serialize ("NoHardwareCrypto", NoHardwareCrypto);
+		sr.Serialize ("NoKernelCrypto", NoKernelCrypto);
+		
+		sr.Serialize ("PasswordNull", Password == nullptr);
+		if (Password)
+			Password->Serialize (stream);
+
+		sr.Serialize ("PathNull", Path == nullptr);
+		if (Path)
+			sr.Serialize ("Path", wstring (*Path));
+
+		sr.Serialize ("PartitionInSystemEncryptionScope", PartitionInSystemEncryptionScope);
+		sr.Serialize ("PreserveTimestamps", PreserveTimestamps);
+		sr.Serialize ("Protection", static_cast <uint32> (Protection));
+
+		sr.Serialize ("ProtectionPasswordNull", ProtectionPassword == nullptr);
+		if (ProtectionPassword)
+			ProtectionPassword->Serialize (stream);
+
+		Keyfile::SerializeList (stream, "ProtectionKeyfiles", ProtectionKeyfiles);
+		sr.Serialize ("Removable", Removable);
+		sr.Serialize ("SharedAccessAllowed", SharedAccessAllowed);
+		sr.Serialize ("SlotNumber", SlotNumber);
+		sr.Serialize ("UseBackupHeaders", UseBackupHeaders);
+	}
+
+	TC_SERIALIZER_FACTORY_ADD_CLASS (MountOptions);
+}

src/Core/MountOptions.h

@@ -0,0 +1,70 @@
+/*
+ Copyright (c) 2008 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_Core_MountOptions
+#define TC_HEADER_Core_MountOptions
+
+#include "Platform/Serializable.h"
+#include "Volume/Keyfile.h"
+#include "Volume/Volume.h"
+#include "Volume/VolumeSlot.h"
+#include "Volume/VolumePassword.h"
+
+namespace VeraCrypt
+{
+	struct MountOptions : public Serializable
+	{
+		MountOptions ()
+			:
+			CachePassword (false),
+			NoFilesystem (false),
+			NoHardwareCrypto (false),
+			NoKernelCrypto (false),
+			PartitionInSystemEncryptionScope (false),
+			PreserveTimestamps (true),
+			Protection (VolumeProtection::None),
+			Removable (false),
+			SharedAccessAllowed (false),
+			SlotNumber (0),
+			UseBackupHeaders (false)
+		{
+		}
+
+		MountOptions (const MountOptions &other) { CopyFrom (other); }
+		virtual ~MountOptions () { }
+
+		MountOptions &operator= (const MountOptions &other) { CopyFrom (other); return *this; }
+
+		TC_SERIALIZABLE (MountOptions);
+
+		bool CachePassword;
+		wstring FilesystemOptions;
+		wstring FilesystemType;
+		shared_ptr <KeyfileList> Keyfiles;
+		shared_ptr <DirectoryPath> MountPoint;
+		bool NoFilesystem;
+		bool NoHardwareCrypto;
+		bool NoKernelCrypto;
+		shared_ptr <VolumePassword> Password;
+		bool PartitionInSystemEncryptionScope;
+		shared_ptr <VolumePath> Path;
+		bool PreserveTimestamps;
+		VolumeProtection::Enum Protection;
+		shared_ptr <VolumePassword> ProtectionPassword;
+		shared_ptr <KeyfileList> ProtectionKeyfiles;
+		bool Removable;
+		bool SharedAccessAllowed;
+		VolumeSlotNumber SlotNumber;
+		bool UseBackupHeaders;
+
+	protected:
+		void CopyFrom (const MountOptions &other);
+	};
+}
+
+#endif // TC_HEADER_Core_MountOptions

src/Core/RandomNumberGenerator.cpp

@@ -0,0 +1,213 @@
+/*
+ Copyright (c) 2008-2009 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_WINDOWS
+#include <sys/types.h>
+#include <errno.h>
+#include <fcntl.h>
+#endif
+
+#include "RandomNumberGenerator.h"
+#include "Volume/Crc32.h"
+
+namespace VeraCrypt
+{
+	void RandomNumberGenerator::AddSystemDataToPool (bool fast)
+	{
+		SecureBuffer buffer (PoolSize);
+
+#ifdef TC_WINDOWS
+#ifndef DEBUG
+		throw NotImplemented (SRC_POS);
+#endif
+#else
+		int urandom = open ("/dev/urandom", O_RDONLY);
+		throw_sys_sub_if (urandom == -1, L"/dev/urandom");
+		finally_do_arg (int, urandom, { close (finally_arg); });
+
+		throw_sys_sub_if (read (urandom, buffer, buffer.Size()) == -1, L"/dev/urandom");
+		AddToPool (buffer);
+
+		if (!fast)
+		{
+			// Read all bytes available in /dev/random up to buffer size
+			int random = open ("/dev/random", O_RDONLY | O_NONBLOCK);
+			throw_sys_sub_if (random == -1, L"/dev/random");
+			finally_do_arg (int, random, { close (finally_arg); });
+
+			throw_sys_sub_if (read (random, buffer, buffer.Size()) == -1 && errno != EAGAIN, L"/dev/random");
+			AddToPool (buffer);
+		}
+#endif
+	}
+
+	void RandomNumberGenerator::AddToPool (const ConstBufferPtr &data)
+	{
+		if (!Running)
+			throw NotInitialized (SRC_POS);
+
+		ScopeLock lock (AccessMutex);
+
+		for (size_t i = 0; i < data.Size(); ++i)
+		{
+			Pool[WriteOffset++] += data[i];
+
+			if (WriteOffset >= PoolSize)
+				WriteOffset = 0;
+
+			if (++BytesAddedSincePoolHashMix >= MaxBytesAddedBeforePoolHashMix)
+				HashMixPool();
+		}
+	}
+
+	void RandomNumberGenerator::GetData (const BufferPtr &buffer, bool fast)
+	{
+		if (!Running)
+			throw NotInitialized (SRC_POS);
+
+		if (buffer.Size() > PoolSize)
+			throw ParameterIncorrect (SRC_POS);
+
+		ScopeLock lock (AccessMutex);
+
+		// Poll system for data
+		AddSystemDataToPool (fast);
+		HashMixPool();
+
+		// Transfer bytes from pool to output buffer
+		for (size_t i = 0; i < buffer.Size(); ++i)
+		{
+			buffer[i] += Pool[ReadOffset++];
+
+			if (ReadOffset >= PoolSize)
+				ReadOffset = 0;
+		}
+
+		// Invert and mix the pool
+		for (size_t i = 0; i < Pool.Size(); ++i)
+		{
+			Pool[i] = ~Pool[i];
+		}
+
+		AddSystemDataToPool (true);
+		HashMixPool();
+
+		// XOR the current pool content into the output buffer to prevent pool state leaks
+		for (size_t i = 0; i < buffer.Size(); ++i)
+		{
+			buffer[i] ^= Pool[ReadOffset++];
+
+			if (ReadOffset >= PoolSize)
+				ReadOffset = 0;
+		}
+	}
+
+	shared_ptr <Hash> RandomNumberGenerator::GetHash ()
+	{
+		ScopeLock lock (AccessMutex);
+		return PoolHash;
+	}
+
+	void RandomNumberGenerator::HashMixPool ()
+	{
+		BytesAddedSincePoolHashMix = 0;
+
+		for (size_t poolPos = 0; poolPos < Pool.Size(); )
+		{
+			// Compute the message digest of the entire pool using the selected hash function
+			SecureBuffer digest (PoolHash->GetDigestSize());
+			PoolHash->ProcessData (Pool);
+			PoolHash->GetDigest (digest);
+
+			// Add the message digest to the pool
+			for (size_t digestPos = 0; digestPos < digest.Size() && poolPos < Pool.Size(); ++digestPos)
+			{
+				Pool[poolPos++] += digest[digestPos];
+			}
+		}
+	}
+
+	void RandomNumberGenerator::SetHash (shared_ptr <Hash> hash)
+	{
+		ScopeLock lock (AccessMutex);
+		PoolHash = hash;
+	}
+
+	void RandomNumberGenerator::Start ()
+	{
+		ScopeLock lock (AccessMutex);
+
+		if (IsRunning())
+			return;
+
+		BytesAddedSincePoolHashMix = 0;
+		ReadOffset = 0;
+		WriteOffset = 0;
+		Running = true;
+		EnrichedByUser = false;
+
+		Pool.Allocate (PoolSize);
+		Test();
+
+		if (!PoolHash)
+		{
+			// First hash algorithm is the default one
+			PoolHash = Hash::GetAvailableAlgorithms().front();
+		}
+
+		AddSystemDataToPool (true);
+	}
+
+	void RandomNumberGenerator::Stop ()
+	{		
+		ScopeLock lock (AccessMutex);
+
+		if (Pool.IsAllocated())
+			Pool.Free ();
+
+		PoolHash.reset();
+
+		EnrichedByUser = false;
+		Running = false;
+	}
+
+	void RandomNumberGenerator::Test ()
+	{
+		shared_ptr <Hash> origPoolHash = PoolHash;
+		PoolHash.reset (new Ripemd160());
+
+		Pool.Zero();
+		Buffer buffer (1);
+		for (size_t i = 0; i < PoolSize * 10; ++i)
+		{
+			buffer[0] = (byte) i;
+			AddToPool (buffer);
+		}
+
+		if (Crc32::ProcessBuffer (Pool) != 0x2de46d17)
+			throw TestFailed (SRC_POS);
+
+		buffer.Allocate (PoolSize);
+		buffer.CopyFrom (PeekPool());
+		AddToPool (buffer);
+
+		if (Crc32::ProcessBuffer (Pool) != 0xcb88e019)
+			throw TestFailed (SRC_POS);
+
+		PoolHash = origPoolHash;
+	}
+
+	Mutex RandomNumberGenerator::AccessMutex;
+	size_t RandomNumberGenerator::BytesAddedSincePoolHashMix;
+	bool RandomNumberGenerator::EnrichedByUser;
+	SecureBuffer RandomNumberGenerator::Pool;
+	shared_ptr <Hash> RandomNumberGenerator::PoolHash;
+	size_t RandomNumberGenerator::ReadOffset;
+	bool RandomNumberGenerator::Running = false;
+	size_t RandomNumberGenerator::WriteOffset;
+}

src/Core/RandomNumberGenerator.h

@@ -0,0 +1,55 @@
+/*
+ Copyright (c) 2008-2009 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_Core_RandomNumberGenerator
+#define TC_HEADER_Core_RandomNumberGenerator
+
+#include "Platform/Platform.h"
+#include "Volume/Hash.h"
+#include "Common/Random.h"
+
+namespace VeraCrypt
+{
+	class RandomNumberGenerator
+	{
+	public:
+		static void AddToPool (const ConstBufferPtr &buffer);
+		static void GetData (const BufferPtr &buffer) { GetData (buffer, false); }
+		static void GetDataFast (const BufferPtr &buffer) { GetData (buffer, true); }
+		static shared_ptr <Hash> GetHash ();
+		static bool IsEnrichedByUser () { return EnrichedByUser; }
+		static bool IsRunning () { return Running; }
+		static ConstBufferPtr PeekPool () { return Pool; }
+		static void SetEnrichedByUserStatus (bool enriched) { EnrichedByUser = enriched; }
+		static void SetHash (shared_ptr <Hash> hash);
+		static void Start ();
+		static void Stop ();
+
+		static const size_t PoolSize = RNG_POOL_SIZE;
+
+	protected:
+		static void AddSystemDataToPool (bool fast);
+		static void GetData (const BufferPtr &buffer, bool fast);
+		static void HashMixPool ();
+		static void Test ();
+		RandomNumberGenerator ();
+
+		static const size_t MaxBytesAddedBeforePoolHashMix = RANDMIX_BYTE_INTERVAL;
+
+		static Mutex AccessMutex;
+		static size_t BytesAddedSincePoolHashMix;
+		static bool EnrichedByUser;
+		static SecureBuffer Pool;
+		static shared_ptr <Hash> PoolHash;
+		static size_t ReadOffset;
+		static bool Running;
+		static size_t WriteOffset;
+	};
+}
+
+#endif // TC_HEADER_Core_RandomNumberGenerator

src/Core/Unix/CoreService.cpp

@@ -0,0 +1,544 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#include "CoreService.h"
+#include <fcntl.h>
+#include <sys/wait.h>
+#include "Platform/FileStream.h"
+#include "Platform/MemoryStream.h"
+#include "Platform/Serializable.h"
+#include "Platform/SystemLog.h"
+#include "Platform/Thread.h"
+#include "Platform/Unix/Poller.h"
+#include "Core/Core.h"
+#include "CoreUnix.h"
+#include "CoreServiceRequest.h"
+#include "CoreServiceResponse.h"
+
+namespace VeraCrypt
+{
+	template <class T>
+	auto_ptr <T> CoreService::GetResponse ()
+	{
+		auto_ptr <Serializable> deserializedObject (Serializable::DeserializeNew (ServiceOutputStream));
+		
+		Exception *deserializedException = dynamic_cast <Exception*> (deserializedObject.get());
+		if (deserializedException)
+			deserializedException->Throw();
+
+		if (dynamic_cast <T *> (deserializedObject.get()) == nullptr)
+			throw ParameterIncorrect (SRC_POS);
+
+		return auto_ptr <T> (dynamic_cast <T *> (deserializedObject.release()));
+	}
+
+	void CoreService::ProcessElevatedRequests ()
+	{
+		int pid = fork();
+		throw_sys_if (pid == -1);
+		if (pid == 0)
+		{
+			try
+			{
+				int f = open ("/dev/null", 0);
+				throw_sys_sub_if (f == -1, "/dev/null");
+				throw_sys_if (dup2 (f, STDERR_FILENO) == -1);
+
+				// Wait for sync code
+				while (true)
+				{
+					byte b;
+					throw_sys_if (read (STDIN_FILENO, &b, 1) != 1);
+					if (b != 0x00)
+						continue;
+					
+					throw_sys_if (read (STDIN_FILENO, &b, 1) != 1);
+					if (b != 0x11)
+						continue;
+					
+					throw_sys_if (read (STDIN_FILENO, &b, 1) != 1);
+					if (b == 0x22)
+						break;
+				}
+
+				ElevatedPrivileges = true;
+				ProcessRequests (STDIN_FILENO, STDOUT_FILENO);
+				_exit (0);
+			}
+			catch (exception &e)
+			{
+#ifdef DEBUG
+				SystemLog::WriteException (e);
+#endif
+			}
+			catch (...)	{ }
+			_exit (1);
+		}
+	}
+
+	void CoreService::ProcessRequests (int inputFD, int outputFD)
+	{
+		try
+		{
+			Core = CoreDirect;
+
+			shared_ptr <Stream> inputStream (new FileStream (inputFD != -1 ? inputFD : InputPipe->GetReadFD()));
+			shared_ptr <Stream> outputStream (new FileStream (outputFD != -1 ? outputFD : OutputPipe->GetWriteFD()));
+
+			while (true)
+			{
+				shared_ptr <CoreServiceRequest> request = Serializable::DeserializeNew <CoreServiceRequest> (inputStream);
+
+				try
+				{
+					// ExitRequest
+					if (dynamic_cast <ExitRequest*> (request.get()) != nullptr)
+					{
+						if (ElevatedServiceAvailable)
+							request->Serialize (ServiceInputStream);
+						return;
+					}
+
+					if (!ElevatedPrivileges && request->ElevateUserPrivileges)
+					{
+						if (!ElevatedServiceAvailable)
+						{
+							finally_do_arg (string *, &request->AdminPassword, { StringConverter::Erase (*finally_arg); });
+							
+							CoreService::StartElevated (*request);
+							ElevatedServiceAvailable = true;
+						}
+
+						request->Serialize (ServiceInputStream);
+						GetResponse <Serializable>()->Serialize (outputStream);
+						continue;
+					}
+
+					// CheckFilesystemRequest
+					CheckFilesystemRequest *checkRequest = dynamic_cast <CheckFilesystemRequest*> (request.get());
+					if (checkRequest)
+					{
+						Core->CheckFilesystem (checkRequest->MountedVolumeInfo, checkRequest->Repair);
+						
+						CheckFilesystemResponse().Serialize (outputStream);
+						continue;
+					}
+
+					// DismountFilesystemRequest
+					DismountFilesystemRequest *dismountFsRequest = dynamic_cast <DismountFilesystemRequest*> (request.get());
+					if (dismountFsRequest)
+					{
+						Core->DismountFilesystem (dismountFsRequest->MountPoint, dismountFsRequest->Force);
+
+						DismountFilesystemResponse().Serialize (outputStream);
+						continue;
+					}
+
+					// DismountVolumeRequest
+					DismountVolumeRequest *dismountRequest = dynamic_cast <DismountVolumeRequest*> (request.get());
+					if (dismountRequest)
+					{
+						DismountVolumeResponse response;
+						response.DismountedVolumeInfo = Core->DismountVolume (dismountRequest->MountedVolumeInfo, dismountRequest->IgnoreOpenFiles, dismountRequest->SyncVolumeInfo);
+						response.Serialize (outputStream);
+						continue;
+					}
+
+					// GetDeviceSectorSizeRequest
+					GetDeviceSectorSizeRequest *getDeviceSectorSizeRequest = dynamic_cast <GetDeviceSectorSizeRequest*> (request.get());
+					if (getDeviceSectorSizeRequest)
+					{
+						GetDeviceSectorSizeResponse response;
+						response.Size = Core->GetDeviceSectorSize (getDeviceSectorSizeRequest->Path);
+						response.Serialize (outputStream);
+						continue;
+					}
+
+					// GetDeviceSizeRequest
+					GetDeviceSizeRequest *getDeviceSizeRequest = dynamic_cast <GetDeviceSizeRequest*> (request.get());
+					if (getDeviceSizeRequest)
+					{
+						GetDeviceSizeResponse response;
+						response.Size = Core->GetDeviceSize (getDeviceSizeRequest->Path);
+						response.Serialize (outputStream);
+						continue;
+					}
+
+					// GetHostDevicesRequest
+					GetHostDevicesRequest *getHostDevicesRequest = dynamic_cast <GetHostDevicesRequest*> (request.get());
+					if (getHostDevicesRequest)
+					{
+						GetHostDevicesResponse response;
+						response.HostDevices = Core->GetHostDevices (getHostDevicesRequest->PathListOnly);
+						response.Serialize (outputStream);
+						continue;
+					}
+
+					// MountVolumeRequest
+					MountVolumeRequest *mountRequest = dynamic_cast <MountVolumeRequest*> (request.get());
+					if (mountRequest)
+					{
+						MountVolumeResponse (
+							Core->MountVolume (*mountRequest->Options)
+						).Serialize (outputStream);
+
+						continue;
+					}
+
+					// SetFileOwnerRequest
+					SetFileOwnerRequest *setFileOwnerRequest = dynamic_cast <SetFileOwnerRequest*> (request.get());
+					if (setFileOwnerRequest)
+					{
+						CoreUnix *coreUnix = dynamic_cast <CoreUnix *> (Core.get());
+						if (!coreUnix)
+							throw ParameterIncorrect (SRC_POS);
+
+						coreUnix->SetFileOwner (setFileOwnerRequest->Path, setFileOwnerRequest->Owner);
+						SetFileOwnerResponse().Serialize (outputStream);
+						continue;
+					}
+
+					throw ParameterIncorrect (SRC_POS);
+				}
+				catch (Exception &e)
+				{
+					e.Serialize (outputStream);
+				}
+				catch (exception &e)
+				{
+					ExternalException (SRC_POS, StringConverter::ToExceptionString (e)).Serialize (outputStream);
+				}
+			}
+		}
+		catch (exception &e)
+		{
+#ifdef DEBUG
+			SystemLog::WriteException (e);
+#endif
+			throw;
+		}
+	}
+
+	void CoreService::RequestCheckFilesystem (shared_ptr <VolumeInfo> mountedVolume, bool repair)
+	{
+		CheckFilesystemRequest request (mountedVolume, repair);
+		SendRequest <CheckFilesystemResponse> (request);
+	}
+
+	void CoreService::RequestDismountFilesystem (const DirectoryPath &mountPoint, bool force)
+	{
+		DismountFilesystemRequest request (mountPoint, force);
+		SendRequest <DismountFilesystemResponse> (request);
+	}
+
+	shared_ptr <VolumeInfo> CoreService::RequestDismountVolume (shared_ptr <VolumeInfo> mountedVolume, bool ignoreOpenFiles, bool syncVolumeInfo)
+	{
+		DismountVolumeRequest request (mountedVolume, ignoreOpenFiles, syncVolumeInfo);
+		return SendRequest <DismountVolumeResponse> (request)->DismountedVolumeInfo;
+	}
+
+	uint32 CoreService::RequestGetDeviceSectorSize (const DevicePath &devicePath)
+	{
+		GetDeviceSectorSizeRequest request (devicePath);
+		return SendRequest <GetDeviceSectorSizeResponse> (request)->Size;
+	}
+
+	uint64 CoreService::RequestGetDeviceSize (const DevicePath &devicePath)
+	{
+		GetDeviceSizeRequest request (devicePath);
+		return SendRequest <GetDeviceSizeResponse> (request)->Size;
+	}
+
+	HostDeviceList CoreService::RequestGetHostDevices (bool pathListOnly)
+	{
+		GetHostDevicesRequest request (pathListOnly);
+		return SendRequest <GetHostDevicesResponse> (request)->HostDevices;
+	}
+	
+	shared_ptr <VolumeInfo> CoreService::RequestMountVolume (MountOptions &options)
+	{
+		MountVolumeRequest request (&options);
+		return SendRequest <MountVolumeResponse> (request)->MountedVolumeInfo;
+	}
+
+	void CoreService::RequestSetFileOwner (const FilesystemPath &path, const UserId &owner)
+	{
+		SetFileOwnerRequest request (path, owner);
+		SendRequest <SetFileOwnerResponse> (request);
+	}
+
+	template <class T>
+	auto_ptr <T> CoreService::SendRequest (CoreServiceRequest &request)
+	{
+		static Mutex mutex;
+		ScopeLock lock (mutex);
+
+		if (request.RequiresElevation())
+		{
+			request.ElevateUserPrivileges = true;
+			request.FastElevation = !ElevatedServiceAvailable;
+			request.ApplicationExecutablePath = Core->GetApplicationExecutablePath();
+
+			while (!ElevatedServiceAvailable)
+			{
+				try
+				{
+					request.Serialize (ServiceInputStream);
+					auto_ptr <T> response (GetResponse <T>());
+					ElevatedServiceAvailable = true;
+					return response;
+				}
+				catch (ElevationFailed &e)
+				{
+					if (!request.FastElevation)
+					{
+						ExceptionEventArgs args (e);
+						Core->WarningEvent.Raise (args);
+					}
+
+					request.FastElevation = false;
+					(*AdminPasswordCallback) (request.AdminPassword);
+				}
+			}
+		}
+
+		finally_do_arg (string *, &request.AdminPassword, { StringConverter::Erase (*finally_arg); });
+
+		request.Serialize (ServiceInputStream);
+		return GetResponse <T>();
+	}
+
+	void CoreService::Start ()
+	{
+		InputPipe.reset (new Pipe());
+		OutputPipe.reset (new Pipe());
+
+		int pid = fork();
+		throw_sys_if (pid == -1);
+
+		if (pid == 0)
+		{
+			try
+			{
+				ProcessRequests();
+				_exit (0);
+			}
+			catch (...) { }
+			_exit (1);
+		}
+
+		ServiceInputStream = shared_ptr <Stream> (new FileStream (InputPipe->GetWriteFD()));
+		ServiceOutputStream = shared_ptr <Stream> (new FileStream (OutputPipe->GetReadFD()));
+	}
+
+	void CoreService::StartElevated (const CoreServiceRequest &request)
+	{
+		auto_ptr <Pipe> inPipe (new Pipe());
+		auto_ptr <Pipe> outPipe (new Pipe());
+		Pipe errPipe;
+
+		int forkedPid = fork();
+		throw_sys_if (forkedPid == -1);
+
+		if (forkedPid == 0)
+		{
+			try
+			{
+				try
+				{
+					throw_sys_if (dup2 (inPipe->GetReadFD(), STDIN_FILENO) == -1);
+					throw_sys_if (dup2 (outPipe->GetWriteFD(), STDOUT_FILENO) == -1);
+					throw_sys_if (dup2 (errPipe.GetWriteFD(), STDERR_FILENO) == -1);
+
+					string appPath = request.ApplicationExecutablePath;
+					if (appPath.empty())
+						appPath = "veracrypt";
+
+					const char *args[] = { "sudo", "-S", "-p", "", appPath.c_str(), TC_CORE_SERVICE_CMDLINE_OPTION, nullptr };
+					execvp (args[0], ((char* const*) args));
+					throw SystemException (SRC_POS, args[0]);
+				}
+				catch (Exception &)
+				{
+					throw;
+				}
+				catch (exception &e)
+				{
+					throw ExternalException (SRC_POS, StringConverter::ToExceptionString (e));
+				}
+				catch (...)
+				{
+					throw UnknownException (SRC_POS);
+				}
+			}
+			catch (Exception &e)
+			{
+				try
+				{
+					shared_ptr <Stream> outputStream (new FileStream (errPipe.GetWriteFD()));
+					e.Serialize (outputStream);
+				}
+				catch (...) { }
+			}
+
+			_exit (1);
+		}
+
+		vector <char> adminPassword (request.AdminPassword.size() + 1);
+		int timeout = 6000;
+
+		if (request.FastElevation)
+		{
+			string dummyPassword = "dummy\n";
+			adminPassword = vector <char> (dummyPassword.size());
+			Memory::Copy (&adminPassword.front(), dummyPassword.c_str(), dummyPassword.size());
+			timeout = 1000;
+		}
+		else
+		{
+			Memory::Copy (&adminPassword.front(), request.AdminPassword.c_str(), request.AdminPassword.size());
+			adminPassword[request.AdminPassword.size()] = '\n';
+		}
+
+		if (write (inPipe->GetWriteFD(), &adminPassword.front(), adminPassword.size())) { } // Errors ignored
+
+		Memory::Erase (&adminPassword.front(), adminPassword.size());
+
+		throw_sys_if (fcntl (outPipe->GetReadFD(), F_SETFL, O_NONBLOCK) == -1);
+		throw_sys_if (fcntl (errPipe.GetReadFD(), F_SETFL, O_NONBLOCK) == -1);
+
+		vector <char> buffer (4096), errOutput (4096);
+		buffer.clear ();
+		errOutput.clear ();
+
+		Poller poller (outPipe->GetReadFD(), errPipe.GetReadFD());
+		int status, waitRes;
+		int exitCode = 1;
+
+		try
+		{
+			do
+			{
+				ssize_t bytesRead = 0;
+				foreach (int fd, poller.WaitForData (timeout))
+				{
+					bytesRead = read (fd, &buffer[0], buffer.capacity());
+					if (bytesRead > 0 && fd == errPipe.GetReadFD())
+					{
+						errOutput.insert (errOutput.end(), buffer.begin(), buffer.begin() + bytesRead);
+
+						if (bytesRead > 5 && bytesRead < 80)  // Short message captured
+							timeout = 200;
+					}
+				}
+
+				if (bytesRead == 0)
+				{
+					waitRes = waitpid (forkedPid, &status, 0);
+					break;
+				}
+
+			} while ((waitRes = waitpid (forkedPid, &status, WNOHANG)) == 0);
+		}
+		catch (TimeOut&)
+		{
+			if ((waitRes = waitpid (forkedPid, &status, WNOHANG)) == 0)
+			{
+				inPipe->Close();
+				outPipe->Close();
+				errPipe.Close();
+				
+				if (request.FastElevation)
+				{
+					// Prevent defunct process
+					struct WaitFunctor : public Functor
+					{
+						WaitFunctor (int pid) : Pid (pid) { }
+						virtual void operator() ()
+						{
+							int status;
+							for (int t = 0; t < 10 && waitpid (Pid, &status, WNOHANG) == 0; t++)
+								Thread::Sleep (1000);
+						}
+						int Pid;
+					};
+					Thread thread;
+					thread.Start (new WaitFunctor (forkedPid));
+
+					throw ElevationFailed (SRC_POS, "sudo", 1, "");
+				}
+
+				waitRes = waitpid (forkedPid, &status, 0);
+			}
+		}
+
+		if (!errOutput.empty())
+		{
+			auto_ptr <Serializable> deserializedObject;
+			Exception *deserializedException = nullptr;
+
+			try
+			{
+				shared_ptr <Stream> stream (new MemoryStream (ConstBufferPtr ((byte *) &errOutput[0], errOutput.size())));
+				deserializedObject.reset (Serializable::DeserializeNew (stream));
+				deserializedException = dynamic_cast <Exception*> (deserializedObject.get());
+			}
+			catch (...)	{ }
+
+			if (deserializedException)
+				deserializedException->Throw();
+		}
+
+		throw_sys_if (waitRes == -1);
+		exitCode = (WIFEXITED (status) ? WEXITSTATUS (status) : 1);
+		if (exitCode != 0)
+		{
+			string strErrOutput;
+
+			if (!errOutput.empty())
+				strErrOutput.insert (strErrOutput.begin(), errOutput.begin(), errOutput.end());
+
+			// sudo may require a tty even if -S is used
+			if (strErrOutput.find (" tty") != string::npos)
+				strErrOutput += "\nTo enable use of 'sudo' by applications without a terminal window, please disable 'requiretty' option in '/etc/sudoers'. Newer versions of sudo automatically determine whether a terminal is required ('requiretty' option is obsolete).";
+
+			throw ElevationFailed (SRC_POS, "sudo", exitCode, strErrOutput);
+		}
+
+		throw_sys_if (fcntl (outPipe->GetReadFD(), F_SETFL, 0) == -1);
+
+		ServiceInputStream = shared_ptr <Stream> (new FileStream (inPipe->GetWriteFD()));
+		ServiceOutputStream = shared_ptr <Stream> (new FileStream (outPipe->GetReadFD()));
+
+		// Send sync code
+		byte sync[] = { 0, 0x11, 0x22 };
+		ServiceInputStream->Write (ConstBufferPtr (sync, array_capacity (sync)));
+
+		AdminInputPipe = inPipe;
+		AdminOutputPipe = outPipe;
+	}
+
+	void CoreService::Stop ()
+	{
+		ExitRequest exitRequest;
+		exitRequest.Serialize (ServiceInputStream);
+	}
+	
+	shared_ptr <GetStringFunctor> CoreService::AdminPasswordCallback;
+
+	auto_ptr <Pipe> CoreService::AdminInputPipe;
+	auto_ptr <Pipe> CoreService::AdminOutputPipe;
+
+	auto_ptr <Pipe> CoreService::InputPipe;
+	auto_ptr <Pipe> CoreService::OutputPipe;
+	shared_ptr <Stream> CoreService::ServiceInputStream;
+	shared_ptr <Stream> CoreService::ServiceOutputStream;
+
+	bool CoreService::ElevatedPrivileges = false;
+	bool CoreService::ElevatedServiceAvailable = false;
+}

src/Core/Unix/CoreService.h

@@ -0,0 +1,63 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_Core_Unix_CoreService
+#define TC_HEADER_Core_Unix_CoreService
+
+#include "CoreServiceRequest.h"
+#include "Platform/Stream.h"
+#include "Platform/Unix/Pipe.h"
+#include "Core/Core.h"
+
+namespace VeraCrypt
+{
+	// This service facilitates process forking and elevation of user privileges
+	class CoreService
+	{
+	public:
+		static void ProcessElevatedRequests ();
+		static void ProcessRequests (int inputFD = -1, int outputFD = -1);
+		static void RequestCheckFilesystem (shared_ptr <VolumeInfo> mountedVolume, bool repair);
+		static void RequestDismountFilesystem (const DirectoryPath &mountPoint, bool force);
+		static shared_ptr <VolumeInfo> RequestDismountVolume (shared_ptr <VolumeInfo> mountedVolume, bool ignoreOpenFiles = false, bool syncVolumeInfo = false);
+		static uint32 RequestGetDeviceSectorSize (const DevicePath &devicePath);
+		static uint64 RequestGetDeviceSize (const DevicePath &devicePath);
+		static HostDeviceList RequestGetHostDevices (bool pathListOnly);
+		static shared_ptr <VolumeInfo> RequestMountVolume (MountOptions &options);
+		static void RequestSetFileOwner (const FilesystemPath &path, const UserId &owner);
+		static void SetAdminPasswordCallback (shared_ptr <GetStringFunctor> functor) { AdminPasswordCallback = functor; }
+		static void Start ();
+		static void Stop ();
+
+	protected:
+		template <class T> static auto_ptr <T> GetResponse ();
+		template <class T> static auto_ptr <T> SendRequest (CoreServiceRequest &request);
+		static void StartElevated (const CoreServiceRequest &request);
+
+		static shared_ptr <GetStringFunctor> AdminPasswordCallback;
+
+		static auto_ptr <Pipe> AdminInputPipe;
+		static auto_ptr <Pipe> AdminOutputPipe;
+
+		static auto_ptr <Pipe> InputPipe;
+		static auto_ptr <Pipe> OutputPipe;
+		static shared_ptr <Stream> ServiceInputStream;
+		static shared_ptr <Stream> ServiceOutputStream;
+
+		static bool ElevatedPrivileges;
+		static bool ElevatedServiceAvailable;
+		static bool Running;
+
+	private:
+		CoreService ();
+	};
+
+#define TC_CORE_SERVICE_CMDLINE_OPTION "--core-service"
+}
+
+#endif // TC_HEADER_Core_Unix_CoreService

src/Core/Unix/CoreServiceProxy.h

@@ -0,0 +1,152 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_Core_Windows_CoreServiceProxy
+#define TC_HEADER_Core_Windows_CoreServiceProxy
+
+#include "CoreService.h"
+#include "Volume/VolumePasswordCache.h"
+
+namespace VeraCrypt
+{
+	template <class T>
+	class CoreServiceProxy : public T
+	{
+	public:
+		CoreServiceProxy () { }
+		virtual ~CoreServiceProxy () { }
+
+		virtual void CheckFilesystem (shared_ptr <VolumeInfo> mountedVolume, bool repair) const
+		{
+			CoreService::RequestCheckFilesystem (mountedVolume, repair);
+		}
+
+		virtual void DismountFilesystem (const DirectoryPath &mountPoint, bool force) const
+		{
+			CoreService::RequestDismountFilesystem (mountPoint, force);
+		}
+
+		virtual shared_ptr <VolumeInfo> DismountVolume (shared_ptr <VolumeInfo> mountedVolume, bool ignoreOpenFiles = false, bool syncVolumeInfo = false)
+		{
+			shared_ptr <VolumeInfo> dismountedVolumeInfo = CoreService::RequestDismountVolume (mountedVolume, ignoreOpenFiles, syncVolumeInfo);
+
+			VolumeEventArgs eventArgs (dismountedVolumeInfo);
+			T::VolumeDismountedEvent.Raise (eventArgs);
+
+			return dismountedVolumeInfo;
+		}
+
+		virtual uint32 GetDeviceSectorSize (const DevicePath &devicePath) const
+		{
+			return CoreService::RequestGetDeviceSectorSize (devicePath);
+		}
+
+		virtual uint64 GetDeviceSize (const DevicePath &devicePath) const
+		{
+			return CoreService::RequestGetDeviceSize (devicePath);
+		}
+
+#ifndef TC_LINUX
+		virtual HostDeviceList GetHostDevices (bool pathListOnly = false) const
+		{
+			if (pathListOnly)
+				return T::GetHostDevices (pathListOnly);
+			else
+				return CoreService::RequestGetHostDevices (pathListOnly);
+		}
+#endif
+		virtual bool IsPasswordCacheEmpty () const { return VolumePasswordCache::IsEmpty(); }
+
+		virtual shared_ptr <VolumeInfo> MountVolume (MountOptions &options)
+		{
+			shared_ptr <VolumeInfo> mountedVolume;
+
+			if (!VolumePasswordCache::IsEmpty()
+				&& (!options.Password || options.Password->IsEmpty())
+				&& (!options.Keyfiles || options.Keyfiles->empty()))
+			{
+				finally_do_arg (MountOptions*, &options, { if (finally_arg->Password) finally_arg->Password.reset(); });
+
+				PasswordIncorrect passwordException;
+				foreach (shared_ptr <VolumePassword> password, VolumePasswordCache::GetPasswords())
+				{
+					try
+					{
+						options.Password = password;
+						mountedVolume = CoreService::RequestMountVolume (options);
+						break;
+					}
+					catch (PasswordIncorrect &e)
+					{
+						passwordException = e;
+					}
+				}
+
+				if (!mountedVolume)
+					passwordException.Throw();
+			}
+			else
+			{
+				MountOptions newOptions = options;
+				
+				newOptions.Password = Keyfile::ApplyListToPassword (options.Keyfiles, options.Password);
+				if (newOptions.Keyfiles)
+					newOptions.Keyfiles->clear();
+
+				newOptions.ProtectionPassword = Keyfile::ApplyListToPassword (options.ProtectionKeyfiles, options.ProtectionPassword);
+				if (newOptions.ProtectionKeyfiles)
+					newOptions.ProtectionKeyfiles->clear();
+
+				try
+				{
+					mountedVolume = CoreService::RequestMountVolume (newOptions);
+				}
+				catch (ProtectionPasswordIncorrect &e)
+				{
+					if (options.ProtectionKeyfiles && !options.ProtectionKeyfiles->empty())
+						throw ProtectionPasswordKeyfilesIncorrect (e.what());
+					throw;
+				}
+				catch (PasswordIncorrect &e)
+				{
+					if (options.Keyfiles && !options.Keyfiles->empty())
+						throw PasswordKeyfilesIncorrect (e.what());
+					throw;
+				}
+
+				if (options.CachePassword
+					&& ((options.Password && !options.Password->IsEmpty()) || (options.Keyfiles && !options.Keyfiles->empty())))
+				{
+					VolumePasswordCache::Store (*Keyfile::ApplyListToPassword (options.Keyfiles, options.Password));
+				}
+			}
+
+			VolumeEventArgs eventArgs (mountedVolume);
+			T::VolumeMountedEvent.Raise (eventArgs);
+
+			return mountedVolume;
+		}
+
+		virtual void SetAdminPasswordCallback (shared_ptr <GetStringFunctor> functor)
+		{
+			CoreService::SetAdminPasswordCallback (functor);
+		}
+
+		virtual void SetFileOwner (const FilesystemPath &path, const UserId &owner) const
+		{
+			CoreService::RequestSetFileOwner (path, owner);
+		}
+
+		virtual void WipePasswordCache () const
+		{
+			VolumePasswordCache::Clear();
+		}
+	};
+}
+
+#endif // TC_HEADER_Core_Windows_CoreServiceProxy

src/Core/Unix/CoreServiceRequest.cpp

@@ -0,0 +1,269 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#include <errno.h>
+#include "CoreServiceRequest.h"
+#include "Platform/SerializerFactory.h"
+
+namespace VeraCrypt
+{
+	void CoreServiceRequest::Deserialize (shared_ptr <Stream> stream)
+	{
+		Serializer sr (stream);
+		sr.Deserialize ("AdminPassword", AdminPassword);
+		ApplicationExecutablePath = sr.DeserializeWString ("ApplicationExecutablePath");
+		sr.Deserialize ("ElevateUserPrivileges", ElevateUserPrivileges);
+		sr.Deserialize ("FastElevation", FastElevation);
+	}
+
+	void CoreServiceRequest::Serialize (shared_ptr <Stream> stream) const
+	{
+		Serializable::Serialize (stream);
+		Serializer sr (stream);
+		sr.Serialize ("AdminPassword", AdminPassword);
+		sr.Serialize ("ApplicationExecutablePath", wstring (ApplicationExecutablePath));
+		sr.Serialize ("ElevateUserPrivileges", ElevateUserPrivileges);
+		sr.Serialize ("FastElevation", FastElevation);
+	}
+
+	// CheckFilesystemRequest
+	void CheckFilesystemRequest::Deserialize (shared_ptr <Stream> stream)
+	{
+		CoreServiceRequest::Deserialize (stream);
+		Serializer sr (stream);
+		MountedVolumeInfo = Serializable::DeserializeNew <VolumeInfo> (stream);
+		sr.Deserialize ("Repair", Repair);
+	}
+
+	bool CheckFilesystemRequest::RequiresElevation () const
+	{
+#ifdef TC_MACOSX
+		return false;
+#endif
+		return !Core->HasAdminPrivileges();
+	}
+
+	void CheckFilesystemRequest::Serialize (shared_ptr <Stream> stream) const
+	{
+		CoreServiceRequest::Serialize (stream);
+		Serializer sr (stream);
+		MountedVolumeInfo->Serialize (stream);
+		sr.Serialize ("Repair", Repair);
+	}
+
+	// DismountFilesystemRequest
+	void DismountFilesystemRequest::Deserialize (shared_ptr <Stream> stream)
+	{
+		CoreServiceRequest::Deserialize (stream);
+		Serializer sr (stream);
+		sr.Deserialize ("Force", Force);
+		MountPoint = sr.DeserializeWString ("MountPoint");
+	}
+
+	bool DismountFilesystemRequest::RequiresElevation () const
+	{
+		return !Core->HasAdminPrivileges();
+	}
+
+	void DismountFilesystemRequest::Serialize (shared_ptr <Stream> stream) const
+	{
+		CoreServiceRequest::Serialize (stream);
+		Serializer sr (stream);
+		sr.Serialize ("Force", Force);
+		sr.Serialize ("MountPoint", wstring (MountPoint));
+	}
+
+	// DismountVolumeRequest
+	void DismountVolumeRequest::Deserialize (shared_ptr <Stream> stream)
+	{
+		CoreServiceRequest::Deserialize (stream);
+		Serializer sr (stream);
+		sr.Deserialize ("IgnoreOpenFiles", IgnoreOpenFiles);
+		sr.Deserialize ("SyncVolumeInfo", SyncVolumeInfo);
+		MountedVolumeInfo = Serializable::DeserializeNew <VolumeInfo> (stream);
+	}
+
+	bool DismountVolumeRequest::RequiresElevation () const
+	{
+#ifdef TC_MACOSX
+		if (MountedVolumeInfo->Path.IsDevice())
+		{
+			try
+			{
+				File file;
+				file.Open (MountedVolumeInfo->Path, File::OpenReadWrite);
+			}
+			catch (...)
+			{
+				return true;
+			}
+		}
+
+		return false;
+#endif
+		return !Core->HasAdminPrivileges();
+	}
+
+	void DismountVolumeRequest::Serialize (shared_ptr <Stream> stream) const
+	{
+		CoreServiceRequest::Serialize (stream);
+		Serializer sr (stream);
+		sr.Serialize ("IgnoreOpenFiles", IgnoreOpenFiles);
+		sr.Serialize ("SyncVolumeInfo", SyncVolumeInfo);
+		MountedVolumeInfo->Serialize (stream);
+	}
+
+	// GetDeviceSectorSizeRequest
+	void GetDeviceSectorSizeRequest::Deserialize (shared_ptr <Stream> stream)
+	{
+		CoreServiceRequest::Deserialize (stream);
+		Serializer sr (stream);
+		Path = sr.DeserializeWString ("Path");
+	}
+
+	bool GetDeviceSectorSizeRequest::RequiresElevation () const
+	{
+		return !Core->HasAdminPrivileges();
+	}
+
+	void GetDeviceSectorSizeRequest::Serialize (shared_ptr <Stream> stream) const
+	{
+		CoreServiceRequest::Serialize (stream);
+		Serializer sr (stream);
+		sr.Serialize ("Path", wstring (Path));
+	}
+
+	// GetDeviceSizeRequest
+	void GetDeviceSizeRequest::Deserialize (shared_ptr <Stream> stream)
+	{
+		CoreServiceRequest::Deserialize (stream);
+		Serializer sr (stream);
+		Path = sr.DeserializeWString ("Path");
+	}
+
+	bool GetDeviceSizeRequest::RequiresElevation () const
+	{
+		return !Core->HasAdminPrivileges();
+	}
+
+	void GetDeviceSizeRequest::Serialize (shared_ptr <Stream> stream) const
+	{
+		CoreServiceRequest::Serialize (stream);
+		Serializer sr (stream);
+		sr.Serialize ("Path", wstring (Path));
+	}
+
+	// GetHostDevicesRequest
+	void GetHostDevicesRequest::Deserialize (shared_ptr <Stream> stream)
+	{
+		CoreServiceRequest::Deserialize (stream);
+		Serializer sr (stream);
+		sr.Deserialize ("PathListOnly", PathListOnly);
+	}
+
+	bool GetHostDevicesRequest::RequiresElevation () const
+	{
+		return !Core->HasAdminPrivileges();
+	}
+
+	void GetHostDevicesRequest::Serialize (shared_ptr <Stream> stream) const
+	{
+		CoreServiceRequest::Serialize (stream);
+		Serializer sr (stream);
+		sr.Serialize ("PathListOnly", PathListOnly);
+	}
+
+	// ExitRequest
+	void ExitRequest::Deserialize (shared_ptr <Stream> stream)
+	{
+		CoreServiceRequest::Deserialize (stream);
+	}
+
+	void ExitRequest::Serialize (shared_ptr <Stream> stream) const
+	{
+		CoreServiceRequest::Serialize (stream);
+	}
+
+	// MountVolumeRequest
+	void MountVolumeRequest::Deserialize (shared_ptr <Stream> stream)
+	{
+		CoreServiceRequest::Deserialize (stream);
+		Serializer sr (stream);
+		DeserializedOptions = Serializable::DeserializeNew <MountOptions> (stream);
+		Options = DeserializedOptions.get();
+	}
+
+	bool MountVolumeRequest::RequiresElevation () const
+	{
+#ifdef TC_MACOSX
+		if (Options->Path->IsDevice())
+		{
+			try
+			{
+				File file;
+				file.Open (*Options->Path, File::OpenReadWrite);
+			}
+			catch (...)
+			{
+				return true;
+			}
+		}
+
+		return false;
+#endif
+		return !Core->HasAdminPrivileges();
+	}
+
+	void MountVolumeRequest::Serialize (shared_ptr <Stream> stream) const
+	{
+		CoreServiceRequest::Serialize (stream);
+		Serializer sr (stream);
+		Options->Serialize (stream);
+	}
+	
+	// SetFileOwnerRequest
+	void SetFileOwnerRequest::Deserialize (shared_ptr <Stream> stream)
+	{
+		CoreServiceRequest::Deserialize (stream);
+		Serializer sr (stream);
+		
+		uint64 owner;
+		sr.Deserialize ("Owner", owner);
+		Owner.SystemId = static_cast <uid_t> (owner);
+
+		Path = sr.DeserializeWString ("Path");
+	}
+
+	bool SetFileOwnerRequest::RequiresElevation () const
+	{
+		return !Core->HasAdminPrivileges();
+	}
+
+	void SetFileOwnerRequest::Serialize (shared_ptr <Stream> stream) const
+	{
+		CoreServiceRequest::Serialize (stream);
+		Serializer sr (stream);
+
+		uint64 owner = Owner.SystemId;
+		sr.Serialize ("Owner", owner);
+
+		sr.Serialize ("Path", wstring (Path));
+	}
+
+
+	TC_SERIALIZER_FACTORY_ADD_CLASS (CoreServiceRequest);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (CheckFilesystemRequest);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (DismountFilesystemRequest);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (DismountVolumeRequest);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (ExitRequest);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (GetDeviceSectorSizeRequest);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (GetDeviceSizeRequest);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (GetHostDevicesRequest);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (MountVolumeRequest);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (SetFileOwnerRequest);
+}

src/Core/Unix/CoreServiceRequest.h

@@ -0,0 +1,136 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_Core_Unix_CoreServiceRequest
+#define TC_HEADER_Core_Unix_CoreServiceRequest
+
+#include "Platform/Serializable.h"
+#include "Core/Core.h"
+
+namespace VeraCrypt
+{
+	struct CoreServiceRequest : public Serializable
+	{
+		CoreServiceRequest () : ElevateUserPrivileges (false), FastElevation (false) { }
+		TC_SERIALIZABLE (CoreServiceRequest);
+
+		virtual bool RequiresElevation () const { return false; }
+
+		string AdminPassword;
+		FilePath ApplicationExecutablePath;
+		bool ElevateUserPrivileges;
+		bool FastElevation;
+	};
+
+	struct CheckFilesystemRequest : CoreServiceRequest
+	{
+		CheckFilesystemRequest () { }
+		CheckFilesystemRequest (shared_ptr <VolumeInfo> volumeInfo, bool repair)
+			: MountedVolumeInfo (volumeInfo), Repair (repair) { }
+		TC_SERIALIZABLE (CheckFilesystemRequest);
+
+		virtual bool RequiresElevation () const;
+
+		shared_ptr <VolumeInfo> MountedVolumeInfo;
+		bool Repair;
+	};
+
+	struct DismountFilesystemRequest : CoreServiceRequest
+	{
+		DismountFilesystemRequest () { }
+		DismountFilesystemRequest (const DirectoryPath &mountPoint, bool force)
+			: Force (force), MountPoint (mountPoint) { }
+		TC_SERIALIZABLE (DismountFilesystemRequest);
+
+		virtual bool RequiresElevation () const;
+
+		bool Force;
+		DirectoryPath MountPoint;
+	};
+
+	struct DismountVolumeRequest : CoreServiceRequest
+	{
+		DismountVolumeRequest () { }
+		DismountVolumeRequest (shared_ptr <VolumeInfo> volumeInfo, bool ignoreOpenFiles, bool syncVolumeInfo)
+			: IgnoreOpenFiles (ignoreOpenFiles), MountedVolumeInfo (volumeInfo), SyncVolumeInfo (syncVolumeInfo) { }
+		TC_SERIALIZABLE (DismountVolumeRequest);
+
+		virtual bool RequiresElevation () const;
+
+		bool IgnoreOpenFiles;
+		shared_ptr <VolumeInfo> MountedVolumeInfo;
+		bool SyncVolumeInfo;
+	};
+
+	struct GetDeviceSectorSizeRequest : CoreServiceRequest
+	{
+		GetDeviceSectorSizeRequest () { }
+		GetDeviceSectorSizeRequest (const DevicePath &path) : Path (path) { }
+		TC_SERIALIZABLE (GetDeviceSectorSizeRequest);
+
+		virtual bool RequiresElevation () const;
+
+		DevicePath Path;
+	};
+
+	struct GetDeviceSizeRequest : CoreServiceRequest
+	{
+		GetDeviceSizeRequest () { }
+		GetDeviceSizeRequest (const DevicePath &path) : Path (path) { }
+		TC_SERIALIZABLE (GetDeviceSizeRequest);
+
+		virtual bool RequiresElevation () const;
+
+		DevicePath Path;
+	};
+
+	struct GetHostDevicesRequest : CoreServiceRequest
+	{
+		GetHostDevicesRequest () { }
+		GetHostDevicesRequest (bool pathListOnly) : PathListOnly (pathListOnly) { }
+		TC_SERIALIZABLE (GetHostDevicesRequest);
+
+		virtual bool RequiresElevation () const;
+
+		bool PathListOnly;
+	};
+
+	struct ExitRequest : CoreServiceRequest
+	{
+		TC_SERIALIZABLE (ExitRequest);
+	};
+
+	struct MountVolumeRequest : CoreServiceRequest
+	{
+		MountVolumeRequest () { }
+		MountVolumeRequest (MountOptions *options) : Options (options) { }
+		TC_SERIALIZABLE (MountVolumeRequest);
+
+		virtual bool RequiresElevation () const;
+
+		MountOptions *Options;
+
+	protected:
+		shared_ptr <MountOptions> DeserializedOptions;
+	};
+
+
+	struct SetFileOwnerRequest : CoreServiceRequest
+	{
+		SetFileOwnerRequest () { }
+		SetFileOwnerRequest (const FilesystemPath &path, const UserId &owner) : Owner (owner), Path (path) { }
+		TC_SERIALIZABLE (SetFileOwnerRequest);
+
+		virtual bool RequiresElevation () const;
+
+		UserId Owner;
+		FilesystemPath Path;
+	};
+}
+
+#endif // TC_HEADER_Core_Unix_CoreServiceRequest

src/Core/Unix/CoreServiceResponse.cpp

@@ -0,0 +1,119 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#include "CoreServiceResponse.h"
+#include "Platform/SerializerFactory.h"
+
+namespace VeraCrypt
+{
+	// CheckFilesystemResponse
+	void CheckFilesystemResponse::Deserialize (shared_ptr <Stream> stream)
+	{
+	}
+
+	void CheckFilesystemResponse::Serialize (shared_ptr <Stream> stream) const
+	{
+		Serializable::Serialize (stream);
+	}
+
+	// DismountFilesystemResponse
+	void DismountFilesystemResponse::Deserialize (shared_ptr <Stream> stream)
+	{
+	}
+
+	void DismountFilesystemResponse::Serialize (shared_ptr <Stream> stream) const
+	{
+		Serializable::Serialize (stream);
+	}
+
+	// DismountVolumeResponse
+	void DismountVolumeResponse::Deserialize (shared_ptr <Stream> stream)
+	{
+		DismountedVolumeInfo = Serializable::DeserializeNew <VolumeInfo> (stream);
+	}
+
+	void DismountVolumeResponse::Serialize (shared_ptr <Stream> stream) const
+	{
+		Serializable::Serialize (stream);
+		Serializer sr (stream);
+		DismountedVolumeInfo->Serialize (stream);
+	}
+
+	// GetDeviceSectorSizeResponse
+	void GetDeviceSectorSizeResponse::Deserialize (shared_ptr <Stream> stream)
+	{
+		Serializer sr (stream);
+		sr.Deserialize ("Size", Size);
+	}
+
+	void GetDeviceSectorSizeResponse::Serialize (shared_ptr <Stream> stream) const
+	{
+		Serializable::Serialize (stream);
+		Serializer sr (stream);
+		sr.Serialize ("Size", Size);
+	}
+
+	// GetDeviceSizeResponse
+	void GetDeviceSizeResponse::Deserialize (shared_ptr <Stream> stream)
+	{
+		Serializer sr (stream);
+		sr.Deserialize ("Size", Size);
+	}
+
+	void GetDeviceSizeResponse::Serialize (shared_ptr <Stream> stream) const
+	{
+		Serializable::Serialize (stream);
+		Serializer sr (stream);
+		sr.Serialize ("Size", Size);
+	}
+	
+	// GetHostDevicesResponse
+	void GetHostDevicesResponse::Deserialize (shared_ptr <Stream> stream)
+	{
+		Serializable::DeserializeList (stream, HostDevices);
+	}
+
+	void GetHostDevicesResponse::Serialize (shared_ptr <Stream> stream) const
+	{
+		Serializable::Serialize (stream);
+		Serializable::SerializeList (stream, HostDevices);
+	}
+
+	// MountVolumeResponse
+	void MountVolumeResponse::Deserialize (shared_ptr <Stream> stream)
+	{
+		Serializer sr (stream);
+		MountedVolumeInfo = Serializable::DeserializeNew <VolumeInfo> (stream);
+	}
+
+	void MountVolumeResponse::Serialize (shared_ptr <Stream> stream) const
+	{
+		Serializable::Serialize (stream);
+		Serializer sr (stream);
+		MountedVolumeInfo->Serialize (stream);
+	}
+
+	// SetFileOwnerResponse
+	void SetFileOwnerResponse::Deserialize (shared_ptr <Stream> stream)
+	{
+	}
+
+	void SetFileOwnerResponse::Serialize (shared_ptr <Stream> stream) const
+	{
+		Serializable::Serialize (stream);
+	}
+
+	TC_SERIALIZER_FACTORY_ADD_CLASS (CheckFilesystemResponse);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (DismountFilesystemResponse);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (DismountVolumeResponse);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (GetDeviceSectorSizeResponse);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (GetDeviceSizeResponse);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (GetHostDevicesResponse);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (MountVolumeResponse);
+	TC_SERIALIZER_FACTORY_ADD_CLASS (SetFileOwnerResponse);
+}

src/Core/Unix/CoreServiceResponse.h

@@ -0,0 +1,84 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#ifndef TC_HEADER_Core_Unix_CoreServiceResponse
+#define TC_HEADER_Core_Unix_CoreServiceResponse
+
+#include "Platform/Serializable.h"
+#include "Core/Core.h"
+
+namespace VeraCrypt
+{
+	struct CoreServiceResponse : public Serializable
+	{
+	};
+
+	struct CheckFilesystemResponse : CoreServiceResponse
+	{
+		CheckFilesystemResponse () { }
+		TC_SERIALIZABLE (CheckFilesystemResponse);
+	};
+
+	struct DismountFilesystemResponse : CoreServiceResponse
+	{
+		DismountFilesystemResponse () { }
+		TC_SERIALIZABLE (DismountFilesystemResponse);
+	};
+
+	struct DismountVolumeResponse : CoreServiceResponse
+	{
+		DismountVolumeResponse () { }
+		TC_SERIALIZABLE (DismountVolumeResponse);
+
+		shared_ptr <VolumeInfo> DismountedVolumeInfo;
+	};
+
+	struct GetDeviceSectorSizeResponse : CoreServiceResponse
+	{
+		GetDeviceSectorSizeResponse () { }
+		GetDeviceSectorSizeResponse (uint32 size) : Size (size) { }
+		TC_SERIALIZABLE (GetDeviceSectorSizeResponse);
+
+		uint32 Size;
+	};
+
+	struct GetDeviceSizeResponse : CoreServiceResponse
+	{
+		GetDeviceSizeResponse () { }
+		GetDeviceSizeResponse (uint64 size) : Size (size) { }
+		TC_SERIALIZABLE (GetDeviceSizeResponse);
+
+		uint64 Size;
+	};
+
+	struct GetHostDevicesResponse : CoreServiceResponse
+	{
+		GetHostDevicesResponse () { }
+		GetHostDevicesResponse (const HostDeviceList &hostDevices) : HostDevices (hostDevices) { }
+		TC_SERIALIZABLE (GetHostDevicesResponse);
+
+		HostDeviceList HostDevices;
+	};
+
+	struct MountVolumeResponse : CoreServiceResponse
+	{
+		MountVolumeResponse () { }
+		MountVolumeResponse (shared_ptr <VolumeInfo> volumeInfo) : MountedVolumeInfo (volumeInfo) { }
+		TC_SERIALIZABLE (MountVolumeResponse);
+
+		shared_ptr <VolumeInfo> MountedVolumeInfo;
+	};
+
+	struct SetFileOwnerResponse : CoreServiceResponse
+	{
+		SetFileOwnerResponse () { }
+		TC_SERIALIZABLE (SetFileOwnerResponse);
+	};
+}
+
+#endif // TC_HEADER_Core_Unix_CoreServiceResponse

src/Core/Unix/CoreUnix.cpp

@@ -0,0 +1,618 @@
+/*
+ Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved.
+
+ Governed by the TrueCrypt License 3.0 the full text of which is contained in
+ the file License.txt included in TrueCrypt binary and source code distribution
+ packages.
+*/
+
+#include "CoreUnix.h"
+#include <errno.h>
+#include <iostream>
+#include <signal.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <stdio.h>
+#include <unistd.h>
+#include "Platform/FileStream.h"
+#include "Driver/Fuse/FuseService.h"
+#include "Volume/VolumePasswordCache.h"
+
+namespace VeraCrypt
+{
+	CoreUnix::CoreUnix ()
+	{
+		signal (SIGPIPE, SIG_IGN);
+		
+		char *loc = setlocale (LC_ALL, "");
+		if (!loc || string (loc) == "C")
+			setlocale (LC_ALL, "en_US.UTF-8");
+	}
+
+	CoreUnix::~CoreUnix ()
+	{
+	}
+	
+	void CoreUnix::CheckFilesystem (shared_ptr <VolumeInfo> mountedVolume, bool repair) const
+	{
+		if (!mountedVolume->MountPoint.IsEmpty())
+			DismountFilesystem (mountedVolume->MountPoint, false);
+
+		list <string> args;
+
+		args.push_back ("-T");
+		args.push_back ("fsck");
+
+		args.push_back ("-e");
+
+		string xargs = "fsck ";
+
+#ifdef TC_LINUX
+		if (!repair)
+			xargs += "-n ";
+		else
+			xargs += "-r ";
+#endif
+
+		xargs += string (mountedVolume->VirtualDevice) + "; echo '[Done]'; read W";
+		args.push_back (xargs);
+
+		try
+		{
+			Process::Execute ("xterm", args, 1000);
+		} catch (TimeOut&) { }
+	}
+
+	void CoreUnix::DismountFilesystem (const DirectoryPath &mountPoint, bool force) const
+	{
+		list <string> args;
+
+#ifdef TC_MACOSX
+		if (force)
+			args.push_back ("-f");
+#endif
+		args.push_back ("--");
+		args.push_back (mountPoint);
+
+		Process::Execute ("umount", args);
+	}
+
+	shared_ptr <VolumeInfo> CoreUnix::DismountVolume (shared_ptr <VolumeInfo> mountedVolume, bool ignoreOpenFiles, bool syncVolumeInfo)
+	{
+		if (!mountedVolume->MountPoint.IsEmpty())
+		{
+			DismountFilesystem (mountedVolume->MountPoint, ignoreOpenFiles);
+
+			// Delete mount directory if a default path has been used
+			if (string (mountedVolume->MountPoint).find (GetDefaultMountPointPrefix()) == 0)
+				mountedVolume->MountPoint.Delete();
+		}
+
+		try
+		{
+			DismountNativeVolume (mountedVolume);
+		}
+		catch (NotApplicable &) { }
+
+		if (!mountedVolume->LoopDevice.IsEmpty())
+		{
+			try
+			{
+				DetachLoopDevice (mountedVolume->LoopDevice);
+			}
+			catch (ExecutedProcessFailed&) { }
+		}
+
+		if (syncVolumeInfo || mountedVolume->Protection == VolumeProtection::HiddenVolumeReadOnly)
+		{
+			sync();
+			VolumeInfoList ml = GetMountedVolumes (mountedVolume->Path);
+
+			if (ml.size() > 0)
+				mountedVolume = ml.front();
+		}
+
+		list <string> args;
+		args.push_back ("--");
+		args.push_back (mountedVolume->AuxMountPoint);
+
+		for (int t = 0; true; t++)
+		{
+			try
+			{
+				Process::Execute ("umount", args);
+				break;
+			}
+			catch (ExecutedProcessFailed&)
+			{
+				if (t > 10)
+					throw;
+				Thread::Sleep (200);
+			}
+		}
+
+		try
+		{
+			mountedVolume->AuxMountPoint.Delete();
+		}
+		catch (...)	{ }
+
+		VolumeEventArgs eventArgs (mountedVolume);
+		VolumeDismountedEvent.Raise (eventArgs);
+
+		return mountedVolume;
+	}
+
+	bool CoreUnix::FilesystemSupportsLargeFiles (const FilePath &filePath) const
+	{
+		string path = filePath;
+		size_t pos;
+		
+		while ((pos = path.find_last_of ('/')) != string::npos)
+		{
+			path = path.substr (0, pos);
+
+			if (path.empty())
+				break;
+
+			try
+			{
+				MountedFilesystemList filesystems = GetMountedFilesystems (DevicePath(), path);
+				if (!filesystems.empty())
+				{
+					const MountedFilesystem &fs = *filesystems.front();
+
+					if (fs.Type == "fat"
+						|| fs.Type == "fat32"
+						|| fs.Type == "vfat"
+						|| fs.Type == "fatfs"
+						|| fs.Type == "msdos"
+						|| fs.Type == "msdosfs"
+						|| fs.Type == "umsdos"
+						|| fs.Type == "dos"
+						|| fs.Type == "dosfs"
+						|| fs.Type == "pcfs"
+						)
+					{
+						return false;
+					}
+
+					return true;
+				}
+			}
+			catch (...) { }
+		}
+
+		return true;	// Prevent errors if the filesystem cannot be identified
+	}
+
+	bool CoreUnix::FilesystemSupportsUnixPermissions (const DevicePath &devicePath) const
+	{
+		File device;
+		device.Open (devicePath);
+
+		Buffer bootSector (device.GetDeviceSectorSize());
+		device.SeekAt (0);
+		device.ReadCompleteBuffer (bootSector);
+
+		byte *b = bootSector.Ptr(); 
+
+		return memcmp (b + 3,  "NTFS", 4) != 0
+			&& memcmp (b + 54, "FAT", 3) != 0
+			&& memcmp (b + 82, "FAT32", 5) != 0
+			&& memcmp (b + 3,  "EXFAT", 5) != 0;
+	}
+
+	string CoreUnix::GetDefaultMountPointPrefix () const
+	{
+		const char *envPrefix = getenv ("VERACRYPT_MOUNT_PREFIX");
+		if (envPrefix && !string (envPrefix).empty())
+			return envPrefix;
+		
+		if (FilesystemPath ("/media").IsDirectory())
+			return "/media/veracrypt";
+		
+		if (FilesystemPath ("/mnt").IsDirectory())
+			return "/mnt/veracrypt";
+		
+		return GetTempDirectory() + "/veracrypt_mnt";
+	}
+
+	uint32 CoreUnix::GetDeviceSectorSize (const DevicePath &devicePath) const
+	{
+		File dev;
+		dev.Open (devicePath);
+		return dev.GetDeviceSectorSize();
+	}
+
+	uint64 CoreUnix::GetDeviceSize (const DevicePath &devicePath) const
+	{
+		File dev;
+		dev.Open (devicePath);
+		return dev.Length();
+	}
+
+	DirectoryPath CoreUnix::GetDeviceMountPoint (const DevicePath &devicePath) const
+	{
+		DevicePath devPath = devicePath;
+#ifdef TC_MACOSX
+		if (string (devPath).find ("/dev/rdisk") != string::npos)
+			devPath = string ("/dev/") + string (devicePath).substr (6);
+#endif
+		MountedFilesystemList mountedFilesystems = GetMountedFilesystems (devPath);
+
+		if (mountedFilesystems.size() < 1)
+			return DirectoryPath();
+
+		return mountedFilesystems.front()->MountPoint;
+	}
+
+	VolumeInfoList CoreUnix::GetMountedVolumes (const VolumePath &volumePath) const
+	{
+		VolumeInfoList volumes;
+
+		foreach_ref (const MountedFilesystem &mf, GetMountedFilesystems ())
+		{
+			if (string (mf.MountPoint).find (GetFuseMountDirPrefix()) == string::npos)
+				continue;
+
+			shared_ptr <VolumeInfo> mountedVol;
+			try
+			{
+				shared_ptr <File> controlFile (new File);
+				controlFile->Open (string (mf.MountPoint) + FuseService::GetControlPath());
+
+				shared_ptr <Stream> controlFileStream (new FileStream (controlFile));
+				mountedVol = Serializable::DeserializeNew <VolumeInfo> (controlFileStream);
+			}
+			catch (...)
+			{
+				continue;
+			}
+			
+			if (!volumePath.IsEmpty() && wstring (mountedVol->Path).compare (volumePath) != 0)
+				continue;
+
+			mountedVol->AuxMountPoint = mf.MountPoint;
+
+			if (!mountedVol->VirtualDevice.IsEmpty())
+			{
+				MountedFilesystemList mpl = GetMountedFilesystems (mountedVol->VirtualDevice);
+
+				if (mpl.size() > 0)
+					mountedVol->MountPoint = mpl.front()->MountPoint;
+			}
+
+			volumes.push_back (mountedVol);
+
+			if (!volumePath.IsEmpty())
+				break;
+		}
+
+		return volumes;
+	}
+	
+	gid_t CoreUnix::GetRealGroupId () const
+	{
+		const char *env = getenv ("SUDO_GID");
+		if (env)
+		{
+			try
+			{
+				string s (env);
+				return static_cast <gid_t> (StringConverter::ToUInt64 (s));
+			}
+			catch (...) { }
+		}
+
+		return getgid();
+	}
+
+	uid_t CoreUnix::GetRealUserId () const
+	{
+		const char *env = getenv ("SUDO_UID");
+		if (env)
+		{
+			try
+			{
+				string s (env);
+				return static_cast <uid_t> (StringConverter::ToUInt64 (s));
+			}
+			catch (...) { }
+		}
+
+		return getuid();
+	}
+	
+	string CoreUnix::GetTempDirectory () const
+	{
+		char *envDir = getenv ("TMPDIR");
+		return envDir ? envDir : "/tmp";
+	}
+
+	bool CoreUnix::IsMountPointAvailable (const DirectoryPath &mountPoint) const
+	{
+		return GetMountedFilesystems (DevicePath(), mountPoint).size() == 0;
+	}
+
+	void CoreUnix::MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions) const
+	{
+		if (GetMountedFilesystems (DevicePath(), mountPoint).size() > 0)
+			throw MountPointUnavailable (SRC_POS);
+
+		list <string> args;
+		string options;
+
+		if (!filesystemType.empty())
+		{
+#ifdef TC_SOLARIS
+			args.push_back ("-F");
+#else
+			args.push_back ("-t");
+#endif
+			args.push_back (filesystemType);
+		}
+
+		if (readOnly)
+			options = "-oro";
+
+		if (!systemMountOptions.empty())
+		{
+			if (options.empty())
+				options = "-o";
+			else
+				options += ",";
+
+			options += systemMountOptions;
+		}
+
+		if (!options.empty())
+			args.push_back (options);
+
+		args.push_back ("--");
+		args.push_back (devicePath);
+		args.push_back (mountPoint);
+
+		Process::Execute ("mount", args);
+	}
+
+	VolumeSlotNumber CoreUnix::MountPointToSlotNumber (const DirectoryPath &mountPoint) const
+	{
+		string mountPointStr (mountPoint);
+		if (mountPointStr.find (GetDefaultMountPointPrefix()) == 0)
+		{
+			try
+			{
+				return StringConverter::ToUInt32 (StringConverter::GetTrailingNumber (mountPointStr));
+			}
+			catch (...) { }
+		}
+		return GetFirstFreeSlotNumber();
+	}
+
+	shared_ptr <VolumeInfo> CoreUnix::MountVolume (MountOptions &options)
+	{
+		CoalesceSlotNumberAndMountPoint (options);
+
+		if (IsVolumeMounted (*options.Path))
+			throw VolumeAlreadyMounted (SRC_POS);
+
+		Cipher::EnableHwSupport (!options.NoHardwareCrypto);
+
+		shared_ptr <Volume> volume;
+
+		while (true)
+		{
+			try
+			{
+				volume = OpenVolume (
+					options.Path,
+					options.PreserveTimestamps,
+					options.Password,
+					options.Keyfiles,
+					options.Protection,
+					options.ProtectionPassword,
+					options.ProtectionKeyfiles,
+					options.SharedAccessAllowed,
+					VolumeType::Unknown,
+					options.UseBackupHeaders,
+					options.PartitionInSystemEncryptionScope
+					);
+
+				options.Password.reset();
+			}
+			catch (SystemException &e)
+			{
+				if (options.Protection != VolumeProtection::ReadOnly
+					&& (e.GetErrorCode() == EROFS || e.GetErrorCode() == EACCES || e.GetErrorCode() == EPERM))
+				{
+					// Read-only filesystem
+					options.Protection = VolumeProtection::ReadOnly;
+					continue;
+				}
+
+				throw;
+			}
+
+			break;
+		}
+
+		if (options.Path->IsDevice())
+		{
+			if (volume->GetFile()->GetDeviceSectorSize() != volume->GetSectorSize())
+				throw ParameterIncorrect (SRC_POS);
+
+#if defined (TC_LINUX)
+			if (volume->GetSectorSize() != TC_SECTOR_SIZE_LEGACY)
+			{
+				if (options.Protection == VolumeProtection::HiddenVolumeReadOnly)
+					throw UnsupportedSectorSizeHiddenVolumeProtection();
+
+				if (options.NoKernelCrypto)
+					throw UnsupportedSectorSizeNoKernelCrypto();
+			}
+#endif
+		}
+
+		// Find a free mount point for FUSE service
+		MountedFilesystemList mountedFilesystems = GetMountedFilesystems ();
+		string fuseMountPoint;
+		for (int i = 1; true; i++)
+		{
+			stringstream path;
+			path << GetTempDirectory() << "/" << GetFuseMountDirPrefix() << i;
+			FilesystemPath fsPath (path.str());
+
+			bool inUse = false;
+
+			foreach_ref (const MountedFilesystem &mf, mountedFilesystems)
+			{
+				if (mf.MountPoint == path.str())
+				{
+					inUse = true;
+					break;
+				}
+			}
+
+			if (!inUse)
+			{
+				try
+				{
+					if (fsPath.IsDirectory())
+						fsPath.Delete();
+
+					throw_sys_sub_if (mkdir (path.str().c_str(), S_IRUSR | S_IXUSR) == -1, path.str());
+
+					fuseMountPoint = fsPath;
+					break;
+				}
+				catch (...)
+				{
+					if (i > 255)
+						throw TemporaryDirectoryFailure (SRC_POS, StringConverter::ToWide (path.str()));
+				}
+			}
+		}
+
+		try
+		{
+			FuseService::Mount (volume, options.SlotNumber, fuseMountPoint);
+		}
+		catch (...)
+		{
+			try
+			{
+				DirectoryPath (fuseMountPoint).Delete();
+			}
+			catch (...) { }
+			throw;
+		}
+
+		try
+		{
+			// Create a mount directory if a default path has been specified
+			bool mountDirCreated = false;
+			string mountPoint;
+			if (!options.NoFilesystem && options.MountPoint)
+			{
+				mountPoint = *options.MountPoint;
+
+#ifndef TC_MACOSX
+				if (mountPoint.find (GetDefaultMountPointPrefix()) == 0 && !options.MountPoint->IsDirectory())
+				{
+					Directory::Create (*options.MountPoint);
+					try
+					{
+						throw_sys_sub_if (chown (mountPoint.c_str(), GetRealUserId(), GetRealGroupId()) == -1, mountPoint);
+					} catch (ParameterIncorrect&) { }
+
+					mountDirCreated = true;
+				}
+#endif
+			}
+
+			try
+			{
+				try
+				{
+					MountVolumeNative (volume, options, fuseMountPoint);
+				}
+				catch (NotApplicable&)
+				{
+					MountAuxVolumeImage (fuseMountPoint, options);
+				}
+			}
+			catch (...)
+			{
+				if (mountDirCreated)
+					remove (mountPoint.c_str());
+				throw;
+			}
+		}
+		catch (...)
+		{
+			try
+			{
+				VolumeInfoList mountedVolumes = GetMountedVolumes (*options.Path);
+				if (mountedVolumes.size() > 0)
+				{
+					shared_ptr <VolumeInfo> mountedVolume (mountedVolumes.front());
+					DismountVolume (mountedVolume);
+				}
+			}
+			catch (...) { }
+			throw;
+		}
+
+		VolumeInfoList mountedVolumes = GetMountedVolumes (*options.Path);
+		if (mountedVolumes.size() != 1)
+			throw ParameterIncorrect (SRC_POS);
+
+		VolumeEventArgs eventArgs (mountedVolumes.front());
+		VolumeMountedEvent.Raise (eventArgs);
+
+		return mountedVolumes.front();
+	}
+
+	void CoreUnix::MountAuxVolumeImage (const DirectoryPath &auxMountPoint, const MountOptions &options) const
+	{
+		DevicePath loopDev = AttachFileToLoopDevice (string (auxMountPoint) + FuseService::GetVolumeImagePath(), options.Protection == VolumeProtection::ReadOnly);
+
+		try
+		{
+			FuseService::SendAuxDeviceInfo (auxMountPoint, loopDev, loopDev);
+		}
+		catch (...)
+		{
+			try
+			{
+				DetachLoopDevice (loopDev);
+			}
+			catch (...) { }
+			throw;
+		}
+
+		if (!options.NoFilesystem && options.MountPoint && !options.MountPoint->IsEmpty())
+		{
+			MountFilesystem (loopDev, *options.MountPoint,
+				StringConverter::ToSingle (options.FilesystemType),
+				options.Protection == VolumeProtection::ReadOnly,
+				StringConverter::ToSingle (options.FilesystemOptions));
+		}
+	}
+
+	void CoreUnix::SetFileOwner (const FilesystemPath &path, const UserId &owner) const
+	{
+		throw_sys_if (chown (string (path).c_str(), owner.SystemId, (gid_t) -1) == -1);
+	}
+
+	DirectoryPath CoreUnix::SlotNumberToMountPoint (VolumeSlotNumber slotNumber) const
+	{
+		if (slotNumber < GetFirstSlotNumber() || slotNumber > GetLastSlotNumber())
+			throw ParameterIncorrect (SRC_POS);
+
+		stringstream s;
+		s << GetDefaultMountPointPrefix() << slotNumber;
+		return s.str();
+	}
+}