Embed both Microsoft UEFI CA 2011 and 2023 signed DCS EFI sets and select the 2023 set only when the firmware db trusts the required 2023 third-party CAs.
Fall back to the 2011 EFI set when firmware db state cannot be determined, preserving pre-existing compatibility behavior and recording the reason in HKLM diagnostics.
Refresh installed ESP modules during PostOOBE repair, keep backups before replacing existing DCS modules, and use the selected EFI set when creating rescue media.
Record the selected EFI bootloader resource set and selection reason in HKLM, allow larger firmware db variables on systems with many Secure Boot certificates, and remove diagnostic registry keys on uninstall.
Fix MSI SetupDLL COM typelib version constants so unregister targets the current Main and Format COM typelib versions.
References: https://github.com/veracrypt/VeraCrypt/issues/1655
Keep the NTFS kernel-driver option as a generic in-kernel NTFS path rather than an ntfs3-specific path. Add --filesystem=kernel-ntfs and -m kernelntfs routes that select a registered or loadable kernel NTFS driver and mount with -i so mount.ntfs/ntfs-3g helpers are not invoked.
Preserve --filesystem=ntfs3 as a literal pin to the ntfs3 driver. Treat both ntfs3 and kernel-ntfs as mount-only selectors; volume creation continues to use filesystem type NTFS.
The preference and -m kernelntfs path only select an in-kernel NTFS driver when no explicit filesystem type was supplied and blkid detects NTFS.
Treat ntfs as the preferred in-kernel driver on Linux 7.1 and later, where the upstream read/write driver is expected. On earlier kernels, select ntfs only when module metadata identifies the standalone read/write driver and /sys/module confirms it loaded, avoiding ntfs3 read-only ntfs compatibility registrations. Fall back to ntfs3 otherwise, and report a generic kernel-driver error if neither supported driver is available or loadable.
Rename the internal preference/config field to MountNtfsWithKernelDriver, migrate the old MountNtfsWithNtfs3 preference key, and update UI strings, CLI help, documentation, release notes, and translation placeholders accordingly.
Reference: https://github.com/veracrypt/VeraCrypt/issues/1735
* ensure reproducible builds
* improve patch
* improve patch
* Narrow reproducibility scope to legacy and DEB
Keep the verified Linux legacy Makefile and DEB reproducibility paths, but remove the unverified RPM/openSUSE timestamp changes and AppImage reproducibility behavior from this PR.
The CPack mtime/mode clamp is now installed only for Debian/Ubuntu packaging, matching the scope covered by the provided reproducibility logs.
Retain umask 022 in the RPM/openSUSE wrappers so staged package permissions do not depend on a restrictive caller umask.
* Harden reproducible build cleanup
Validate SOURCE_DATE_EPOCH before interpolating it into Make, CMake or shell packaging paths.
Refuse live DESTDIR values in the CPack mtime clamp and pass makeself options through normal argv construction instead of eval.
---------
Co-authored-by: curious-rabbit <curious-rabbit@local>
Co-authored-by: Mounir IDRASSI <mounir.idrassi@amcrypto.jp>
Replace the Linux ntfs3 help icon paint lambda with a small wxWindow
subclass and regular paint event handler.
GCC 4.4, used on CentOS 6, builds with -std=c++0x but does not support
the lambda syntax used in PreferencesDialog.cpp, causing compilation to
fail at the ntfs3 help icon handler.
The drawing behavior is unchanged.
Keep the executable requirement at CMake 2.8.12 for legacy CentOS 6 package builders while using the version-range syntax to declare policy compatibility up to 3.10. Newer CMake versions use the policy maximum to avoid CMake 4 failures, and older CMake versions ignore the suffix and continue to configure as before.
Enable use_ino for Linux FUSE mounts so stable inode numbers returned by getattr and readdir are reported to userspace. For FUSE3, set fuse_config.use_ino from init; for FUSE2, pass -o use_ino because there is no fuse_config init hook.
Also map otherwise unhandled FUSE exceptions to EIO instead of EINTR, since these failures are not signal interruptions and should not encourage retry loops.
Prefer hdiutil plist entities that carry a mount-point when recording the virtual device. This fixes APFS images where the first dev-entry is not the mounted volume.
Add a macOS mounted-volume refresh hook that recovers VirtualDevice and MountPoint from hdiutil info when FUSE-T SMB auxiliary metadata is missing or stale.
APFS volume creation can still fail with Permission denied after preparing the raw and block device aliases because newfs_apfs performs privileged APFS container and volume operations beyond opening the device nodes.
Route APFS formatting through the elevated CoreService path for non-root macOS runs. Keep the elevated interface narrow by sending only the target device and invoking user UID/GID, validate the device path on the privileged side, rebuild the formatter arguments there, and execute /sbin/newfs_apfs by absolute path to avoid PATH shadowing.
Pass -U/-G so the created filesystem preserves the invoking user ownership. Apply the same path to GUI and text-mode creation.
When creating an APFS filesystem inside a newly created device-hosted volume, VeraCrypt prepared only the raw hdiutil device path before invoking newfs_apfs. On macOS, newfs_apfs may resolve or reopen the corresponding block device path, which can fail with Permission denied for non-root GUI runs.
Prepare both raw and block aliases for the temporary formatter device, restore changed owners afterward, and share the helper between GUI and text-mode volume creation. Restore each changed alias independently so one restore failure does not skip the rest.
Add a -t option to build_veracrypt_macosx.sh so VC_OSX_TARGET can be set explicitly while preserving the existing defaults for source and Homebrew builds.
Fixes#1726.
Keep device selection enumeration unchanged to avoid slow dialog loads.
In the format wizard, inspect only the selected target with diskutil info -plist and reject APFS synthesized devices, macOS system/support targets, read-only targets, and current APFS system stores. Add a read-only APFS hint for creation failures.
Remove the duplicate Shell_NotifyIconW(NIM_MODIFY) call from the tray balloon helper. On Windows 11, the shell can queue the repeated NIF_INFO request and show the same unmount notification twice.
Fixes#1630
* Update Language.ro_1.26.28.xml
* Update Language.ro_1.26.28.xml
I corrected the signaled problems, where was the case and where I did not it was because of misinterpretation of AI.
* Update Language.ro_1.26.28.xml
Final version, for now.
* Update Language.ro_1.26.28.xml
Corrected PIM_ARGON2_SMALL_WARNING
Reject empty or truncated TLV buffers, unsupported indefinite lengths, and declared value lengths that exceed the remaining input or uint16 node storage. Parse BER long-form lengths in big-endian order before copying value bytes.
Report explicit progress stages while writing volume data, writing backup headers, and flushing data to disk so the wizard does not appear stuck at 100%.
Keep the wizard in progress during Unix post-creation formatting and show status for temporary mount/device setup, mkfs invocation, and dismount.
When normal filesystem unmount fails, the Linux path could stop before cleaning VeraCrypt mapper, loop and FUSE objects. Add an explicit emergency dismount request that is only reached after interactive confirmation.
The recovery path lazy-detaches mounted filesystems, uses deferred dmsetup removal for VeraCrypt mapper devices, detaches loop devices, and keeps normal force/ignoreOpenFiles behavior unchanged.
Validate SecRegion password cache offsets before use.
Wipe decrypted SecRegion password-cache data even when cache validation fails.
Clamp encrypted I/O work item counts and check allocation sizing.
Reject invalid boot drive sector writes and initialize decoy wipe data unit.
Validate hidden-system boot offsets and remap arithmetic before use.
Verify restored EFI Microsoft and fallback boot loader paths after system decryption.
Show clearer recovery guidance when EFI file restoration or NVRAM cleanup remains incomplete.
Add a GPT-only EFI boot loader repair menu action for already decrypted systems.
The read loop that captures stderr from the sudo child process used
`vector<char> buffer(4096); buffer.clear();` followed by
`read(fd, &buffer[0], buffer.capacity())`. This has two instances of
undefined behavior:
1. `operator[](0)` on a vector with `size() == 0` violates the C++
standard precondition `n < size()`. libstdc++ built with
`-D_GLIBCXX_ASSERTIONS` aborts the process with:
stl_vector.h:1128: Assertion '__n < this->size()' failed.
2. `buffer.begin() + bytesRead` on the same empty vector constructs
an iterator past `end()`, also UB.
`-D_GLIBCXX_ASSERTIONS` is in the default build flags of Arch Linux,
Fedora, and several other distributions. On those systems, the
unprivileged helper process aborts as soon as sudo writes anything
to stderr (a password prompt, a 'user is not in the sudoers file'
error, etc.). The main process then sees EOF on the service output
pipe, and throws `InsufficientData`, which renders to the user as
'Not enough data available'. A second mount attempt fails at
`File::Write` because the helper is dead and the pipe is broken,
producing the bare message 'VeraCrypt::File::Write:395'.
Fix by replacing `buffer` with a plain `char[4096]` and using
`reserve(4096)` on `errOutput` to preserve the original
pre-allocation intent. No behavioral change on systems where the UB
happened to work; aborts are eliminated on systems where the
assertions fire.
Reported-by: multiple users, see veracrypt/VeraCrypt#1550,
veracrypt/VeraCrypt#1446, veracrypt/VeraCrypt#844
Co-authored-by: rabbit <rabbit@github>
Make /aux-device-info readable for SMB, verify that FUSE records hdiutil device info after mount and recover missing virtual devices from hdiutil before dismounting auxiliary mounts.
Add statfs metadata for the auxiliary FUSE mount, keep /control read-only by sending hdiutil device data through /aux-device-info and tolerate delayed SMB rediscovery during mount completion. Log final control-file retry failures for diagnostics.
Use the same SystemFavorites service flag mapping for /PostOOBE bootloader repair as the non-forced service update path. This prevents Windows upgrade repair from adding VeraCrypt to BootOrder or forcing it first when those actions are disabled, while forced updates keep their previous behavior and still repair the loader.
Copy selected favorite volumes into mount thread parameters so background mounting does not depend on mutable global vector storage. Also avoid unnecessary FavoriteVolume copies in auto-mount paths and fix mount-on-arrival state updates.
Refs #1661
* Windows: Add input validation whitelists to elevated COM methods
* Windows: Add drive number validation to FormatNtfs and FormatFs COM methods
* Windows: Fix correctness regressions in elevated COM format and device path validation
* Windows: Revert unready COM input validation; keep FormatNtfs/FormatFs return fix
wxWidgets does not propagate mouse motion events from child controls to parent windows. The Linux/macOS GUI was binding the random-pool mouse handlers only to the dialog/page and its direct children, which left nested controls such as static-box contents and the wizard image as dead zones.
Add a reusable recursive child-window event binder and use it in the keyfile generator, random pool enrichment dialog, and volume creation wizard. The root windows keep their existing generated bindings, while descendants are bound explicitly, avoiding duplicate handling on the root while covering all nested controls.
This makes the entropy gauge and the random pool update consistently no matter where the pointer moves inside the affected windows.
Fixes#1656.
Local macOS builds disable universal binaries. On Apple Silicon, that means
the regular objects are built for arm64 only, but Volume.make still selected
the macOS assembly bundle. Several of those assembly outputs are x86_64 only,
which makes ranlib reject Volume.a because it contains mixed cputypes.
Make local arm64 macOS builds use the existing arm64 crypto object path and
have the macOS build wrapper export CPU_ARCH/COMPILE_ASM consistently for
local builds.
wxWidgets 3.3 removed the configure switches for explicitly enabling
Unicode and std_string support. Passing these options now makes configure
fail with "unrecognized options" when option checking is enabled.
Keep the legacy switches for older wxWidgets releases, but only add them
from the wxbuild recipe when the target configure script still supports the
corresponding Autoconf option variables.
* Fix hibernation crash on fresh Windows 11 25H2 (BSOD Event 41)
* follow up on the hibernation fix review: fix MDL check order and drop the risky sleep.
Make MSI-installed VeraCrypt use the IDRIX-signed COMReg package as the
source for traveler files, matching the EXE installer flow. COMReg now
packages the x64 traveler payload, so traveler creation no longer has to
copy the installed x64 driver from appDir\veracrypt.sys and verify it
against a Microsoft WHQL certificate fingerprint.
Keep Microsoft WHQL certificate verification only for the loose portable
driver fallback, where driver files cannot be signed with the IDRIX code
signing certificate. The normal VerifyModuleSignature path now remains
IDRIX-only.
Also validate that an MSI COMReg package actually contains the required
x64 traveler files before reporting success, avoiding partial traveler
directories when the package payload is incomplete.
When dismounting via CLI (/d /q /s), SHChangeNotify is called without
SHCNF_FLUSH flag, making it asynchronous. The process exits before
Explorer processes the notification, leaving a phantom drive letter
visible in Explorer as an inaccessible Local Disk until reboot.
Add SHCNF_FLUSH in Silent (CLI) mode to force synchronous shell
notification processing in both single-volume (UnmountVolumeBase)
and dismount-all (DismountAll) code paths. The flush is only added
in CLI mode to avoid adding latency to interactive GUI operations.
Co-authored-by: Contributor <contributor@example.com>
The commit 9ea5ccc4aa introduced this bug
by creating a translation key named "DISABLE_SCREEN_PROTECTION_WARNING"
but used the key "DISABLE_SCREEN_PROTECTION_HELP" into the installation
wizard.
Now it is possible to enable IME during Secure Desktop using a setting in Preferences or using /enableIME switch.
This helps solve issues with some IME that causes VeraCrypt to freeze when selecting keyfile while VeraCrypt secure desktop is active.
See: https://sourceforge.net/p/veracrypt/discussion/general/thread/1e8b9aeacd
Introduce MapIrpDataBuffer to handle Direct/Buffered/Neither I/O, probing & locking pages and allocating a temp MDL when needed.
Replace blind MmGetSystemAddressForMdlSafe usage. clean up TempUserMdl in OnItemCompleted to avoid crashes when MdlAddress is NULL.
Issue reported at https://sourceforge.net/p/veracrypt/discussion/technical/thread/e43bde8d86/
- Replace dynamic GetProcAddress usage with direct SetThreadGroupAffinity call since we run under Windows 10 minimum
- Compute affinity mask based on actual active processor count
- Fix off-by-one when assigning threads to processor groups (use > instead of >=), preventing premature group advance
- Improves correctness on multi-group (>=64 CPU) systems
Replace timer-based TCSleep (which allocated a KTIMER and waited on it) with an
implementation that calls KeDelayExecutionThread. This removes dynamic allocation
and kernel timer usage to simplify the code and reduce resource overhead.
Adds an IRQL <= APC_LEVEL assertion and documents the requirement.
This is safe because TCSleep is always called from code that runs at PASSIVE_LEVEL
Added InterlockedDecrement in the error path when GetPoolBuffer fails for EncryptedIoRequest to ensure accurate tracking of pending IO requests and prevent potential resource leaks.
Major changes:
- Added pooled + elastic work item model with retry/backoff (MAX_WI_RETRIES). removed semaphore usage.
- Introduced two completion threads to reduce contention and latency under heavy IO.
- Added BytesCompleted (per IRP) and ActualBytes (per fragment) for correct short read/write accounting. total read/write stats now reflect real transferred bytes instead of requested length.
- Moved decryption of read fragments into IO thread. completion threads now only finalize IRPs (reduces race window and simplifies flow).
- Deferred final IRP completion via FinalizeOriginalIrp to avoid inline IoCompleteRequest re-entrancy. added safe OOM inline fallback.
- Implemented work item pool drain & orderly shutdown (ActiveWorkItems + NoActiveWorkItemsEvent) with robust stop protocol.
- Replaced semaphore-based work item acquisition with spin lock + free list + event (WorkItemAvailableEvent). added exponential backoff for transient exhaustion.
- Added elastic (on-demand) work item allocation with pool vs dynamic origin tracking (FromPool).
- Added FreeCompletionWorkItemPool() for symmetric cleanup; ensured all threads are explicitly awakened during stop.
- Added second completion thread replacing single CompletionThread.
- Hardened UpdateBuffer: fixed parameter name typo, added bounds/overflow checks using IntSafe (ULongLongAdd), validated Count, guarded sector end computation.
- Fixed GPT/system region write protection logic to pass correct length instead of end offset.
- Ensured ASSERTs use fragment‑relative bounds (cast + length) and avoided mixed 64/32 comparisons.
- Added MAX_WI_RETRIES constant. added WiRetryCount field in EncryptedIoRequest.
- Ensured RemoveLock is released only after all queue/accounting updates (OnItemCompleted).
- Reset/read-ahead logic preserved. read-ahead trigger now based on actual completion & zero pending fragment count.
- General refactoring, clearer separation of concerns (TryAcquireCompletionWorkItem / FinalizeOriginalIrp / HandleCompleteOriginalIrp).
Safety / correctness improvements:
- Accurate short read handling (STATUS_END_OF_FILE with true byte count).
- Eliminated risk of double free or premature RemoveLock release on completion paths.
- Prevented potential overflow in sector end arithmetic.
- Reduced contention and potential deadlock scenarios present with previous semaphore wait path.
- Document HIGH_LEVEL constraints and rationale for pre-building a nonpaged scratch MDL.
- Allocate contiguous scratch buffer with conservative PFN cap (0x7FFFFFFFFFF) and fall back to unlimited cap if needed.
- Replace ASSERT with TC_BUG_CHECK for validation of write MDL mapping at HIGH_LEVEL.
- Safely copy PFNs from prebuilt MDL into caller MDL: compute dst/src page counts, check capacity, copy exact PFNs and retarget MDL header fields (preserve MdlFlags).
- Make DumpData cleanup defensive in unload path.
- comments improvements for clarity and maintainability.
* Prefer allocations to be non-executable
* Remove and reimplement DDIs inappropriately called inside HIGH_LEVEL IRQL routines
* Refactor hibernate context to be passed around in the passed FILTER_EXTENSION pointer rather than global
Column width was updated before SlotListCtrl had the slots added,
which caused the column width to be incorrect before the first time
OnTimer ran to update it. Changing the order ensures the column width
is correct on program launch. Also ensure that we do not autosize
column to fit empty content.
* Documentation: Remove XHTML spec and fix errors
None of the docs follow the XHTML specification, which means
that programs that expect this (such as Gnome Web) as it is advertised
as such, will completely fail to parse it as it is incorrect syntax. So
it is removed.
* Remove .chm files
Update the old logo with a simplified one without extra label text.
.ico and .icns are updated on Windows and macOS, and .png, .svg
are added on Linux and FreeBSD.
Original logo design by Andreas Becker, recreated by danielwerg with
some edits and symbolic version by me.
When multiple VeraCrypt.exe instances were launched simultaneously, race conditions
could occur during the WM_INITDIALOG processing phase, potentially causing application
crashes or hang. This was because the initialization logic handles critical operations
like mounting/unmounting volumes and processing favorite volumes that modify global
system state.
This commit:
- Adds a named local session mutex (MainInitMutex) that serializes the WM_INITDIALOG handler
- Implements proper acquisition and release of the mutex during initialization
- Ensures proper cleanup of mutex resources on application exit
This update introduces a screen protection mechanism that leverages the Windows Display Affinity API to prevent screen capture, screen recording, and inclusion in the Windows 11 Recall feature. By default, all VeraCrypt windows, menus, and tooltips are protected. Users can enable or disable this feature through a new setting available in the application Preferences, as well as in the installer and MSI configurations.
This enhances user privacy by mitigating potential leaks of sensitive interface content.
Note: Due to a regression in Windows 11 affecting layered windows, ComboBox dropdowns cannot currently be protected by this mechanism.
The cascade order has been updated so that SM4 is applied after the other cipher(s) (e.g., Serpent). This change reflects standard cryptanalytic guidance, which shows that the overall strength of a cascade is limited by the first encryption stage. Given that SM4 uses a 128-bit key, its post-quantum brute-force resistance is lower than ciphers with a 256-bit key (such as Serpent). By placing SM4 last, we ensure that any potential weakness in SM4 cannot reduce the security margin provided by the stronger cipher.
When VeraCrypt is run as an AppImage, the veracrypt binary resides in a SquashFS mount under /tmp which is inaccessible to root. Using this path with sudo results in a "command not found" error.
This patch detects the AppImage environment by checking both APPIMAGE and APPDIR variables, ensuring the executable path starts with APPDIR and that APPDIR starts with the expected "/tmp/.mount_Veracr" prefix. In this scenario, the AppImage file itself (APPIMAGE) is used as the executable for sudo, resolving the elevation issue.
- Added parameters for cluster size (auto/manual), encryption/hash, safety margin, VeraCrypt overhead, and VeraCrypt path override
- Switched to iterative exFAT size calculation for accurate FAT/bitmap sizing
- Auto-selects optimal cluster size based on data size
- Supports -WhatIf/-Confirm (SupportsShouldProcess) for safe operation
- Allows password via pipeline or prompt; improved error handling and cleanup
- Enhanced output, free space checks, and force-overwrite option
- Improved code structure, comments, and user feedback
Replaced hardcoded 0x56455241 ('VERA') with TC_HEADER_MAGIC for better readability and maintainability.
Also replaced 0x5645524142455854 with TC_BOOT_DRIVE_FILTER_EXTENSION_MAGIC and added 'ULL' suffix for 64-bit safety.
This commit updates several strings in the Italian language file
based on an expert review.
The changes focus on:
- Using more idiomatic phrasing (e.g., "negazione plausibile").
- Employing standard IT terminology (e.g., "Codice di errore").
- Adjusting formality for better UX (e.g., informal commands, recommendations).
- Improving sentence structure for system messages (e.g., impersonal "si").
This patch moves away from gnome-terminal -e options which is deprecated
and subject to possibly be removed in the future. The -- option is nearly
equivalent in behaviour. Also ensures that uninstallation script has correct
privileges, adds window title to xmessage and ensures correct files are
used during installation.
The method GetNodes implementation didn't parse multiple attributes correctly and it failed with Hungarian XML because of the presence of '>' character in an attribute value.
Issue reported in https://github.com/veracrypt/VeraCrypt/pull/1516
Now we properly honor the AllowDefrag configuration.
This regression introduced other issues because, in order to allow defragmentation, we must provide Windows with an actual physical disk number. As a result, we assign the number of the physical disk where the VeraCrypt volume resides. This, in turn, causes Windows to send IOCTLs directly to this disk instead of to VeraCrypt. If these IOCTLs return values and properties not supported by VeraCrypt, inconsistencies arise, leading to failures.
- matching the phases used in Chinese Traditional Windows
- resolved conflicts introduced in 498dff9013
- minor formatting correction
- translated new entries staring from line 1459
* refactor: use UNMOUNT instead of DISMOUNT in code
This change updates the term DISMOUNT in constants to UNMOUNT.
Other occurrences (e.g. variable names) are left alone for now.
* refactor(ui): use unmount instead of dismount
This change updates the GUI text and replaces dismount with unmount.
* docs: update term dismount -> unmount
* refactor(cmdline): add unmount
This change adds an argument 'unmount' for command line usage, while
trying to deprecate the old disnount argument.
The current dismount argument/flag will still work to not introduce
a breaking change.
* docs: mention that /dismount is deprecated
This change fixes the shorthand version of the argument /unmount
It also adds back the info for /dismount and that it is deprecated.
Added security checks to prevent mounting VeraCrypt volumes on system directories (like /usr/bin) or directories in the user's PATH, which could theoretically allow execution of malicious binaries instead of legitimate system binaries.
Key changes:
- Block mounting on protected system directories (/usr, /bin, /lib, etc.)
This restriction cannot be overridden
- Block mounting on directories present in user's PATH environment variable
This can be overridden with --allow-insecure-mount flag
- Add visual warnings (red border, "[INSECURE MODE]") when mounting on PATH directories is allowed
- Handle symlinks properly when checking paths
- Add new error messages for blocked mount points
To override PATH-based restrictions only (system directories remain protected):
veracrypt --allow-insecure-mount [options] volume mountpoint
Security Impact: Low to Medium
The attack requires either:
- User explicitly choosing a system directory as mount point instead of using VeraCrypt's default mount points
- Or attacker having both filesystem access to modify favorites configuration AND knowledge of the volume password
Default mount points are not affected by this vulnerability.
Security: CVE-2025-23021
This commit fixes a critical security vulnerability where VeraCrypt could be tricked into executing malicious binaries with elevated privileges. The vulnerability has two severe implications:
1. When sudo's secure_path option is disabled, attackers could execute malicious binaries with root privileges by placing them in user-writable PATH directories (e.g., making "sudo mount" execute a malicious mount binary)
2. By placing a malicious sudo binary in PATH, attackers could intercept and steal the user's password when VeraCrypt prompts for sudo authentication
The vulnerability allowed attackers to place malicious binaries in user-writable directories that appear in PATH before system directories, potentially leading to privilege escalation and credential theft.
Key changes:
- Implement FindSystemBinary() to locate executables in secure system paths
- Replace all relative binary paths with absolute paths for system commands
- Add security checks for executable permissions
- Update process execution to use absolute paths for:
* sudo
* mount
* fsck
* terminal emulators
* file managers
* system utilities (hdiutil, mdconfig, vnconfig, lofiadm)
The fix ensures all system binaries are called using their absolute paths from secure system directories, preventing both privilege escalation through PATH manipulation and password theft through sudo hijacking.
Security: CVE-2024-54187
Issue was caused by the fact that Microsoft signing certificate for driver file has changed.
We fix it by updating the SHA512 fingerprint of Microsoft code signing certificate.
In a Debian-style APT repository, the pool/ directory groups packages primarily by source package name and binary package name, version, architecture, etc. If two distinct .deb files have identical name and version (as seen in their control file) and same architecture, reprepro will report a conflict when adding one after the other.
So, we need to append distro-specific string to the existing version in order to avoid such conflict when creating VeraCrypt APT repository.
This commit increases randomness quality by using more dynamic/varied sources of entropy.
PDH-based disk and network statistics collection in now added to random pool
- Introduced `GetDiskStatistics` to gather disk read/write performance data using PDH API.
- Introduced `GetNetworkStatistics` to gather network send/receive performance data using PDH API.
- Integrated high-resolution timestamps and random intervals to improve entropy in collected data.
- Updated `SlowPoll` function to utilize PDH-based disk and network statistics.
- Removed obsolete NetAPI32-based network statistics collection.
- Add IsWin10BuildAtLeast() helper function to check Windows 10 build numbers
- Replace direct build number comparison with IsWin10BuildAtLeast() for ReflectDrivers check
- Update error message to be more specific about Windows version requirement
This update simplifies the logic for detecting active sudo sessions by checking the exit code of the sudo -n -l command, which reliably returns 0 if a session is active.
Additionally, this approach is now applicable to recent macOS versions, as they no longer have the sudo bug that previously prevented us from using this method.
During a Windows upgrade, ownership of veracrypt.sys is set to TrustedInstaller, preventing VeraCrypt from accessing the file during an update.
This commit resolves the issue by temporarily taking ownership of the file to rename it, allowing the new file to be copied. The setup process now obtains additional privileges for this operation, which are properly dropped once the file copying is complete.
- Made the maximum work items count configurable to allow flexibility based on system needs.
- Increased the default value of max work items count to 1024 to better handle high-throughput scenarios.
- Queue write IRPs in system worker thread to avoid potential deadlocks in write scenarios.
Reduce the critical section protected by spinlock to only cover the list manipulation operation. Move the ActiveWorkItems counter decrement outside the spinlock using InterlockedDecrement, and separate event signaling from the locked section.
This change minimizes time spent at raised IRQL (DISPATCH_LEVEL) and reduces potential for lock contention.
There was a deadlock issue in the driver caused by the CompletionThreadProc function in EncryptedIoQueue.c:
https://sourceforge.net/p/veracrypt/discussion/general/thread/f6e7f623d0/?page=20&limit=25#8362
The driver uses a single thread (CompletionThreadProc) to process IRP completions. When IoCompleteRequest is called within this thread, it can result in new IRPs being generated (e.g., for pagefile operations) that are intercepted by the driver and queued back into the CompletionThreadQueue. Since CompletionThreadProc is the only thread processing this queue and is waiting on IoCompleteRequest, these new IRPs are not handled, leading to a system freeze.
To resolve this issue, the following changes have been made:
Deferred IRP Completion Using Pre-allocated Work Items:
- Introduced a pool of pre-allocated work items (COMPLETE_IRP_WORK_ITEM) to handle IRP completions without causing additional resource allocations that could trigger new IRPs.
- The CompletionThreadProc now queues IRP completions to these work items, which are processed in a different context using IoQueueWorkItem, preventing re-entrant IRPs from blocking the completion thread.
Thread-Safe Work Item Pool Management:
- Implemented a thread-safe mechanism using a semaphore (WorkItemSemaphore), spin lock (WorkItemLock), and a free list (FreeWorkItemsList) to manage the pool of work items.
- Threads acquire and release work items safely, and if all work items are busy, threads wait until one becomes available.
Reference Counting and Improved Stop Handling:
- Added an ActiveWorkItems counter to track the number of active work items.
- Modified EncryptedIoQueueStop to wait for all active work items to complete before proceeding with cleanup, ensuring a clean shutdown.
These changes address the deadlock issue by preventing CompletionThreadProc from being blocked by re-entrant IRPs generated during IoCompleteRequest. By deferring IRP completion to a different context using pre-allocated work items and managing resources properly, we avoid the deadlock and ensure that all IRPs are processed correctly.
- Use xdg-open as the primary method for opening directories, ensuring compatibility with most Linux environments.
- Implemented fallback logic to try other known file managers (e.g., nautilus, dolphin, caja, thunar) if xdg-open is unavailable or fails.
Based on proposal by @bugtracker2019
We always using Unicode functions to interact with UI. We convert UTF8 string to UTF16 and vis-versa.
Overwrite input string instead of using resize that caused old test to remain.
Fix case of readOnly by using correct message.
change position of OK/cancel button to match other dialogs.
Activate translation on this dialog.
Veracrypt currently appears in screenshots and screen captures,
which can unintentionally expose sensitive information, such as
the fact that Veracrypt is running or the location of your volumes.
Both Windows and macOS offer mechanisms to exclude specific windows
from being captured. While not foolproof, this is a useful preventative
measure. The method is a no-op for Linux/FreeBSD.
For more details on the wxWidgets API, see:
https://docs.wxwidgets.org/3.2/classwx_top_level_window.html#a337b9cec62b0cbd3b1b1545a83270f64
This started to cause issues after latest changes to disable privileges when they are no more needed.
Because of the bug, the privileges could not be enabled again because they were wrongly removed.
In this case, installation was done by the customer action VC_CustomAction_DoChecks was returning the error ERROR_INSTALL_FAILURE (1603)nevertheless.
Now we return success code correctly.
Cause seems to be IME as documented in KeePass project (https://keepass.info/help/kb/sec_desk.html#ime). We use the same approach as KeePass to disable IME in Secure Desktop.
This commit also add few changes:
- we switch to secure desktop only if SetThreadDesktop succeeds
- we call SwitchDesktop to switch to original desktop only if we actually succeeded in displaying secure desktop
Translation was done using gpt-4o (multi-shot) and validated with Claude Sonnet 3.5 and Google Gemini 1.5 Pro Experimental 0801
Co-authored-by: Mounir IDRASSI <mounir.idrassi@idrix.fr>
If vulnerability detected, a warning message is displayed during mount or backup/restore header, and changing the password is disallowed since it will not change the master key.
The class AdminPasswordRequestHandler was defined in several places in the same namespace and the linker was picking up one definition for constructor and the other one when calling virtual method.
Now we use different named for different implementations.
* Linux/MacOSX: during build, fallback to /tmp if wxWidgets sources not found in parent directory
* Linux: Add Github workflow to build .deb files and test generated binaries
* Linux: fix wrong wxWidgets extract path in yaml
* fix: fix wrong wxWidgets extract path in yaml
* Linux: harmonize content of test volumes and update Github workflow for this
* Fix corrupted test container
* Linux: optimize Github workflow by caching wxBuildConsole and wxBuildGUI folders
We also modify build script to detect the presence of wxBuildConsole and wxBuildGUI folders and reuse them
* Remove files mistakenly added
* Linux: Fix wrong test for Github workflow
* Linux: use static build of wxWidgets for GUI in Github workflow
* Linux: upload also .deb SHA256SUM file if it is generated in Github workflow
* Linux: fix detection logic of parent folder in build scripts
* Github workflow: add build_cmake_deb.sh as trigger to build-linux.yml
* Github workflow: add wxWidgets source code to the cache of workflow
Full Xcode application which can take up-to 40GB of disk space is not
necessary for building VeraCrypt, rather the CommandLineTools for XCode
are sufficient which only take few gigabytes. Instead of hardcoding the SDK
location, use xcrun --show-sdk-path to support also the CommandLineTools
instance.
The reason for switching the logic for the XCode version is because the
xcodebuild will not report a correct XCode version for the CommandLineTools,
thus it can't be relied for whether to use the -Wl,-ld_classic flags.
Instead, we can just check the ld version in use in the active developer
directory, and see whether we are using dyld (the new) or ld64 (the old).
Update friend declaration in FuseService.h and refactor GetCharWidth to ComputeCharWidth in WaitDialog.h to avoif hiding GetCharWidth inherited from wxWindow
The build script build_veracrypt_macosx.h now accepts the argument -f to enable fuse-t support.
It is also possible to set the environment variable VC_OSX_FUSET to 1 for FUSE-T support.
A change was done in CoreUnix::GetMountedVolumes to add a waiting loop for control file to be accessible because when using FUSE-T there always a delay before control file can be serialized.
Replaced an incorrect 'end' statement with 'endif' in the
MacOSX-specific section of the Main.make file. This resolves the make
error caused by an unclosed conditional block.
* Improve markdown documentation in README.md
This commit fixes some of the minor spelling mistakes and uses
markdown formatting to link to local files, for documentation.
* Remove reference to outdated packages installation
This is a legacy installation file that is no longer maintained.
* Add missing macOS requirement for 'make package'
We need packages for the last build step on macOS, update docs
to reflect the requirement.
* Add build instructions using homebrew
On macOS, we can use a package manager to easily install
dependencies. This simplifies onboarding and building Veracrypt.
* Add flag to use homebrew packages
When building, we can use prebuilt wxwidgets from homebrew to
simplify and speed up local building. We also put the package
behind a flag as it's optional during development.
* Skip signing for local builds
When building with homebrew, skip signing. This can be put behind
a flag to enable, if needed.
* Use system yasm on macOS if available
The binary in the repo is not universal (x86_64) and therefore
building fails on arm architecture if Rosetta is not installed.
Use local yasm if available.
* Build local arch only in development
When building via homebrew and locally, build only the local arch
which skips ASM for arm(Mx) for MacOS. This removes the need to
have rosetta installed for building.
* Fix compilation issue when COMPILE_ASM is undefined
Use a conditional check for COMPILE_ASM not being false instead of true.
This avoids passing the variable to other parts of the build script.
* Set SDK 12 as the minimum requirement and target
Align the requirement to SDK 12 in both the makefile and script,
and update the comment to remove confusion.
I chose to leave this on 12 to be on the side of err and support
as many building platforms as possible, when we can support.
The local script now also sets the target using the local sdk
version. This should improve the local development experience.
* Fix wrong architecture for macOS in x86 builds
We now build only the current arch for local development builds
in macOS. This change also fixes the x86 builds failing.
* Add instructions brew backed macOS local builds
Flags to build a local build using homebrew packages are not
default and require parameter -b to build. We also don't build
packages directly, which requires -p.
* Fix wxwidgets not linking in local x86 macOS development builds
* Clarify build location in the document
wxDir::GetAllFiles will throw an assert when opening the preferences dialog
if for some reason the user has not installed VeraCrypt properly and is
missing the intended folder. This patch adds a check to ensure the folder
first exists before querying its files.
The behaviour of `wc -l` is different on FreeBSD, in which the stdout
result is padded by spaces in the beginning, which causes that the
result[0] is not actually the value we care about. This patch adds
a translate removing all whitespace from the output.
* Move from deprecated wxScopedPtr to std::unique_ptr
wxScopedPtr was included previously through some header hierarchy which as of 3.3 is
no longer the case causing it to break. But instead of including a header for a deprecated
function explicitly, just move to std::unique_ptr as recommended by upstream.
* Convert to explicit conversions from wxString
As of https://github.com/wxWidgets/wxWidgets/pull/23449/commits/35c35c235e9c29b40002131602e050dca8d65b8c
wxWidgets defaults to STL classes, which has a side-effect that
some implicit conversions break. This patch converts those conversions
to explicit in anticipation of wxWidgets 3.3 release.
Currently the maximum hidden volume size for file containers is
limited by available free space on the device the file container
resides on, which we do not care about. This commit changes so
that only Normal volumes get their `maxVolumeSize` limited by
`AvailableDiskSpace`. Also the --size=max parameter is restricted
from hidden volume creation as there is no way to determine a good
size as we do not mount the outer volume through the CLI process
flow to determine available free space on the outer volume.
We don't need to reset PIM in PasswordException as it is immediately
fell back to if PIM is specified in text mode, but password is not.
This causes an exception that resets the PIM when it shouldn't.
Currently we check whether the system has DISPLAY environment variable
set, which is the case in a system that uses X11 natively or XWayland.
This variable is not set in a system with only Wayland, so we need to
also check whether WAYLAND_DISPLAY is set.
Fixes: #184
* macOS: Fix issue where PIM box has no width in Wizard
VolumePimTextCtrl has a problem with width on macOS which
we can fix by adjusting the proportions of the elements
inside the PimSizer, which seems like a better solution than
using a forced minimum size in pixels.
Adjacent, simplifies the validator logic for digits in PIM field.
Fixes#1219
Fully reviewed and heavily updated.
Copy paste Google Translations replaced by real person translations.
Translation consistency improved all around.
Transifex (Localization Lab Project) has older VeraCrypt resource file and needs updated latest version to use advanced translation platform features.
* Implement Language selection into settings
Initial commit to create a new tab in PreferencesNotebook for
Language selection. By default, if nothing is chosen, it uses the
current behaviour of using the language from system environment
variables. If another language is chosen from the settings, it is
saved into the Configuration.xml and this is used instead.
* Fix SetStringSelection() assert issue on macOS
* Add header include to fix build
* Add current language pack, authors and way to use literal strings
* Translations also for FreeBSD
* Minimal GTK3 WX build on FreeBSD requires wxGraphicsContext
* Get Preferences properly instead of workaround function
* Use WrapSizer instead of BoxSizer for author line
This forces long author lists to be put on a new line, reducing
the need to increase window width.
* Update Finnish translation
* Borrow translation from IDM_LANGUAGE where it makes sense
* Remove colon and thus unneeded function
* Simplify Language tab layout
* Reintroduce macOS specific fixes to Forms.cpp
* cleanup
The x11 aliases such as --title are only available in the Qt application
if the XDG_SESSION_TYPE is x11. Instead of using an alias, we can use
--qwindowtitle directly.
* EMVCard.cpp: ArrayToHexWideString: prohibit conversion of a string constant
../Common/EMVCard.cpp: In function 'std::wstring VeraCrypt::ArrayToHexWideString(con
st unsigned char*, size_t)':
../Common/EMVCard.cpp:28:43: warning: ISO C++ forbids converting a string constant
to 'wchar_t*' [-Wwrite-strings]
28 | static wchar_t* hexChar = L"0123456789ABCDEF";
| ^~~~~~~~~~~~~~~~~~~
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
* EMVCard.cpp: ArrayToHexWideString: fix of the comparison of different types
../Common/EMVCard.cpp: In function 'std::wstring VeraCrypt::ArrayToHexWideString(con
st unsigned char*, size_t)':
../Common/EMVCard.cpp:32:43: warning: comparison of integer expressions of different
signedness: 'int' and 'size_t' {aka 'long unsigned int'} [-Wsign-compare]
32 | for (int i = 0; i < cbData; i++)
| ~~^~~~~~~~
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
* SecurityTokenKeyfilesDialog.cpp: removed initialization of an unused variable
Forms/SecurityTokenKeyfilesDialog.cpp:58:24: warning: unused variable 'i' [-Wunused-
variable]
58 | size_t i = 0;
| ^
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
* Core/Unix: throwing an exception instead of ignoring the error
Fixes: 5a6b445f ("fix warnings and UB (#1164)")
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
---------
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Co-authored-by: Vasiliy Kovalev <kovalev@altlinux.org>
We use only alphanumeric characters for the name in addition to the '_' character
We ensure the random desktop name doesn't already exist
We create the random desktop on the Secure Desktop thread and we look over SwitchDesktop until it works.
We call SetThreadDesktop (hOriginalDesk) in main thread once we finish
- use a more standard-looking memory value tag instead of fully random one that will look suspicious and outstanding
- If we fail to allocate 1MiB for derivation area, we device the size by two in a loop until we succeed. This is better than falling back directly to 8KiB size
- Better method to derive actual encryption key: instead of simply duplicating 128bit key value, we combine a xor addition and self-encryption to build a 256-bit key
- use both encID and pbKeyDerivationArea to derive IV for encryption and not only endID
Memory protection can be disabled using registry value "VeraCryptEnableMemoryProtection" under the key "HKLM\SYSTEM\CurrentControlSet\Services\veracrypt"
This helps to preserve unknown entries that may be used by future
versions of VeraCrypt (forward compatibility) or entries used by old
versions that were removed from current version (backward compatibility)
Rules of automatic flushing of stdout buffer is implementation-defined
behaviour. In glibc this is automatically flushed, but we can't rely
on it for other implementations such as musl.
We also rename the variables gpbSha256CodeSignCertFingerprint and gpbSha256MSCodeSignCertFingerprint to gpbSha512CodeSignCertFingerprint and gpbSha512MSCodeSignCertFingerprint respectively to reflect the fact that they are actually SHA512 hash values and not SHA256 ones.
When using multiple monitors, the resolution can change in OSX,
during plug-in/off off the display(s). To avoid window becoming
non-usable, there is EnsureVisible, that is called in several
places.
However, if you minimize VeraCrypt on the bigger screen, and
restore it in the main screen of a MacBook, after unplugging, the
window will become unusable (unless you know that clicking 'About'
calls EnsureVisible :-)).
Call EnsureVisible OnActivate so MainFrame is always functional
across screens, even when minimized.
If an error happens, error message will be read from popen pipe and so
libpcsclite.so will not be found. This is the same outcome as when
stdout is empty.
When this option is enabled, we first build the list of currently inserted devices then we start listening to insertion events.
When a device insertion occurs, we check if this device is on our list and if yes, we ignore its insertion.
We also ignore devices whose Device ID starts with "SWD\" and "ROOT\" since these are not real devices.
Currently there are a lot of translated strings that are never seen
anywhere as the installer doesn't offer all the available languages
as options in the installer wizard (sans Burmese).
* Update Chinese (Hong Kong) translation
- replace Mainland China wordings with Hong Kong wordings
- correcting size unit to use KiB, MiB, GiB, TiB
- using Windows default Chinese Traditional fonts
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
- translated some untranslated lines
- minor wording refinements
* Update Language.zh-hk.xml
daily commit for translation progress
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* translated some more untranslated strings
* Update Language.zh-hk.xml
* Language Translations files: update Chinese (Hong Kong) translation
# minor wording changes
# corrected lang attribute to en on some untranslated entries
+ translated some untranslated entries
+ translated some new entries
* Language Translations files: update Chinese (Hong Kong) translation
- translated some new entries
* Language Translations files: update Chinese (Hong Kong) translation
- minor changes
* Language Translations files: update Chinese (Hong Kong) translation
- translated some new entries
* Language Translations files: update Chinese (Hong Kong) translation
- translated some new entries for Linux
* Language Translations files: update Chinese (Hong Kong) translation
- translated some new entries
* Update Language.zh-hk.xml
- add back and translated missing line 298
- minor wording changes
- major progress
* Update Language.zh-hk.xml
- refine wordings
- correct mismatch translations in lines 635-640
- minor progress
* Update Language.zh-hk.xml
- refine wordings
- correct line 470
- minor progress
* Update Language.zh-hk.xml
- correct line 164 and 273
* Update Language.zh-hk.xml
Several enhancements implemented:
- replace CreateThread by _beginthreadex to avoid potential issues when using C runtime
- use an event to notify monitoring thread to stop instead of a volatile boolean
- perform switch to the regular desktop in the main thread and not in the secure desktop thread
When replacing a file container, we increase the `diskSpace`
by the file container's size. This doesn't affect the hidden volume
space logic, as in that case we use `MaxVolumeSize` when
`MaxVolumeSizeValid` is true instead of `AvailableDiskSpace`.
The usage of /Y parameter in format.com simplifies the logic and makes the code robust since we don't need to send \n to the format.com process.
Specifying RemovableMedia parameter to FormatEx fixes its failure in Windows 10 and later to perform quick format. This is also more adequate since we are mounting the volume as removable media for the formatting process.
We also add better error management in order to display adequate error message to the user in case of failure
If the currently selected item in the drive list is a mounted volume that can be dismounted, the Mount button displays "Dismount" and so we should not add the popup menu of "mount without cache" to it.
To fix drag-n-drop of keyfiles, we remove the password drop target since it was blocking the standard drop of files and drop target doesn't work because of UIPI restrictions across privilege levels since Expander is started elevated
* Add basic strcture needed for EMV implementation
* Add demo EMV functionality with C code pasted in a very dirty and unsafe way. NOT FINAL
* Refactor IccExtractor Structure
* Fix Makefile
* fix include file
* move global variables from h to c
* revert to memcpy
* fix icc data recovery functions
* Add EMV functionalities on windows
* Make EMVToken structures like SecurityToken
* Define constants instead of hard coded values
* Token structures created with inheritance
* refactor TokenKeyfile to use inherit. + polymor.
* add Token.h + Token.cpp in modules in VS2010
* Add a comment at each use of SecurityToken class or objects
* SecurityTokenKeyfilesDialog preparation
* Implemennt GetAvailableTokens in Token class on windows
* merge
* up (patching for Windows)
* foreach Token.cpp corrected
* Display EMV keyfiles on first window in graphic interface
* Add token to Windows UI
* EMVToken selection on OKButton on Linux
* Keyfile.cpp optimization
* Move getKeyfileData in the token class
* EMV::Token GetAvailableKeyfiles() base
* Move getKeyfileData in the token class on unix
* Remove test comments
* Warnings resolved
* RemoveeSecurityTokenLibraryNotInitialized exception if at least one emv token is detected
* Adding new files
* Remove old files and add the new version to the windows project
* Change make_shared to shared_ptr constructor
* IccExtractor integration working on linux
* Throwing card not EMV execption
* catch error when not EMV type in EMVToken::GetAvailableKeyfiles
* Change types to compile on windows
* list all keyfiles, security keyfiles and emv keyfiles in command line
* Change type to be coherent and remove old todo comments
* Remove todo comments
* Change indentation and resolve a bug from previous commit
* Use polymorphism for GetKeyfileData and add export option for EMVTokens on Linux
* Linux : Allow to export EMV Tokens in command lines, Windows : Disable the delete button when EMV Keyfiles are selected
* Remove SlotId from TokenInfo as it is already in Token
* Correct errors on Linux
* Disable delete option if one EMV Token is selected on Linux
* Fix bug enabling delete button if nothing is selected
* emv data used as reference then burnt
* use of normal files in linux corrected
* help updated
* help updated for export functionnality
* option EMV added to graphic interface but not yet working
* Bug fix : Allow to use multiple EMV on windows
* EMV Option added to UserPreferences
* EMV Option working for Linux
* EMV option added to Windows (not working yet)
* [NOT TESTED] EMV option for Windows
* Working EMV option on Windows
* EMV Option for data extraction working for volume creation
* EMV Option for data extraction working for Mount
* EMV Option for data extraction working for mounting favorites volumes
* EMV Option for extraction working for Changing volume password, Set Derivation Key Algorithm and Add or remove keyfile from volume
* Windows : re-checking EMV Option when getting data
* Removing error catches in the IccDataExtractor classe (It only throws error now). Changing GetPan signature to resemble the other functions signatures more
* Changing EMV errors
- Only throwing ICCExtractionException from outside of the ICC module.
- Catching all TLVExceptions and PCSCExceptions to throw the right ICCExtractionException
- Deleting APDU exceptions.
* First version of the documentation
* Adding function pointers for winscard library (but it crashes VeraCrypt)
* Debugging function pointers
* The import of the library on windows work as expected now
* Reverting EMVToken.cpp changes used to test to library import
* Searching for the System32 path instead of hard codding it
* Fixing the bug were VeraCrypt crashes if there is no readers when "add Token files" is clicked
* Winscard library not initialized in object constructor anymore to delay it after EMVOption check
* Remove winscard lib from windows dependencies
* Properly displaying errors
* Adding a dot in Language.xml
* Catching TLVException
* Removing unused code
* Remove unusefull comments
* Trying to fix 0x1f error
* Update IccDataExtractor.cpp
* Delete History.xml
* Fix get data without get pan
* Cleanup code
* changes for linux compilation but linking not working
* error handling for linux
* erasing emv data
* Burn PAN
* Burn PAN from memory
* Uncomment selfcheck before merging master
* burn corrected
* EMV errors handling for Linux
* EMV working for Linux CLI
* Doc : Winscard Linux package and VeraCrypt versions
---------
Co-authored-by: doriandu45 <d45.poubelle@gmail.com>
Co-authored-by: red4game <redemgaiming@gmail.com>
Co-authored-by: Brice.Namy <brice.namy@insa-rennes.fr>
Co-authored-by: vocthor <pieceo108@gmail.com>
Co-authored-by: vocthor <67202139+vocthor@users.noreply.github.com>
Co-authored-by: Andrei COCAN <andrei.cocan@insa-rennes.fr>
Co-authored-by: AndreiCocan <95496161+AndreiCocan@users.noreply.github.com>
Co-authored-by: francoisLEROUX <francois3443@gmail.com>
We write a zeroed sector every 128 MiB, leaving other sectors untouched
This helps users visualize the progress of actual file creation while forcing Windows to allocate the disk space of each 128 MiB chunk immediately, otherwise, Windows would delay the allocation until we write the backup header at the end of the volume which would make the user think that the format process has stalled after progress bar reaches 100%.
This change also makes it possible to generate keyfiles larger than 1 MiB although only the first 1 MiB will be taken into account by VeraCrypt.
Update strings in XML files
In old Linux distributions, tar command doesn't support
"--keep-directory-symlink" so we now dynamically detect if this switch
is support and then we use it if it is available
Changes to be able to build latest wxWidgets stable 3.2.2.1.
Removed in 3.1.5, needs to be removed.
--disable-webkit
Added in 3.1.0, needs to be added.
--disable-addremovectrl
Currently if you fail the privilege escalation prompt, the second
one and consecutively every second will be ignored. This is because
if we do not --use-dummy-sudo-password and are on Linux/FreeBSD,
we will be prompted for password twice for one evaluation in the
while(!ElevatedServiceAvailable) loop.
For the fix, we make sure that we run the prompt only once for each
case.
We replace absolute file pointer moving by relative moving with respect to current position. This was implemented as a workaround to address the performance issues related to in-place encryption. When using SetFilePointerEx() with FILE_BEGIN as the reference point, reaching the end of large drives during in-place encryption can cause significant slowdowns. By moving the file pointer relatively, these performance issues are mitigated.
Currently on a system without xterm or konsole (like fresh
Ubuntu install) the fsck check will not launch. Added
gnome-terminal as an alternative and fixed an issue where
konsole will always error out as --title and --caption are
no longer valid arguments.
Previously the error message was simply "xterm not found", so
new LangString LINUX_EX2MSG_TERMINALNOTFOUND was added to let the
user knows which programs they need to get the feature working.
Removes the options exFAT and Btrfs being shown when creating a
volume in text mode when the system does not support them and will
end up erroring out at the end. Hide Btrfs option when the volume
is too small, as we will anyways fail right after.
Hardcoded numbering changed to dynamic as the available options
are not necessarily consecutive.
The lack of explicit hash initialization was causing issue with Blake2s
because it doesn't allow further processing once a digest value was
returned.
Other hash algorithms don't have this restriction.
Not we explicitely initialize all hash algorithms which is the correct
way to do things.
* Libzip 1.9.2
Updated Libzip to latest version 1.9.2 and changed version number in the config.h from 1.7.3 to 1.9.2. Not sure if anything else needs to be tweaked :)
* Modified Libzip to work with Visual studio
* Update README.md
Update libzip copyright.
* Added the missing files.
I've added the missing files zipconf.h and config.h, I've missed those sorry for that!
No parent directory specified in the path, we assume current directory
We first check if parent directory exists before checking its free space
using wxgetDiskSpace
Based on idea proposed by @bogdro in PR#1025
* Update Language.zh-cn.xml
For commit c0ff7a7c52 and pull #957
* Optimize the use of quotation marks
use Chinese standardized quotation marks (“”) instead of unusual white lenticular bracket (〖〗)
* Unified the translation of RESCUE_DISK
* Optimize the use of quotation marks
use Chinese standardized quotation marks (“”) to replace other unusual usage of non-standardized quotation marks
* improve "SYSENC_INFO_2" translation
thanks to @ZhanYF in https://github.com/veracrypt/VeraCrypt/pull/961#pullrequestreview-1190980437
* improve "IDC_LINK_HASH_INFO" translation
thanks to @ZhanYF in veracrypt#961 (review)
* Update Language.zh-cn.xml
-unified the translation of "hash"
-improve "DECOY_OS_INSTRUCTIONS_PORTION_10" translation
* Removal of any of the any of `wxALIGN_RIGHT`/`wxALIGN_CENTRE_HORIZONTAL`/`wxALIGN_BOTTOM`/`wxALIGN_CENTRE_VERTICAL` when used in conjunction with `wxEXPAND`
wxWidget has an "assert" that gets triggered anytime `wxEXPAND` gets used with an alignment property (useless override). This leads to a popup backtrace everytime a non-compliant widget is opened.
* Removal of missed `wxALIGN_RIGHT`/`wxALIGN_CENTRE_HORIZONTAL`/`wxALIGN_BOTTOM`/`wxALIGN_CENTRE_VERTICAL` when used in conjunction with `wxEXPAND`
* Removed property 'label' for wxMenuBar as no longer used (wxFormBuilder)
* Removed redundant 'wxALIGN_RIGHT' for the "OK" button in the preference panel (there is a spacer already in-place that pushes the buttons to the right)
* Removed redundant 'wxALIGN_RIGHT' for items in the wizard panel's (`WizardFrameBase`) button bar and added width spacing for the 2 spacers between the buttons to make up for the change.
* Changed constructor signature for the `WizardPage` and all subclasses
The addition of the wxString 'name' arg brings it inline with the new wxFromBuilder v3.10.1 output so that editing+generating the forms from it won't brake the build now.
* Removed remaining redundant 'wxALIGN_*' that were paired with 'wxEXPAND'.
* Added missing default flags to wxFileName::Normalize(..) method
The old empty initialization which was fine up to v2.8.12 of wxWidget gives off a compile warning. Since the default `wxPATH_NORM_ALL` is now depreciated (v3.x) the equivalent individual flags must be explicitly given.
* Changed spaces to tabs to bring last commit inline with the rest of the src code
Fixing the following compiler warnings:
FuseService.cpp: In function ‘int VeraCrypt::fuse_service_read(const char*, char*, size_t, off_t, fuse_file_info*)’:
FuseService.cpp:233:12: warning: catching polymorphic type ‘struct VeraCrypt::MissingVolumeData’ by value [-Wcatch-value=]
233 | catch (MissingVolumeData)
| ^~~~~~~~~~~~~~~~~
FuseService.cpp: In static member function ‘static int VeraCrypt::FuseService::ExceptionToErrorCode()’:
FuseService.cpp:362:15: warning: catching polymorphic type ‘class std::bad_alloc’ by value [-Wcatch-value=]
362 | catch (std::bad_alloc)
| ^~~~~~~~~
Apart from warnings, the current code creates unnecessary copies of the exception object in debug mode. (But not in -O3)
* New VeraCrypt interface (for system encryption) with improved usability
* System Encryption: translate password to US keyboard layout + improved new interface
* Windows: Fix build error following merge
* Windows: Remove unused variable
* Windows: Add missing string in Language.xml
* Windows: fix buffer overrun caused by wrong use of wmemset
* Do not delete password file
Since the file is only available in \Release\Setup Files\ it would be fully deleted after running this script the first time.
* Correct return code
Originally the function would have always returned the return-code 1 resulting that the user is not able to change the location for the rescue zip.
* Added hint for sysenc
Added a hint why the field for repeating the password is initially greyed out within the system encryption.
* Corrected spelling mistake
Corrected spelling mistake
* Removed not working copy job
The file to be copied was stored at the source location. Therefore the copyjob will not work. Instead the file is already in the target folder.
* Removed RIPEMD-160 from Product64.wxs
See commit from 21.03.2022
* Added german translation for new interface
* Fixed PIM bug
* Corrected translation file based on the guidelines within the pull request
* Fixing merge conflicts
* Fixed Compiling issues. Reverted keyboard translation
* Removed artifacts of password translation
* Corrected language.xml
* Fixed order within german language file
* Corrected positions
Co-authored-by: Bruna2803 <bruna.radeljak@hotmail.com>
Co-authored-by: felixreichmann <30237956+felixreichmann@users.noreply.github.com>
Co-authored-by: Mounir IDRASSI <mounir.idrassi@idrix.fr>
Github PR: https://github.com/veracrypt/VeraCrypt/pull/953
* Create CompilingGuidelinerh
* Initial Upload Windows Compiling Guide
* Removed RIPEMD-160 from Product64.wxs. See commit from 21.03.2022
* Completed Win compiling guideline
* Added link to detailed compiling guide
* Added link to detailed compiling guide
* Restructured docu main page
* Added sourceforge link
* Added compiling guide for Linux
* References to detailed instructions
* Revert "Removed RIPEMD-160 from Product64.wxs. See commit from 21.03.2022"
This reverts commit 024ae2a465.
* Correction of a div box
The variable has enough capacity so pointer &buffer[0] is valid but since clear method was called, we are not supposed to access element at index 0.
Related to Github issue #896
Under "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\veracrypt", create a REG_DWORD value named "VeraCryptEraseKeysShutdown" and set its value to 0.
* *: source files should not be executable
* *: make sure files have final newline
* *: remove BOM from text files
* translations: unify headers
* *: fix typos
* *: trim excess whitespace
We query the kern.geom.conftxt sysctl for the GEOM configuration to find
the partition offset. Technically speaking it would probably be better
to link against libgeom but this is less overall intrusive. Also
includes a small fix to find the parent device of an encrypted partition
when it is a GPT partition rather than a BSD slice.
* Adding more Turkish translations
This change is translating some still English lines to Turkish
* Fixing typo
Co-authored-by: Özgür Pekçağlıyan <zgrw@users.noreply.github.com>
Hooking is not allowed if thread is running in secure desktop so we ignore SetWindowsHookEx failure in this case and random generator will be initialized using the other entropy sources from the system.
this commit will add a sponsor button to the repository,
pointing to the donation page of the veracrypt website.
more information on github documentation under https://git.io/JL9e6
* new xml Tag for en and de
* add linux support for env LANG
* precopiled header into TrueCrypt.fdp to substitute '_()' with 'LangString[]'
* more LangString in Code
* add Language xml's to Linux Setup location
* backup language for linux is en
* remove Language.en.xml install
* rearange new xml lines to end
* yes/no dialogs now translated
* All OK/Cancel Button now support international
Co-authored-by: tb@tbon.de <tb@tbon.de>
* Update Chinese (Hong Kong) translation
- replace Mainland China wordings with Hong Kong wordings
- correcting size unit to use KiB, MiB, GiB, TiB
- using Windows default Chinese Traditional fonts
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
- translated some untranslated lines
- minor wording refinements
* Update Language.zh-hk.xml
daily commit for translation progress
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* translated some more untranslated strings
* Update Language.zh-hk.xml
* Update Chinese (Hong Kong) translation
- replace Mainland China wordings with Hong Kong wordings
- correcting size unit to use KiB, MiB, GiB, TiB
- using Windows default Chinese Traditional fonts
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
- translated some untranslated lines
- minor wording refinements
Completely reworked Dutch translations (in accordance to the Microsoft style guide, as much as possible). Translated using the dedicated Transifex project by Localization Lab. (https://www.transifex.com/otf/veracrypt/dashboard/)
If needed, a Winmerge report (for visual comparison) can be generated.
Regards, Thomas De Rocker (RockyTDR)
* Adding Processor Groups support for more than 64 processors
* Revert " Adding Processor Groups support for more than 64 processors"
This reverts commit e1d5fe0a55.
* Adding Processor Groups support for >64 logical processors
* Revert "Linux: Fix failure to run VeraCrypt binary built for console mode on headless machines (fix issue https://github.com/veracrypt/VeraCrypt/issues/531)"
The build failure still exists for system wxGTK compiled with '--disable-gui':
```
In file included from TextUserInterface.cpp:27:
TextUserInterface.h: In member function ‘virtual bool VeraCrypt::TextUserInterface::Initialize(int&, wxChar**)’:
TextUserInterface.h:50:63: error: ‘wxAppBase’ has not been declared
50 | virtual bool Initialize (int &argc, wxChar **argv) { return wxAppBase::Initialize(argc, argv); }
```
This reverts commit 737e1f126b.
* Revert "Linux: fix compilation error when building console-only version of VeraCrypt that is statically linked to wxWidgets"
The build failure still exists for system wxGTK compiled with '--disable-gui':
```
In file included from TextUserInterface.cpp:27:
TextUserInterface.h: In member function ‘virtual bool VeraCrypt::TextUserInterface::Initialize(int&, wxChar**)’:
TextUserInterface.h:50:63: error: ‘wxAppBase’ has not been declared
50 | virtual bool Initialize (int &argc, wxChar **argv) { return wxAppBase::Initialize(argc, argv); }
```
This reverts commit 14bee5e6a2.
* src/Main/Main.make: simplify the WX_CONFIG_LIBS logic
Irrespective of whether we are linking against widgets statically or
dynamically, pull in only 'base' when GUI is disabled, and
'adv,core,base' when GUI is enabled. When GUI is disabled, the C/CXX
flag must include '-DwxUSE_GUI=0' for this to work.
* src/Makefile: pass '-DwxUSE_GUI=0' when NOGUI=1
veracrypt with NOGUI=1 fails to properly link against wxGTK compiled
with '--disable-gui' only using the 'base' library because the wx's
setup.h implicitly defines wxUSE_GUI=1, which then changes the
definition of various structures, requiring symbols from the core
library as well.
For example, wxwidgets include/wx/app.h defines:
#if wxUSE_GUI
class WXDLLIMPEXP_CORE wxAppBase : public wxAppConsole
...
[snip]
...
#else // !GUI
// wxApp is defined in core and we cannot define another one in wxBase,
// so use the preprocessor to allow using wxApp in console programs too
#define wxApp wxAppConsole
#endif // GUI/!GUI
To fix this, pass '-DwxUSE_GUI=0' when compiling veracrypt with
NOGUI=1.
Closes: https://github.com/veracrypt/VeraCrypt/issues/531
When my system broke and I had to use WindowsPE to rescue some files the password dialog always closed immediately. There was no chance to mount the system device using the GUI. It took me a while to realize that I could try using the CLI by passing the password as a parameter (which might not be so obvious for not advanced users).
Signed-off-by: Sven Strickroth <email@cs-ware.de>
* Start following IEEE 1541 agreed naming of bytes
This standard exists to prevent any confusion about the actual number of bytes. It has been agreed on by experts and is being used more widespead these day. Let's start properly naming the number of bytes, which is absolutely important in disk encryption software.
* Update LanguageStrings.cpp
* Update UserInterface.cpp
* kibibyte instead of kilobyte
* kibibyte instead of kilobyte
* MiB instead of MB
* undo accidental deletions
Odd indeed that two random lines were deleted in a previous commit. Probably happened when using a keyboard shortcut while editing the file. This fixes the issue.
* Mb to Mib
To get the size of each device / partition on the system, the method 'GetDeviceSize()' in 'src/Core/Unix/CoreUnix.cpp' first opens
the device / partition using 'open()' function to get a File Descriptor, then retrieves its size using this File Descriptor.
Starting OS X 10.11 ("El Capitan"), a feature called "System Integrity Protection (SIP)" or less formally, "rootless mode" has been added.
This feature blocks access to certain critical aspects of the OS and Hardware by 3rd-Party programs.
Specifically, low-level access to the system disks, devices and partitions is forbidden ; namely functions like 'open()' for instance fail
with the error code : "EPERM = Operation Not Permitted".
Therefore, for system devices / partitions, 'GetDeviceSize()' fails because of the failure of the 'open()' function, and throws an exception,
which is then caught inside the method 'GetHostDevices()' in '/src/Core/Unix/FreeBSD/CoreFreeBSD.cpp' : this leads to the size of the
device / partition being set to '0'.
Therefore, in the constructor of 'DeviceSelectionDialog' in 'src/Main/Forms/DeviceSelectionDialog.cpp', when the size of a device is '0',
the whole device is skipped, leading to all of its partitions not being treated or shown, even though some of these partitions may have a size which is != 0.
This commit fixes the issue by :
1 - First, checking whether the device size is '0'. If it is the case, the code loops through all the devices partitions : if there is at least one partition
with a size != 0, the device is not skipped. Otherwise, it is.
2 - Then, if the size of the device is '0', the size of the device is not shown to avoid confusing the user.
Also, since the device is not usable, the 'OK' button is not active when the device is selected.
3 - Finally, if a partition's size is '0', it is not shown since it is not usable : we cannot open it.
Signed-off-by: El Mostafa IDRASSI <el-mostafa.idrassi@prestalab.net>
Now, under Debian 10+ and Ubuntu 18.04+, we link against the GTK-3 version of wxWidgets (libwxgtk3.0-gtk3-0v5).
Under Debian 9- and Ubuntu 16.04, we link against the GTK-2 version of wxWidgets (libwxgtk3.0-0v5) which is the
only one available.
Also, we now have 2 separate RPM scripts : 'build_cmake_rpm_gtk2.sh' which builds wxWidgets and links it against GTK-2,
then links VeraCrypt against 'gtk2' package (typically to be used under CentOS 6) and 'build_cmake_rpm_gtk3' which builds
wxWidgets and links it against GTK-3, then links VeraCrypt against 'gtk3' package (typically to be used under CentOS 7+).
The DEB script builds VeraCrypt and links it against wxWidgets that comes with the distribution.
The RPM script awaits for wxWidgets-3.0.4 source code which it builds then links VeraCrypt statically to it.
Both scripts create the corresponding package after the build.
Compiling with -mxxx defines the corresponding macro of the intrinsics.
For example, -mssse3 defines __SSSE3__ macro to 1.
In GCC versions < 4.9, it is not possible to use and call x86 intrinsics only at runtime without
compiling the entire file with the -mxxx option.
For example, if we want to call SSSE3 intrinsics without compiling with -mssse3, the macro __SSSE3__ is not defined.
Therefore, when including <tmmintrin.h>, this results in "error "SSSE3 instruction set not enabled"" because of :
#ifndef __SSSE3__
# error "SSSE3 instruction set not enabled"
Since GCC 4.9, this has been fixed and it is possible to call x86 intrinsics from select functions in a file
that are tagged with the corresponding target attribute without having to compile the entire file with the -mxxx option.
This can be seen in <tmmintrin.h> which in recent versions (>= 4.9) contains :
#ifndef __SSSE3__
#pragma GCC push_options
#pragma GCC target("ssse3")
#define __DISABLE_SSSE3__
Since SSSE3 is only used under Windows for ChaCha256, this can be fixed by preceding '#include <tmmintrin.h>' with
#if defined (_MSC_VER) && !defined (TC_WINDOWS_BOOT).
See https://gcc.gnu.org/gcc-4.9/changes.html
in order for 'export TC_VERSION := $(shell grep VERSION_STRING ../Common/Tcdefs.h | head -n 1 | cut -d'"' -f 2)'
in 'src/Main/Main.make' to actually return the version rather than '-CustomEFI'.
* Update Language.ko.xml
* Update Language.ko.xml
* 509 line
* Update Language.ko.xml
* Update Language.ko.xml
200 line done
1281 line remaining
* Update Language.ko.xml
* 28% Done
* 446 line
* 530 line
* Update Language.ko.xml
* Update Language.ko.xml
* 600 line
* 651 line
* 1042 line
* Update Language.ko.xml
* Edit translator information & korean font name
* Revert previous commit
* Fix "Invalid characters..." issue by not using "foreach" macro
The "foreach" macro creates a copy of the container.
This copy is destroyed immediately after the iteration is completed.
C-strings pointers passed to the local array were invalidated
with destroying of "std::string"s contained in the copy.
Creating such a start menu entry is a leftover of the ancient Win 3.x time where there was no central control panel for removing programs.
Also see the Windows guidelines, where creating an uninstall shortcut is discouraged: https://msdn.microsoft.com/en-us/library/ms954377.aspx
Signed-off-by: Sven Strickroth <email@cs-ware.de>
Starting with glibc 2.26, macros "major" and "minor" are only
available from <sys/sysmacros.h> [0]. The build fails with the
following without including this header:
Unix/FilesystemPath.cpp:84:49: error: ‘major’ was not declared in this scope
Unix/FilesystemPath.cpp:84:113: error: ‘minor’ was not declared in this scope
[0] https://sourceware.org/ml/libc-alpha/2017-02/msg00079.html
Veracrypt for build under GCC6 required using compatibility flag `-std=c++98` against change default C++ frontend in GCC6.
The C++ frontend now defaults to C++14 standard instead of C++98 it has
been defaulting to previously, for compiling older C++ code that might
require either explicitly compiling with selected older C++ standards,
or might require some code adjustment, see
http://gcc.gnu.org/gcc-6/porting_to.html for details. The experimental
C++17 support has been enhanced in this release.
from: https://gcc.gnu.org/ml/gcc-announce/2016/msg00000.html
Adhere to XDG Desktop Specification and use the environment variable
XDG_CONFIG_HOME to determine location of configuration files on *all*
platforms. If it is unset or empty resort to platform-specific defaults.
On Windows and OS X, `wxStandardPaths` provides correct defaults (equal
to the previous hard-coded paths) but on Linux and other Unices
`~/.config/appinfo` would be better than `~/.appinfo`. This means we
treat those platforms as a special case. It also means that we may need
to fall back to the legacy location if it exists but the new location
doesn't.
Requirements for Building VeraCrypt for Linux and Mac OS X
Instructions for Building VeraCrypt for Linux and Mac OS X
Mac OS X specifics
III. FreeBSD and OpenSolaris
IV. Third-Party Developers (Contributors)
[V. Legal Information](#v-legal-information)
V. Legal Information
[VI. Further Information](#vi-further-information)
VI. Further Information
# I. Windows
## Requirements for Building VeraCrypt for Windows:
A detailed guide on how to build VeraCrypt on Windows can be found in
I. Windows
the [documentation](./doc/html/en/CompilingGuidelineWin.html) in the repository and
==========
it is also available [online](https://veracrypt.jp/en/CompilingGuidelineWin.html) or on the [mirror](https://veracrypt.io/en/CompilingGuidelineWin.html).
Requirements for Building VeraCrypt for Windows:
------------------------------------------------
- Microsoft Visual C++ 2008 SP1 (Professional Edition or compatible)
- Microsoft Visual C++ 1.52 (available from MSDN Subscriber Downloads)
- Microsoft Windows SDK for Windows 7 (configured for Visual C++)
- Microsoft Windows Driver Kit 7.1.0 (build 7600.16385.1)
header files (available at ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20)
- NASM assembler 2.08 or compatible
- gzip compressor
IMPORTANT:
IMPORTANT:
The 64-bit editions of Windows Vista and later versions of Windows, and in
The 64-bit editions of Windows Vista and later versions of Windows, and in
some cases (e.g. playback of HD DVD content) also the 32-bit editions, do not
some cases (e.g. playback of HD DVD content) also the 32-bit editions do not
allow the VeraCrypt driver to run without an appropriate digital signature.
allow the VeraCrypt driver to run without an appropriate digital signature.
Therefore, all .sys files in official VeraCrypt binary packages are digitally
Therefore, all .sys files in official VeraCrypt binary packages are digitally
signed with the digital certificate of the IDRIX, which was
signed with the digital certificate of the IDRIX, which was issued by
issued by Thawt certification authority. At the end of each official .exe and
GlobalSign certification authority. At the end of each official .exe and
.sys file, there are embedded digital signatures and all related certificates
.sys file, there are embedded digital signatures and all related certificates
(i.e. all certificates in the relevant certification chain, such as the
(i.e. all certificates in the relevant certification chain, such as the
certification authority certificates, CA-MS cross-certificate, and the
certification authority certificates, CA-MS cross-certificate, and the
IDRIX certificate). Keep this in mind if you compile VeraCrypt
IDRIX certificate).
and compare your binaries with the official binaries. If your binaries are
unsigned, the sizes of the official binaries will usually be approximately
10 KB greater than sizes of your binaries (there may be further differences
if you use a different version of the compiler, or if you install a different
or no service pack for Visual Studio, or different hotfixes for it, or if you
use different versions of the required SDKs).
Keep this in mind if you compile VeraCrypt and compare your binaries with the
official binaries. If your binaries are unsigned, the sizes of the official
binaries will usually be approximately 10 KiB greater than the sizes of your
binaries (there may be further differences if you use a different version of
the compiler, or if you install a different or no service pack for Visual
Studio, or different hotfixes for it, or if you use different versions of
the required SDKs).
Instructions for Building VeraCrypt for Windows:
## Instructions for Signing and Packaging VeraCrypt for Windows:
------------------------------------------------
1) Create an environment variable 'MSVC16_ROOT' pointing to the folder 'MSVC15'
First, create an environment variable 'WSDK81' pointing to the Windows SDK
extracted from the Visual C++ 1.52 self-extracting package.
for Windows 8.1 installation directory.
Note: The 16-bit installer MSVC15\SETUP.EXE cannot be run on 64-bit Windows,
The folder "Signing" contains a batch file (sign.bat) that will sign all
but it is actually not necessary to run it. You only need to extract the
VeraCrypt components using a code signing certificate present on the
folder 'MSVC15', which contains the 32-bit binaries required to build the
certificate store and build the final installation setup and MSI package.
VeraCrypt Boot Loader.
The batch file assumes that the code signing certificate is issued by
GlobalSign. This is the case for IDRIX's certificate. If yours is issued by
another CA, then you should put its intermediate certificates in the "Signing"
folder and modify sign.bat accordingly.
2) If you have installed the Windows Driver Development Kit in another
To generate MSI packages, WiX Toolset v3.11 must be installed.
directory than '%SYSTEMDRIVE%\WinDDK', create an environment variable
'WINDDK_ROOT' pointing to the DDK installation directory.
3) Copy the PKCS #11 header files to a standard include path or create an
## VeraCrypt EFI Boot Loader:
environment variable 'PKCS11_INC' pointing to the directory where
the PKCS #11 header files are installed.
4) Open the solution file 'VeraCrypt.sln' in Microsoft Visual Studio 2008.
VeraCrypt source code contains pre-built EFI binaries under src\Boot\EFI.
The source code of VeraCrypt EFI Boot Loader is licensed under LGPL and
it is available at https://github.com/veracrypt/VeraCrypt-DCS.
For build instructions, please refer to the file src\Boot\EFI\Readme.txt.
5) Select 'All' as the active solution configuration.
# II. Linux and Mac OS X
6) Build the solution.
A detailed guide on how to build VeraCrypt on Linux can be found in
the [documentation](./doc/html/en/CompilingGuidelineLinux.html) in the repository and
it is also available [online](https://veracrypt.jp/en/CompilingGuidelineLinux.html) or on the [mirror](https://veracrypt.io/en/CompilingGuidelineLinux.html).
7) If successful, there should be newly built VeraCrypt binaries in the
## Requirements for Building VeraCrypt for Linux and Mac OS X:
'Release' folder.
Instructions for Signing VeraCrypt for Windows:
------------------------------------------------
The folder "Signing" contains a batch file (sign.bat) that will sign all
VeraCrypt components using a code signing certificate present on the
certificate store and also build the final installation setup.
The batch file suppose that the code signing certificate is issued by Thawt.
This is the case for IDRIX's certificate. If yours is issued by another CA,
then you should put the Root and Intermediate certificates in the "Signing"
folder and then modify sign.bat accordingly.
II. Linux and Mac OS X
======================
Requirements for Building VeraCrypt for Linux and Mac OS X:
Write-Verbose" New Estimated Total Size: '$currentTotalSize' bytes"
}
if($iteration-ge$maxIterations){
Write-Warning"FAT/Bitmap size calculation did not converge after '$maxIterations' iterations. Using last calculated size ('$currentTotalSize' bytes). This might indicate an issue or extremely large dataset."
}
Write-Verbose"Compute-ExFatSize Converged Size: '$currentTotalSize' bytes after '$iteration' iterations."
return[PSCustomObject]@{
TotalSize=$currentTotalSize
ClusterCount=$clusterCount
IterationHistory=@()
}
}
functionGet-RecommendedCluster{
param([UInt64]$VolumeBytes)
switch($VolumeBytes){
{$_-le256MB}{return4KB}
{$_-le32GB}{return32KB}
{$_-le256TB}{return128KB}
default{return512KB}
}
}
#----------------------------------------------- Drive the two-pass logic
Write-Host"Calculating required size for '$InputPath'..."
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
The Advanced Encryption Standard (AES) specifies a FIPS-approved cryptographic algorithm (Rijndael, designed by Joan Daemen and Vincent Rijmen, published in 1998) that may be used by US federal departments and agencies to cryptographically protect sensitive
information [3]. VeraCrypt uses AES with 14 rounds and a 256-bit key (i.e., AES-256, published in 2001) operating in
In June 2003, after the NSA (US National Security Agency) conducted a review and analysis of AES, the U.S. CNSS (Committee on National Security Systems) announced in [1] that the design and strength of AES-256 (and AES-192) are sufficient to protect classified
information up to the Top Secret level. This is applicable to all U.S. Government Departments or Agencies that are considering the acquisition or use of products incorporating the Advanced Encryption Standard (AES) to satisfy Information Assurance requirements
associated with the protection of national security systems and/or national security information [1].</div>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
<p>We would like to thank the following people:</p>
<p>The TrueCrypt Developers team who have done an amazing job over the course of 10 years. Without their hard work, VeraCrypt would not exist today.</p>
<p>Paul Le Roux for making his E4M source code available. TrueCrypt 1.0 was derived from E4M and some parts of the E4M source code are still incorporated in the latest version of the TrueCrypt source code.</p>
<p>Brian Gladman, who wrote the excellent AES, Twofish, and SHA-512 routines.</p>
<p>Peter Gutmann for his paper on random numbers, and for creating his cryptlib, which was the source of parts of the random number generator source code.</p>
<p>Wei Dai, who wrote the Serpent and RIPEMD-160 and Whirlpool routines.</p>
<p>Tom St Denis, the author of LibTomCrypt which includes compact SHA-256 routines.</p>
<p>Mark Adler and Jean-loup Gailly, who wrote the zlib library.</p>
<p>The designers of the encryption algorithms, hash algorithms, and the mode of operation:</p>
<p>Horst Feistel, Don Coppersmith, Walt Tuchmann, Lars Knudsen, Ross Anderson, Eli Biham, Bruce Schneier, David Wagner, John Kelsey, Niels Ferguson, Doug Whiting, Chris Hall, Joan Daemen, Vincent Rijmen, Carlisle Adams, Stafford Tavares, Phillip Rogaway, Hans
Dobbertin, Antoon Bosselaers, Bart Preneel, Paulo S. L. M. Barreto.</p>
<p>Andreas Becker for designing VeraCrypt logo and icons.</p>
<p>Xavier de Carné de Carnavalet who proposed a speed optimization for PBKDF2 that reduced mount/boot time by half.</p>
<p>kerukuro for cppcrypto library (http://cppcrypto.sourceforge.net/) from which Kuznyechik cipher implementation was taken.</p>
<p><br>
Dieter Baron and Thomas Klausner who wrote the libzip library.</p>
<p><br>
Jack Lloyd who wrote the SIMD optimized Serpent implementation.</p>
<p>All the others who have made this project possible, all who have morally supported us, and all who sent us bug reports or suggestions for improvements.</p>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
<ahref="Additional%20Security%20Requirements%20and%20Precautions.html">Additional Security Requirements and Precautions</a>
</p></div>
<divclass="wikidoc">
<div>
<h1>Additional Security Requirements and Precautions</h1>
<p>In addition to the requirements and precautions described in this chapter (<ahref="Security%20Requirements%20and%20Precautions.html"><em>Security Requirements and Precautions</em></a>), you must follow and keep in
mind the security requirements, precautions, and limitations listed in the following chapters and sections:</p>
<ul>
<li><ahref="How%20to%20Back%20Up%20Securely.html"><em><strong>How to Back Up Securely</strong></em></a>
</li><li><ahref="Security%20Requirements%20for%20Hidden%20Volumes.html"><em><strong>Security Requirements and Precautions Pertaining to Hidden Volumes</strong></em></a>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
Argon2id is a memory-hard key derivation function designed to resist both time-memory trade-off attacks and side-channel attacks. It was selected as the winner of the Password Hashing Competition (PHC) in 2015 and is defined in RFC 9106. VeraCrypt supports Argon2id as an alternative to PBKDF2-HMAC for header key derivation.
<strong>Algorithm:</strong> Argon2id as defined in RFC 9106<br/>
<strong>Internal hash:</strong> BLAKE2b<br/>
<strong>Salt size:</strong> 512 bits (same as PBKDF2-HMAC)<br/>
<strong>Output length:</strong> Variable, depending on the encryption algorithm (e.g., 256 bits for AES-256, 768 bits for AES-Twofish-Serpent cascade)<br/>
<strong>Version:</strong> Argon2 version 0x13 (19 decimal)
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
<ahref="Authenticity%20and%20Integrity.html">Authenticity and Integrity</a>
</p></div>
<divclass="wikidoc">
<div>
<h1>Authenticity and Integrity</h1>
<p>VeraCrypt uses encryption to preserve the <em>confidentiality</em> of data it encrypts. VeraCrypt neither preserves nor verifies the integrity or authenticity of data it encrypts or decrypts. Hence, if you allow an adversary to modify data encrypted by VeraCrypt,
he can set the value of any 16-byte block of the data to a random value or to a previous value, which he was able to obtain in the past. Note that the adversary cannot choose the value that you will obtain when VeraCrypt decrypts the modified block —
the value will be random — unless the attacker restores an older version of the encrypted block, which he was able to obtain in the past. It is your responsibility to verify the integrity and authenticity of data encrypted or decrypted by VeraCrypt (for
example, by using appropriate third-party software).<br>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
https://www.linkedin.com/in/idrassi</a>) is the creator and main developer of VeraCrypt. He managed all development and deployment aspects on all supported platforms (Windows,Linux and OSX).</p>
<p>Alex Kolotnikov (<ahref="https://ru.linkedin.com/in/alex-kolotnikov-6625568b"target="_blank">https://ru.linkedin.com/in/alex-kolotnikov-6625568b</a>) is the author of VeraCrypt EFI bootloader. He manages all aspects of EFI support and his strong expertise
helps bring new exciting features to VeraCrypt Windows system encryption.</p>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
<h1>Understanding the Risks of Using Third-Party File Extensions with VeraCrypt</h1>
<div>
<p>While VeraCrypt provides robust encryption capabilities to secure your data, using third-party file extensions for File Containers or Keyfiles could risk making the encrypted data inaccessible.<br/>
This guide provides an in-depth explanation of the associated risks, and it outlines recommendations for best practices to mitigate these risks.</p>
</div>
<h2>Risks Associated with File Containers</h2>
<div>
<p>Using a third-party file extension for File Containers exposes you to several risks:</p>
<ul>
<li>Overwritten Metadata: Third-party applications may update their metadata, which could overwrite crucial parts of the File Container.</li>
<li>Unintentional Changes: Accidentally launching a File Container with a third-party application could modify its metadata without your consent.</li>
<li>Container Corruption: These actions could render the container unreadable or unusable.</li>
<li>Data Loss: The data within the container might be permanently lost if the container becomes corrupted.</li>
</ul>
</div>
<h2>Risks Associated with Keyfiles</h2>
<div>
<p>Similar risks are associated with Keyfiles:</p>
<ul>
<li>Keyfile Corruption: Inadvertently modifying a Keyfile with a third-party application can make it unusable for decryption.</li>
<li>Overwritten Data: Third-party applications may overwrite the portion of the Keyfile that VeraCrypt uses for decryption.</li>
<li>Unintentional Changes: Accidental changes can make it impossible to mount the volume unless you have an unaltered backup of the Keyfile.</li>
</ul>
</div>
<h2>Examples of Extensions to Avoid</h2>
<div>
<p>Avoid using the following types of third-party file extensions:</p>
<ul>
<li>Media Files: Picture, audio, and video files are subject to metadata changes by their respective software.</li>
<li>Archive Files: Zip files can be easily modified, which could disrupt the encrypted volume.</li>
<li>Executable Files: Software updates can modify these files, making them unreliable as File Containers or Keyfiles.</li>
<li>Document Files: Office and PDF files can be automatically updated by productivity software, making them risky to use.</li>
</ul>
</div>
<h2>Recommendations</h2>
<div>
<p>For secure usage, consider the following best practices:</p>
<ul>
<li>Use neutral file extensions for File Containers and Keyfiles to minimize the risk of automatic file association.</li>
<li>Keep secure backups of your File Containers and Keyfiles in locations isolated from network access.</li>
<li>Disable auto-open settings for the specific file extensions you use for VeraCrypt File Containers and Keyfiles.</li>
<li>Always double-check file associations and be cautious when using a new device or third-party application.</li>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
BLAKE2 is a cryptographic hash function based on BLAKE, created by Jean-Philippe Aumasson, Samuel Neves, Zooko Wilcox-O'Hearn, and Christian Winnerlein. It was announced on December 21, 2012. The design goal was to replace the widely used, but broken, MD5 and SHA-1 algorithms in applications requiring high performance in software. BLAKE2 provides better security than SHA-2 and similar to that of SHA-3 (e.g. immunity to length extension, indifferentiability from a random oracle, etc...).<br/>
BLAKE2 removes addition of constants to message words from BLAKE round function, changes two rotation constants, simplifies padding, adds parameter block that is XOR'ed with initialization vectors, and reduces the number of rounds from 16 to 12 for BLAKE2b (successor of BLAKE-512), and from 14 to 10 for BLAKE2s (successor of BLAKE-256).<br/>
BLAKE2b and BLAKE2s are specified in RFC 7693.
</p>
<p>
VeraCrypt uses only BLAKE2s with its maximum output size of 32-bytes (256 bits).
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
<h2>How to Create and Use a VeraCrypt Container</h2>
<p>This chapter contains step-by-step instructions on how to create, mount, and use a VeraCrypt volume. We strongly recommend that you also read the other sections of this manual, as they contain important information.</p>
<h4>STEP 1:</h4>
<p>If you have not done so, download and install VeraCrypt. Then launch VeraCrypt by double-clicking the file VeraCrypt.exe or by clicking the VeraCrypt shortcut in your Windows Start menu.</p>
The VeraCrypt Volume Creation Wizard window should appear.<br>
<br>
In this step you need to choose where you wish the VeraCrypt volume to be created. A VeraCrypt volume can reside in a file, which is also called container, in a partition or drive. In this tutorial, we will choose the first option and create a VeraCrypt volume
within a file.<br>
<br>
As the option is selected by default, you can just click <strong>Next</strong>.</p>
<p>Note: In the following steps, the screenshots will show only the right-hand part of the Wizard window.</p>
In this step you need to choose whether to create a standard or hidden VeraCrypt volume. In this tutorial, we will choose the former option and create a standard VeraCrypt volume.<br>
<br>
As the option is selected by default, you can just click <strong>Next</strong>.</p>
In this step you have to specify where you wish the VeraCrypt volume (file container) to be created. Note that a VeraCrypt container is just like any normal file. It can be, for example, moved or deleted as any normal file. It also needs a filename, which you
will choose in the next step.<br>
<br>
Click <strong>Select File</strong>.<br>
<br>
The standard Windows file selector should appear (while the window of the VeraCrypt Volume Creation Wizard remains open in the background).</p>
In this tutorial, we will create our VeraCrypt volume in the folder F<em>:\Data\ </em>
and the filename of the volume (container) will be <em>MyVolume.hc </em>(as can be seen in the screenshot above). You may, of course, choose any other filename and location you like (for example, on a USB memory stick). Note that the file
<em>MyVolume.hc </em>does not exist yet – VeraCrypt will create it.</p>
<p>IMPORTANT: Note that VeraCrypt will <em>not </em>encrypt any existing files (when creating a VeraCrypt file container). If you select an existing file in this step, it will be overwritten and replaced by the newly created volume (so the overwritten file
will be <em>lost</em>, <em>not </em>encrypted). You will be able to encrypt existing files (later on) by moving them to the VeraCrypt volume that we are creating now.*</p>
<p>Select the desired path (where you wish the container to be created) in the file selector. Type the desired container file name in the
<strong>Filename </strong>box.<br>
<br>
Click <strong>Save</strong>.<br>
<br>
The file selector window should disappear.<br>
<br>
In the following steps, we will return to the VeraCrypt Volume Creation Wizard.</p>
<p>* Note that after you copy existing unencrypted files to a VeraCrypt volume, you should securely erase (wipe) the original unencrypted files. There are software tools that can be used for the purpose of secure erasure (many of them are free).</p>
Here you can choose an encryption algorithm and a hash algorithm for the volume. If you are not sure what to select here, you can use the default settings and click
<strong>Next </strong>(for more information, see chapters <ahref="Encryption Algorithms.html">
<em>Encryption Algorithms</em></a> and <ahref="Hash%20Algorithms.html">
Here we specify that we wish the size of our VeraCrypt container to be 250 megabyte. You may, of course, specify a different size. After you type the desired size in the input field (marked with a red rectangle), click
This is one of the most important steps. Here you have to choose a good volume password. Read carefully the information displayed in the Wizard window about what is considered a good password.<br>
<br>
After you choose a good password, type it in the first input field. Then re-type it in the input field below the first one and click
<strong>Next</strong>.</p>
<p>Note: The button <strong>Next </strong>will be disabled until passwords in both input fields are the same.</p>
Move your mouse as randomly as possible within the Volume Creation Wizard window at least until the randomness indicator becomes green. The longer you move the mouse, the better (moving the mouse for at least 30 seconds is recommended). This significantly increases
the cryptographic strength of the encryption keys (which increases security).<br>
<br>
Click <strong>Format</strong>.<br>
<br>
Volume creation should begin. VeraCrypt will now create a file called <em>MyVolume.hc
</em>in the folder F<em>:\Data\ </em>(as we specified in Step 6). This file will be a VeraCrypt container (it will contain the encrypted VeraCrypt volume). Depending on the size of the volume, the volume creation may take a long time. After it finishes, the
We have just successfully created a VeraCrypt volume (file container). In the VeraCrypt Volume Creation Wizard window, click
<strong>Exit</strong>.<br>
<br>
The Wizard window should disappear.<br>
<br>
In the remaining steps, we will mount the volume we just created. We will return to the main VeraCrypt window (which should still be open, but if it is not, repeat Step 1 to launch VeraCrypt and then continue from Step 13.)</p>
Select the PRF algorithm that was used during the creation of the volume (SHA-512 is the default PRF used by VeraCrypt). If you don’t remember which PRF was used, just leave it set to “autodetection” but the mounting process will take more
time. Click <strong>OK</strong> after entering the password.<br>
<br>
VeraCrypt will now attempt to mount the volume. If the password is incorrect (for example, if you typed it incorrectly), VeraCrypt will notify you and you will need to repeat the previous step (type the password again and click
<strong>OK</strong>). If the password is correct, the volume will be mounted.</p>
We have just successfully mounted the container as a virtual disk M:<br>
<br>
The virtual disk is entirely encrypted (including file names, allocation tables, free space, etc.) and behaves like a real disk. You can save (or copy, move, etc.) files to this virtual disk and they will be encrypted on the fly as they are being written.<br>
<br>
If you open a file stored on a VeraCrypt volume, for example, in media player, the file will be automatically decrypted to RAM (memory) on the fly while it is being read.</p>
<p>Important: Note that when you open a file stored on a VeraCrypt volume (or when you write/copy a file to/from the VeraCrypt volume) you will not be asked to enter the password again. You need to enter the correct password only when mounting the volume.</p>
<p>You can open the mounted volume, for example, by selecting it on the list as shown in the screenshot above (blue selection) and then double-clicking on the selected item.</p>
<p>You can also browse to the mounted volume the way you normally browse to any other types of volumes. For example, by opening the ‘<em>Computer</em>’ (or ‘<em>My Computer</em>’) list and double clicking the corresponding drive letter
You can copy files (or folders) to and from the VeraCrypt volume just as you would copy them to any normal disk (for example, by simple drag-and-drop operations). Files that are being read or copied from the encrypted VeraCrypt volume are automatically decrypted
on the fly in RAM (memory). Similarly, files that are being written or copied to the VeraCrypt volume are automatically encrypted on the fly in RAM (right before they are written to the disk).<br>
<br>
Note that VeraCrypt never saves any decrypted data to a disk – it only stores them temporarily in RAM (memory). Even when the volume is mounted, data stored in the volume is still encrypted. When you restart Windows or turn off your computer, the volume
will be unmounted and all files stored on it will be inaccessible (and encrypted). Even when power supply is suddenly interrupted (without proper system shut down), all files stored on the volume will be inaccessible (and encrypted). To make them accessible
again, you have to mount the volume. To do so, repeat Steps 13-18.</p>
<p>If you want to close the volume and make files stored on it inaccessible, either restart your operating system or unmount the volume. To do so, follow these steps:<br>
Select the volume from the list of mounted volumes in the main VeraCrypt window (marked with a red rectangle in the screenshot above) and then click
<strong>Unmount </strong>(also marked with a red rectangle in the screenshot above). To make files stored on the volume accessible again, you will have to mount the volume. To do so, repeat Steps 13-18.</p>
<h2>How to Create and Use a VeraCrypt-Encrypted Partition/Device</h2>
<p>Instead of creating file containers, you can also encrypt physical partitions or drives (i.e., create VeraCrypt device-hosted volumes). To do so, repeat the steps 1-3 but in the step 3 select the second or third option. Then follow the remaining instructions
in the wizard. When you create a device-hosted VeraCrypt volume within a <em>non-system
</em>partition/drive, you can mount it by clicking <em>Auto-Mount Devices </em>in the main VeraCrypt window. For information pertaining to encrypted
<em>system </em>partition/drives, see the chapter <ahref="System%20Encryption.html">
<em>System Encryption</em></a>.</p>
<p>Important: <em>We strongly recommend that you also read the other chapters of this manual, as they contain important information that has been omitted in this tutorial for simplicity.</em></p>
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.