FreeBSD: make official FreeBSD build script executable

FreeBSD: enable wxWidgets static build by default in official build script
Update Readme to mention FreeBSD support and remove reference to OpenSolaris
2026-08-30 20:57:10 +00:00 · 2017-07-10 00:31:19 +02:00 · 2017-07-10 00:18:28 +02:00 · 2017-07-10 00:14:19 +02:00 · 2017-07-10 00:14:18 +02:00 · 2017-07-09 10:55:38 +02:00
106 changed files with 1939 additions and 920 deletions
@@ -27,7 +27,7 @@ II. Linux and Mac OS X
    Instructions for Building VeraCrypt for Linux and Mac OS X.
 	Mac OS X specifics

-III. FreeBSD and OpenSolaris
+III. FreeBSD

 IV. Third-Party Developers (Contributors)

@@ -210,10 +210,12 @@ Thus, we recommend using a different OSX SDK version for building VeraCrypt.



-III. FreeBSD and OpenSolaris
+III. FreeBSD
 ============================

-FreeBSD and OpenSolaris are not yet supported.
+FreeBSD is supported starting from version 11.
+The build requirements and instructions are the same as Linux except that gmake
+should be used instead of make.



@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="ar" name="العربية" en-name="Arabic" version="0.2.0" translators="Ahmad Gharbeia, Khaled Hosny, Ali Khojah" />
    <!-- Fonts -->
@@ -1413,15 +1413,15 @@
    <string lang="ar" key="RESCUE_DISK_EFI_CHECK_FAILED">لم يمكن التأكد من صحة تصدير ملف الإنقاذ\n\nإذا صدرت ملف الإنقاذ فيرجى نزع القرص الملحق ثم إدخاله مرة أخرى ثم اضغط زر التالي. إذا لم تنجح العملية فيمكن استخدام قرص ملق آخر أو تطبيق آخر لفك ضغط الملفات المضغفطة\n\nإذا لم تقم بتصدير ملف الإنقاذ بعد فيرجى عمل ذلك ثم الضغط على زر التالي\n\nإذا حاولت التأكد من صحة إنشاء ملف الإنقاذ قبل التسلسل التوضيحي للعملية فيرجى ملاحظة أنه لن يمكنك استخدام قرص الإنقاذ ذاك لأنه أنشء بمفتاح رئيسي آخر. تحتاج تصدير تصدير صورة مضغوطة جديدة</string>
    <string lang="ar" key="RESCUE_DISK_EFI_NON_WIZARD_CHECK_FAILED">لم يمكن التأكد من نجاح عملية تصدير قرص الإنقاذ\n\nإذا قمت بتصدير قرص الإنقاذ على وسيط ملحق فيرجى نزعه ثم إدخاله مرة أخرى. إذا لم يجد ذلك فعليك باستخدام وسيط ملحق آخر أو تطبيق آخر لضغط الملفات\n\nإذا حاولت التحقق من إنشاء قرص الإنقاذ لمفتاح رئيسي آخر أو كلمة سر أخرى, فيرجى ملاحظ أن عملية التحقق ستفشل دائما. لإنشاء قرص إنقاذ جديد فينبغي تهيئته على البيئة الحالية, اختر 'النظام' > 'إنشاء قرص الإنقاذ'.</string>
    <string lang="ar" key="RESCUE_DISK_EFI_NON_WIZARD_CREATION">صورة قرص الإنقاذ تم إنشاؤها وحفظها على الملف:\n%s\n\nالآن تحتاج تصديره على وسيط ملحق مهيأ بصيغة FAT/FAT32.\n\nمهم: لاحظ أن تطبيق فك الضغط يجب أن يفك الملف على جذر الوسيط الملحق. على سبيل المثال، لو كان الوسيط الملحق هو E: فإنه يلزم فك الضغط على المجلد E:\\EFI.\n\nبعد إنشاء قرص الإنقاذ، اختر 'النظام' > 'التحقق من قرص الإنقاذ' للتحقق من إنشائه بنجاح</string>
-	<control lang="ar" key="IDC_SECURE_DESKTOP_PASSWORD_ENTRY">استخدم سطح مكتب مؤمن لإدخال كلمة السر</control>
-    <string lang="en" key="ERR_REFS_INVALID_VOLUME_SIZE">The volume file size specified in the command line is incompatible with selected ReFS filesystem.</string>
-    <control lang="en" key="IDC_EDIT_DCSPROP">Edit Boot Loader Configuration</control>
-    <control lang="en" key="IDC_SHOW_PLATFORMINFO">Display EFI Platform Information</control>
-    <string lang="en" key="BOOT_LOADER_CONFIGURATION_FILE">Boot Loader Configuration File</string>
-    <string lang="en" key="EFI_PLATFORM_INFORMATION">EFI Platform Information</string>
-    <string lang="en" key="EDIT_DCSPROP_FOR_ADVANCED_ONLY">WARNING: Inexperienced users should never attempt to manually edit boot loader configurations.\n\nContinue?</string>
-    <string lang="en" key="DCSPROP_XML_VALIDATION_FAILED">WARNING: Failed to validate the XML format of the Boot Loader configuration. Please check your modifications.</string>
-    <control lang="en" key="IDT_ADVANCED_OPTIONS">Advanced Options</control>
+    <control lang="ar" key="IDC_SECURE_DESKTOP_PASSWORD_ENTRY">استخدم سطح مكتب مؤمن لإدخال كلمة السر</control>
+    <string lang="ar" key="ERR_REFS_INVALID_VOLUME_SIZE">حجم الملف المحدد في سطر الأوامر غير متوافق مع نظام الملفات  ReFS</string>
+    <control lang="ar" key="IDC_EDIT_DCSPROP">تحرير تهيئة تحميل الاقلاع</control>
+    <control lang="ar" key="IDC_SHOW_PLATFORMINFO">أعرض معلومات بيئة EFI</control>
+    <string lang="ar" key="BOOT_LOADER_CONFIGURATION_FILE">ملف تهيئة تحميل الاقلاع</string>
+    <string lang="ar" key="EFI_PLATFORM_INFORMATION">EFI معلومات بيئة</string>
+    <string lang="ar" key="EDIT_DCSPROP_FOR_ADVANCED_ONLY">تحذير: المستخدم غير الخبير ينبغي ألا يحاول تعديل ملف تحميل الإقلاع يدويا\n\nاستمر?</string>
+    <string lang="ar" key="DCSPROP_XML_VALIDATION_FAILED">تحذير: فشل في التحقق من صحة صيغة XML لتهيئة بيئة الإقلاع. يرجى التأكد من التعديلات.</string>
+    <control lang="ar" key="IDT_ADVANCED_OPTIONS">خيارات متقدمة</control>
  </localization>
  <!-- XML Schema -->
  <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="be" name="Беларуская" en-name="Belarusian" version="0.1.0" translators="Aleg Azarousky" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="bg" name="Български" en-name="Bulgarian" version="0.1.0" translators="Lachezar Gorchev" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="ca" name="Català" en-name="Catalan" version="0.1.0" translators="CESICAT, Centre de Seguretat de la Informació de Catalunya" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="cs" name="Čeština" en-name="Czech" version="1.1.0" translators="Vítek Moser, Lagardere" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="da" name="Dansk" en-name="Danish" version="0.1.0" translators="Lasse Bond" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Sprachen -->
    <language langid="de" name="Deutsch" en-name="German" version="1.1.8" translators="Harry Haller, Alexander Schorg, Simon Frankenberger, David Arndt, H. Sauer, Dulla, Ettore Atalan, Matthias Kolja Miehl" />
    <!-- Schriftarten -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="el" name="Ελληνικά" en-name="Greek" version="0.1.0" translators="Βασίλης Κοσμίδης" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="es" name="Español" en-name="Spanish" version="1.0.0" translators="Juan Antonio Auñón Ochando" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="et" name="Eesti" en-name="Estonian" version="0.1.0" translators="Maiko Mõtsar" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="eu" name="Euskara" en-name="Basque" version="1.0.0" translators="Ander Genua" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="fa" name="فارسي" en-name="Persian" version="0.1.0" translators="Ali Bitazar, Rodabeh Sarmadi" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="fi" name="Suomi" en-name="Finnish" version="0.1.0" translators="Matti Ruhanen" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="fr" name="Français" en-name="French" version="0.3.0" translators="Stéphane S., Olivier M., Thierry T" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="hu" name="Magyar" en-name="Hungarian" version="0.1.0" translators="Nyul Balazs" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="id" name="Bahasa Indonesia" en-name="Indonesian" version="0.1.0" translators="Tajuddin N. F." />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="it" name="Italiano" en-name="Italian" version="1.0.1" translators="Maurizio Ballo, Consiglio Gaetano" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="ja" name="日本語" en-name="Japanese" version="1.0.0" translators="OGOSHI Masayuki" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="ka" name="ქართული" en-name="Georgian" version="0.1.0" translators="Kakha Lomiashvili" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="ko" name="한국어" en-name="Korean" version="0.1.1" translators="Kim Young, Herbert Shin" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="lv" name="Latviešu" en-name="Latvian" version="0.1.0" translators="Edmunds Melkers" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="my" name="မြန်မာ" en-name="Burmese" version="1.0.0" translators="Zaw Myo Htet" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="nl" name="Nederlands" en-name="Dutch" version="0.2.3" translators="Jan van der Wal, Peter Tak" />
 																								   
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="nn" name="Norsk Nynorsk" en-name="Norwegian (Nynorsk)" version="0.1.0" translators="Kjell Rune Helland" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="pl" name="Polski" en-name="Polish" version="1.0.0" translators="Mirek Druchowicz, Janusz Zamecki, Sobiesław Antolak, Begina Felicysym" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="pt-br" name="Português-Brasil" en-name="Portuguese (Brazil)" version="0.1.0" translators="Thiago C. L. Mendes, Lecidio S. Alencar , Lucas C. Ferreira" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="ro" name="Română" en-name="Romanian" version="1.0.0" translators="Barna Cosmin Marian" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="ru" name="Русский" en-name="Russian" version="1.0.3" translators="Dmitry Yerokhin" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="sk" name="Slovenčina" en-name="Slovak" version="0.1.0" translators="Kamil David" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="sl" name="Slovenščina" en-name="Slovenian" version="0.1.0" translators="Erik David Salam" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="sv" name="Svenska" en-name="Swedish" version="1.0.0" translators="Peter Runesson" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="tr" name="Türkçe" en-name="Turkish" version="0.1.0" translators="Ali İskender Turan, Zeynel Abidin Öztürk" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="uk" name="Українська" en-name="Ukrainian" version="1.0.0" translators="Kravchuk Olexandr, Babchuk Volodymyr" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="uz" name="Ўзбекча" en-name="Uzbek (Cyrillic)" version="0.1.0" translators="Abdurauf Azizov, Dmitry Yerokhin" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="vi" name="Tiếng Việt" en-name="Vietnamese" version="0.1.0" translators="Nguyễn Kim Huy" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="zh-cn" name="简体中文" en-name="Chinese (Simplified)" version="1.0.0" translators="Barney Li and Zhangjintao" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="zh-hk" name="繁體中文" en-name="Chinese (Hong Kong)" version="0.1.0" translators="PUN Chi Ho" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.20">
+  <localization prog-version="1.21">
    <!-- Languages -->
    <language langid="zh-tw" name="繁體中文" en-name="Chinese (Taiwan)" version="0.1.0" translators="Barney Li, Simon Ma, ChangMing Hsu" />
    <!-- Fonts -->
@@ -35,7 +35,7 @@
 <div class="wikidoc">
 <h1>Frequently Asked Questions</h1>
 <div style="text-align:left; margin-bottom:19px; padding-top:0px; padding-bottom:0px; margin-top:0px">
-Last Updated December 23th, 2015</div>
+Last Updated July 2nd, 2017</div>
 <div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
 <em style="text-align:left">This document is not guaranteed to be error-free and is provided &quot;as is&quot; without warranty of any kind. For more information, see
 <a href="Disclaimers.html" target="_blank" style="text-align:left; color:#0080c0; text-decoration:none.html">
@@ -685,12 +685,12 @@ VeraCrypt User Guide</a>.</div>
 <br style="text-align:left">
 <strong style="text-align:left">Is the online documentation available for download as a single file?</strong></div>
 <div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
-Yes, the documentation is contained in the file <em style="text-align:left">VeraCrypt User Guide.pdf</em> that is included in all official VeraCrypt distribution packages. You can also download the PDF using the link available at the home page
+Yes, the documentation is contained in the file <em style="text-align:left">VeraCrypt User Guide.chm</em> that is included in official VeraCrypt installer for Windows. You can also download the CHM using the link available at the home page
 <a href="https://www.veracrypt.fr/en/Downloads.html" target="_blank">https://www.veracrypt.fr/en/downloads/</a>. Note that you do
-<em style="text-align:left">not</em> have to install VeraCrypt to obtain the PDF documentation. Just run the self-extracting installation package and then select
+<em style="text-align:left">not</em> have to install VeraCrypt to obtain the CHM documentation. Just run the self-extracting installation package and then select
 <em style="text-align:left">Extract</em> (instead of <em style="text-align:left">
 Install</em>) on the second page of the VeraCrypt Setup wizard. Also note that when you
-<em style="text-align:left">do</em> install VeraCrypt, the PDF documentation is automatically copied to the folder to which VeraCrypt is installed, and is accessible via the VeraCrypt user interface (by pressing F1 or choosing
+<em style="text-align:left">do</em> install VeraCrypt, the CHM documentation is automatically copied to the folder to which VeraCrypt is installed, and is accessible via the VeraCrypt user interface (by pressing F1 or choosing
 <em style="text-align:left">Help</em> &gt; <em style="text-align:left">User's Guide</em>).</div>
 <div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
 <br style="text-align:left">
@@ -70,8 +70,8 @@ PIM </a>value is not specified or if it is equal to zero, VeraCrypt uses the def
 <p>When a <a href="Personal%20Iterations%20Multiplier%20%28PIM%29.html">
 PIM </a>value is given by the user, the number of iterations of the key derivation function is calculated as follows:</p>
 <ul>
-<li>For system partition encryption (boot encryption): Iterations = <strong>PIM x 2048</strong>
-</li><li>For standard containers and other partitions: Iterations = <strong>15000 &#43; (PIM x 1000)</strong>
+<li>For system encryption that doesn't use SHA-512 or Whirlpool: Iterations = <strong>PIM x 2048</strong>
+</li><li>For system encryption that uses SHA-512 or Whirlpool, non-system encryption and file containers: Iterations = <strong>15000 &#43; (PIM x 1000)</strong>
 </li></ul>
 </div>
 <div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
@@ -34,8 +34,8 @@

 <div class="wikidoc">
 <h1>Incompatibilities</h1>
-<h4 style="text-align:left; font-family:Arial,Helvetica,Verdana,sans-serif; font-weight:bold; margin-top:0px; font-size:12px; margin-bottom:1px">
-Activation of Adobe Photoshop&reg; and Other Products Using FLEXnet Publisher&reg; / SafeCast</h4>
+<h2>
+Activation of Adobe Photoshop&reg; and Other Products Using FLEXnet Publisher&reg; / SafeCast</h2>
 <div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
 <em style="text-align:left">Note: The issue described below does <strong style="text-align:left">
 not</strong> affect you if you use a non-cascade encryption algorithm (i.e., AES, Serpent, or Twofish).* The issue also does
@@ -62,7 +62,14 @@ VeraCrypt Rescue Disk</a>.</div>
 <strong style="text-align:left">Possible permanent solution</strong>: decrypt the system partition/drive, and then re-encrypt it using a non-cascade encryption algorithm (i.e., AES, Serpent, or Twofish).*</div>
 <div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
 Please note that this not a bug in VeraCrypt (the issue is caused by inappropriate design of the third-party activation software).</div>
-<p>&nbsp;</p>
+<h2>Outpost Firewall and Outpost Security Suite</h2>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+If Outpost Firewall or Outpost Security Suite is installed with Proactive Protection enabled, the machine freezes completely for 5-10 seconds during the volume mount/dismount operation. This is caused by a conflict between Outpost System Guard option that protects "Active Desktop" objects and VeraCrypt waiting dialog displayed during mount/dismount operations.</div>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+A workaround that fixes this issue is to disable VeraCrypt waiting dialog in the Preferences: use menu "Settings -> Preferences" and check the option "Don't show wait message dialog when performing operations".</div>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+More information can be found at <a href="https://sourceforge.net/p/veracrypt/tickets/100/">https://sourceforge.net/p/veracrypt/tickets/100/</a>
+</div>
 <hr align="left" size="1" width="189" style="text-align:left; height:0px; border-width:0px 1px 1px; border-style:solid; border-color:#000000">
 <p><span style="text-align:left; font-size:10px; line-height:12px">* The reason is that the VeraCrypt Boot Loader is smaller than the one used for cascades of ciphers and, therefore, there is enough space in the first drive track for a backup of the VeraCrypt
 Boot Loader. Hence, whenever the VeraCrypt Boot Loader is damaged, its backup copy is run automatically instead.</span><br style="text-align:left">
@@ -44,7 +44,12 @@
 <br>
 Also, there are other entries whose name start with &quot;#{&quot; and &quot;\??\Volume{&quot;: double click on each one of them and remove the ones whose data value contains the name &quot;VeraCrypt&quot; and &quot;TrueCrypt&quot;.
 </li></ul>
-</li></ul>
+</li>
+<li>On some Windows machines, VeraCrypt may hang intermittently when mounting or dismounting a volume. Similar hanging may affect other running applications during veraCrypt mounting or dismounting operations.
+This issue is caused by a conflict between VeraCrypt waiting dialog displayed during mount/dismount operations and other software installed on the machine (e.g. Outpost Firewall Pro).
+In such situations, the issue can be solved by disabling VeraCrypt waiting dialog in the Preferences: use menu "Settings -> Preferences" and check the option "Don't show wait message dialog when performing operations".
+</li>
+</ul>
 <h3 id="limitations">Limitations</h3>
 <ul>
 <li>[<em>Note: This limitation does not apply to users of Windows Vista and later versions of Windows.</em>] On Windows XP/2003, VeraCrypt does not support encrypting an entire system drive that contains extended (logical) partitions. You can encrypt an entire
@@ -44,7 +44,7 @@
 Header Key Derivation</a>).</p>
 <p>When a PIM value is specified, the number of iterations is calculated as follows:</p>
 <ul>
-<li>For system encryption: Iterations = <strong>PIM x 2048</strong> </li><li>For non-system encryption and file containers: Iterations = <strong>15000 &#43; (PIM x 1000)</strong>
+<li>For system encryption that doesn't use SHA-512 or Whirlpool: Iterations = <strong>PIM x 2048</strong> </li><li>For system encryption that uses SHA-512 or Whirlpool, non-system encryption and file containers: Iterations = <strong>15000 &#43; (PIM x 1000)</strong>
 </li></ul>
 <p>Prior to version 1.12, the security of a VeraCrypt volume was only based on the password strength because VeraCrypt was using a fixed number of iterations.<br>
 With the introduction of PIM, VeraCrypt has a 2-dimensional security space for volumes based on the couple (Password, PIM). This provides more flexibility for adjusting the desired security level while also controlling the performance of the mount/boot operation.</p>
@@ -61,8 +61,8 @@ When creating a volume or when changing the password, the user has the possibili
 <div>During the creation of a volume or the encryption of the system, VeraCrypt forces the PIM value to be greater than or equal to a certain minimal value when the password is less than 20 characters. This check is done in order to ensure that, for short passwords,
 the security level is at least equal to the default level provided by an empty PIM.</div>
 <div>&nbsp;</div>
-<div>The PIM minimal value for short passwords is <strong>98</strong> for system encryption and
-<strong>485</strong> for non-system encryption and files containers. For password with 20 characters and more, the PIM minimal value is
+<div>The PIM minimal value for short passwords is <strong>98</strong> for system encryption that doesn't use SHA-512 or Whirlpool and
+<strong>485</strong> for the other cases. For password with 20 characters and more, the PIM minimal value is
 <strong>1</strong>. In all cases, leaving the PIM empty or setting its value to 0 will make VeraCrypt use the default high number of iterations as explained in section
 <a href="Header%20Key%20Derivation.html">
 Header Key Derivation</a>.</div>
@@ -70,7 +70,7 @@ Header Key Derivation</a>.</div>
 Motivations behind using a custom PIM value can be:<br>
 <ul>
 <li>Add an extra secret parameter (PIM) that an attacker will have to guess </li><li>Increase security level by using large PIM values to thwart future development of brute force attacks.
-</li><li>Speeding up booting or mounting through the use of a small PIM value (less than 98 for system encryption and less than 485 for the other cases)
+</li><li>Speeding up booting or mounting through the use of a small PIM value (less than 98 for system encryption that doesn't use SHA-512 or Whirlpool and less than 485 for the other cases)
 </li></ul>
 <p>The screenshots below show the step to mount a volume using a PIM equal to 231:</p>
 <table style="margin-left:auto; margin-right:auto">
@@ -17,7 +17,7 @@
 #include "BootDefs.h"

 // The user will be advised to upgrade the rescue disk if upgrading from the following or any previous version
-#define TC_RESCUE_DISK_UPGRADE_NOTICE_MAX_VERSION 0x0118
+#define TC_RESCUE_DISK_UPGRADE_NOTICE_MAX_VERSION 0x0120

 #define TC_BOOT_LOADER_AREA_SIZE (TC_BOOT_LOADER_AREA_SECTOR_COUNT * TC_SECTOR_SIZE_BIOS)

@@ -74,7 +74,7 @@
 	<string>TRUE</string>

 	<key>CFBundleVersion</key>
-	<string>1.20.3</string>
+	<string>1.21.5</string>

 	<key>CFBundleShortVersionString</key>
 	<string>_VERSION_</string>
@@ -0,0 +1,48 @@
+#!/bin/sh
+#
+# Copyright (c) 2013-2016 IDRIX
+# Governed by the Apache License 2.0 the full text of which is contained
+# in the file License.txt included in VeraCrypt binary and source
+# code distribution packages.
+#
+
+# Absolute path to this script
+SCRIPT=$(readlink -f "$0")
+# Absolute path this script is in
+SCRIPTPATH=$(dirname "$SCRIPT")
+# source directory which contains the Makefile
+SOURCEPATH=$(readlink -f "$SCRIPTPATH/..")
+# directory where the VeraCrypt has been checked out
+PARENTDIR=$(readlink -f "$SCRIPTPATH/../../..")
+
+# Make sure only root can run our script
+if [ "$(id -u)" != "0" ]; then
+   echo "VeraCrypt must be built by root" 1>&2
+   exit 1
+fi
+
+# the sources of wxWidgets 3.0.3 must be extracted to the parent directory
+export WX_ROOT=$PARENTDIR/wxWidgets-3.0.3
+echo "Using wxWidgets sources in $WX_ROOT"
+
+cd $SOURCEPATH
+
+echo "Building GUI version of VeraCrypt"
+
+# this will be the temporary wxWidgets directory
+export WX_BUILD_DIR=$PARENTDIR/wxBuildGui
+
+gmake WXSTATIC=1 wxbuild && gmake WXSTATIC=1 clean && gmake WXSTATIC=1 && gmake WXSTATIC=1 package
+
+# Uncomment below and comment line above to reuse existing wxWidgets build
+#gmake WXSTATIC=1 clean && gmake WXSTATIC=1 && gmake WXSTATIC=1 package
+
+echo "Building console version of VeraCrypt"
+
+# this will be the temporary wxWidgets directory
+export WX_BUILD_DIR=$PARENTDIR/wxBuildConsole
+
+gmake WXSTATIC=1 NOGUI=1 wxbuild && gmake WXSTATIC=1 NOGUI=1 clean && gmake WXSTATIC=1 NOGUI=1 && gmake WXSTATIC=1 NOGUI=1 package
+
+# Uncomment below and comment line above to reuse existing wxWidgets build
+#gmake WXSTATIC=1 NOGUI=1 clean && gmake WXSTATIC=1 NOGUI=1 && gmake WXSTATIC=1 NOGUI=1 package
@@ -474,12 +474,12 @@ namespace VeraCrypt

 #endif // SETUP

-	File::File (wstring path, bool readOnly, bool create) : Elevated (false), FileOpen (false), ReadOnly (readOnly), LastError(0)
+	File::File (wstring path, bool readOnly, bool create, bool useNormalAttributes) : Elevated (false), FileOpen (false), ReadOnly (readOnly), LastError(0)
 	{
 		Handle = CreateFile (path.c_str(),
 			readOnly ? GENERIC_READ : GENERIC_READ | GENERIC_WRITE,
 			FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, create ? CREATE_ALWAYS : OPEN_EXISTING,
-			FILE_FLAG_RANDOM_ACCESS | FILE_FLAG_WRITE_THROUGH, NULL);
+			useNormalAttributes? FILE_ATTRIBUTE_NORMAL : (FILE_FLAG_RANDOM_ACCESS | FILE_FLAG_WRITE_THROUGH), NULL);

 		if (Handle != INVALID_HANDLE_VALUE)
 		{
@@ -2128,13 +2128,27 @@ namespace VeraCrypt
 		GetVolumeESP(pathESP);
 		if (szFilePath[0] != L'\\')
 			pathESP += L"\\";
-		File f(pathESP + szFilePath, false, true);
+
 		fileContent.resize(dwSize);
 		if (bAddUTF8BOM)
 			memcpy (fileContent.data(), "\xEF\xBB\xBF", 3);
 		memcpy (&fileContent[dwOffset], pbData, dwDataLen);
-		f.Write(fileContent.data(), dwSize);
-		f.Close();
+
+		try
+		{
+			File f(pathESP + szFilePath, false, true);
+			f.Write(fileContent.data(), dwSize);
+			f.Close();
+		}
+		catch (SystemException &e)
+		{
+			if (e.ErrorCode != ERROR_INVALID_PARAMETER)
+				throw;
+			// try again with normal attributes
+			File f(pathESP + szFilePath, false, true, true);
+			f.Write(fileContent.data(), dwSize);
+			f.Close();
+		}
 	}

 	EfiBoot::EfiBoot() {
@@ -2422,9 +2436,22 @@ namespace VeraCrypt
 	void EfiBoot::SaveFile(const wchar_t* name, byte* data, DWORD size) {
 		wstring path = EfiBootPartPath;
 		path += name;
-		File f(path, false, true);
-		f.Write(data, size);
-		f.Close();
+		try
+		{
+			File f(path, false, true);
+			f.Write(data, size);
+			f.Close();
+		}
+		catch (SystemException &e)
+		{
+			if (e.ErrorCode != ERROR_INVALID_PARAMETER)
+				throw;
+
+			// try again with normal attributes
+			File f(path, false, true, true);
+			f.Write(data, size);
+			f.Close();
+		}
 	}

 	void EfiBoot::GetFileSize(const wchar_t* name, unsigned __int64& size) {
@@ -37,7 +37,7 @@ namespace VeraCrypt
 	{
 	public:
 		File () : Elevated (false), FileOpen (false), ReadOnly (false), FilePointerPosition(0), Handle(INVALID_HANDLE_VALUE), IsDevice(false), LastError(0) { }
-		File (wstring path,bool readOnly = false, bool create = false);
+		File (wstring path,bool readOnly = false, bool create = false, bool useNormalAttributes = false);
 		virtual ~File () { Close(); }

 		void CheckOpened (const char* srcPos) { if (!FileOpen) { SetLastError (LastError); throw SystemException (srcPos);} }
@@ -555,6 +555,7 @@ IDR_EFI_DCSCFG          BIN                     "..\\Boot\\EFI\\DcsCfg.efi"
 IDR_EFI_LEGACYSPEAKER   BIN                     "..\\Boot\\EFI\\LegacySpeaker.efi"
 IDR_EFI_DCSBML         BIN                     "..\\Boot\\EFI\\DcsBml.efi"
 IDR_EFI_DCSRE          BIN                     "..\\Boot\\EFI\\DcsRe.efi"
+IDR_EFI_DCSINFO         BIN                     "..\\Boot\\EFI\\DcsInfo.efi"
 #ifndef WIN64
 IDR_EFI_DCSBOOT32         BIN                     "..\\Boot\\EFI\\DcsBoot32.efi"
 IDR_EFI_DCSINT32          BIN                     "..\\Boot\\EFI\\DcsInt32.efi"
@@ -562,7 +563,6 @@ IDR_EFI_DCSCFG32          BIN                     "..\\Boot\\EFI\\DcsCfg32.efi"
 IDR_EFI_LEGACYSPEAKER32   BIN                     "..\\Boot\\EFI\\LegacySpeaker32.efi"
 IDR_EFI_DCSBML32         BIN                     "..\\Boot\\EFI\\DcsBml32.efi"
 IDR_EFI_DCSRE32          BIN                     "..\\Boot\\EFI\\DcsRe32.efi"
-IDR_EFI_DCSINFO         BIN                     "..\\Boot\\EFI\\DcsInfo.efi"
 IDR_EFI_DCSINFO32         BIN                     "..\\Boot\\EFI\\DcsInfo32.efi"
 #endif
 /////////////////////////////////////////////////////////////////////////////
@@ -1156,20 +1156,20 @@ static BOOL HwEncryptionDisabled = FALSE;

 BOOL IsAesHwCpuSupported ()
 {
+#ifdef TC_WINDOWS_BOOT_AES
 	static BOOL state = FALSE;
 	static BOOL stateValid = FALSE;

 	if (!stateValid)
 	{
-#ifdef TC_WINDOWS_BOOT_AES
 		state = is_aes_hw_cpu_supported() ? TRUE : FALSE;
-#else
-		state = g_hasAESNI ? TRUE : FALSE;
-#endif
 		stateValid = TRUE;
 	}

 	return state && !HwEncryptionDisabled;
+#else
+	return (HasAESNI() && !HwEncryptionDisabled)? TRUE : FALSE;
+#endif
 }

 void EnableHwEncryption (BOOL enable)
@@ -389,6 +389,19 @@ typedef struct

 } MULTI_CHOICE_DLGPROC_PARAMS;

+void InitGlobalLocks ()
+{
+	InitializeCriticalSection (&csWNetCalls);
+	InitializeCriticalSection (&csMountableDevices);
+	InitializeCriticalSection (&csVolumeIdCandidates);
+}
+
+void FinalizeGlobalLocks ()
+{
+	DeleteCriticalSection (&csWNetCalls);
+	DeleteCriticalSection (&csMountableDevices);
+	DeleteCriticalSection (&csVolumeIdCandidates);
+}

 void cleanup ()
 {
@@ -468,9 +481,7 @@ void cleanup ()
 	EncryptionThreadPoolStop();
 #endif

-	DeleteCriticalSection (&csWNetCalls);
-	DeleteCriticalSection (&csMountableDevices);
-	DeleteCriticalSection (&csVolumeIdCandidates);
+	FinalizeGlobalLocks ();
 }


@@ -2694,9 +2705,7 @@ void InitApp (HINSTANCE hInstance, wchar_t *lpszCommandLine)

 	VirtualLock (&CmdTokenPin, sizeof (CmdTokenPin));

-	InitializeCriticalSection (&csWNetCalls);
-	InitializeCriticalSection (&csMountableDevices);
-	InitializeCriticalSection (&csVolumeIdCandidates);
+	InitGlobalLocks ();

 	LoadSystemDll (L"ntmarta.dll", &hntmartadll, TRUE, SRC_POS);
 	LoadSystemDll (L"MPR.DLL", &hmprdll, TRUE, SRC_POS);
@@ -4952,9 +4961,6 @@ wstring GetUserFriendlyVersionString (int version)

 	versionString.insert (version > 0xfff ? 2 : 1,L".");

-	if (versionString[versionString.length()-1] == L'0')
-		versionString.erase (versionString.length()-1, 1); 
-
 	return (versionString);
 }

@@ -5801,7 +5807,7 @@ BOOL CALLBACK BenchmarkDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lP

 			if (benchmarkType == BENCHMARK_TYPE_PRF)
 			{
-				benchmarkPim = GetPim (hwndDlg, IDC_PIM);
+				benchmarkPim = GetPim (hwndDlg, IDC_PIM, 0);
 				benchmarkPreBoot = GetCheckBox (hwndDlg, IDC_BENCHMARK_PREBOOT);
 			}
 			else
@@ -12100,10 +12106,11 @@ void UpdateMountableHostDeviceList ()
 							OPEN_EXISTING,
 							0,
 							NULL );
-						if (handle != INVALID_HANDLE_VALUE)
+						if ((handle != INVALID_HANDLE_VALUE) || (GetLastError () == ERROR_ACCESS_DENIED))
 						{
 							AddDeviceToList (mountableDevices, It->SystemNumber, layout->PartitionEntry[i].PartitionNumber);
-							CloseHandle (handle);
+							if (handle != INVALID_HANDLE_VALUE)
+								CloseHandle (handle);
 						}
 					}
 				}
@@ -12670,9 +12677,9 @@ std::wstring FindLatestFileOrDirectory (const std::wstring &directory, const wch
 	return wstring (directory) + L"\\" + name;
 }

-int GetPim (HWND hwndDlg, UINT ctrlId)
+int GetPim (HWND hwndDlg, UINT ctrlId, int defaultPim)
 {
-	int pim = 0;
+	int pim = defaultPim;
 	HWND hCtrl = GetDlgItem (hwndDlg, ctrlId);
 	if (IsWindowEnabled (hCtrl) && IsWindowVisible (hCtrl))
 	{
@@ -12682,7 +12689,7 @@ int GetPim (HWND hwndDlg, UINT ctrlId)
 			wchar_t* endPtr = NULL;
 			pim = wcstol(szTmp, &endPtr, 10);
 			if (pim < 0 || endPtr == szTmp || !endPtr || *endPtr != L'\0')
-				pim = 0;
+				pim = defaultPim;
 		}
 	}
 	return pim;
@@ -238,6 +238,8 @@ typedef struct
 #define	ISO_BURNER_TOOL L"isoburn.exe"
 #define PRINT_TOOL L"notepad.exe"

+void InitGlobalLocks ();
+void FinalizeGlobalLocks ();
 void cleanup ( void );
 void LowerCaseCopy ( wchar_t *lpszDest , const wchar_t *lpszSource );
 void UpperCaseCopy ( wchar_t *lpszDest , size_t cbDest, const wchar_t *lpszSource );
@@ -503,7 +505,7 @@ BOOL VolumePathExists (const wchar_t *volumePath);
 BOOL IsWindowsIsoBurnerAvailable ();
 BOOL LaunchWindowsIsoBurner (HWND hwnd, const wchar_t *isoPath);
 BOOL IsApplicationInstalled (const wchar_t *appName);
-int GetPim (HWND hwndDlg, UINT ctrlId);
+int GetPim (HWND hwndDlg, UINT ctrlId, int defaultPim);
 void SetPim (HWND hwndDlg, UINT ctrlId, int pim);
 BOOL GetPassword (HWND hwndDlg, UINT ctrlID, char* passValue, int bufSize, BOOL bShowError);
 void SetPassword (HWND hwndDlg, UINT ctrlID, char* passValue);
@@ -133,14 +133,15 @@ BOOL CheckPasswordCharEncoding (HWND hPassword, Password *ptrPw)
 }


-BOOL CheckPasswordLength (HWND hwndDlg, unsigned __int32 passwordLength, int pim, BOOL bForBoot, BOOL bSkipPasswordWarning, BOOL bSkipPimWarning)
+BOOL CheckPasswordLength (HWND hwndDlg, unsigned __int32 passwordLength, int pim, BOOL bForBoot, int bootPRF, BOOL bSkipPasswordWarning, BOOL bSkipPimWarning)
 {
-	BOOL bCustomPimSmall = ((pim != 0) && (pim < (bForBoot? 98 : 485)))? TRUE : FALSE;
+	BOOL bootPimCondition = (bForBoot && (bootPRF != SHA512 && bootPRF != WHIRLPOOL))? TRUE : FALSE;
+	BOOL bCustomPimSmall = ((pim != 0) && (pim < (bootPimCondition? 98 : 485)))? TRUE : FALSE;
 	if (passwordLength < PASSWORD_LEN_WARNING)
 	{
 		if (bCustomPimSmall)
 		{
-			Error (bForBoot? "BOOT_PIM_REQUIRE_LONG_PASSWORD": "PIM_REQUIRE_LONG_PASSWORD", hwndDlg);
+			Error (bootPimCondition? "BOOT_PIM_REQUIRE_LONG_PASSWORD": "PIM_REQUIRE_LONG_PASSWORD", hwndDlg);
 			return FALSE;
 		}

@@ -157,7 +158,7 @@ BOOL CheckPasswordLength (HWND hwndDlg, unsigned __int32 passwordLength, int pim
 	}
 #endif

-	if ((pim != 0) && (pim > (bForBoot? 98 : 485)))
+	if ((pim != 0) && (pim > (bootPimCondition? 98 : 485)))
 	{
 		// warn that mount/boot will take more time
 		Warning ("PIM_LARGE_WARNING", hwndDlg);
@@ -39,7 +39,7 @@ typedef struct
 #if defined(_WIN32) && !defined(TC_WINDOWS_DRIVER) && !defined(_UEFI)

 void VerifyPasswordAndUpdate ( HWND hwndDlg , HWND hButton , HWND hPassword , HWND hVerify , unsigned char *szPassword , char *szVerify, BOOL keyFilesEnabled );
-BOOL CheckPasswordLength (HWND hwndDlg, unsigned __int32 passwordLength, int pim, BOOL bForBoot, BOOL bSkipPasswordWarning, BOOL bSkipPimWarning);		
+BOOL CheckPasswordLength (HWND hwndDlg, unsigned __int32 passwordLength, int pim, BOOL bForBoot, int bootPRF, BOOL bSkipPasswordWarning, BOOL bSkipPimWarning);		
 BOOL CheckPasswordCharEncoding (HWND hPassword, Password *ptrPw);			
 int ChangePwd (const wchar_t *lpszVolume, Password *oldPassword, int old_pkcs5, int old_pim, BOOL truecryptMode, Password *newPassword, int pkcs5, int pim, int wipePassCount, HWND hwndDlg);

@@ -99,6 +99,18 @@ void hmac_sha256
 	char* buf = hmac.k;
 	int b;
 	char key[SHA256_DIGESTSIZE];
+#if defined (DEVICE_DRIVER)
+	NTSTATUS saveStatus = STATUS_INVALID_PARAMETER;
+#ifdef _WIN64
+	XSTATE_SAVE SaveState;
+	if (g_isIntel && HasSAVX())
+		saveStatus = KeSaveExtendedProcessorState(XSTATE_MASK_GSSE, &SaveState);
+#else
+	KFLOATING_SAVE floatingPointState;	
+	if (HasSSE2())
+		saveStatus = KeSaveFloatingPointState (&floatingPointState);
+#endif
+#endif
    /* If the key is longer than the hash algorithm block size,
 	   let key = sha256(key), as per HMAC specifications. */
 	if (lk > SHA256_BLOCKSIZE)
@@ -139,6 +151,16 @@ void hmac_sha256
 	sha256_hash ((unsigned char *) buf, SHA256_BLOCKSIZE, ctx);

 	hmac_sha256_internal(d, ld, &hmac);
+
+#if defined (DEVICE_DRIVER)
+	if (NT_SUCCESS (saveStatus))
+#ifdef _WIN64
+		KeRestoreExtendedProcessorState(&SaveState);
+#else
+		KeRestoreFloatingPointState (&floatingPointState);
+#endif
+#endif
+
 	/* Prevent leaks */
 	burn(&hmac, sizeof(hmac));
 	burn(key, sizeof(key));
@@ -204,6 +226,18 @@ void derive_key_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, uint32
 	int b, l, r;
 #ifndef TC_WINDOWS_BOOT
 	char key[SHA256_DIGESTSIZE];
+#if defined (DEVICE_DRIVER)
+	NTSTATUS saveStatus = STATUS_INVALID_PARAMETER;
+#ifdef _WIN64
+	XSTATE_SAVE SaveState;
+	if (g_isIntel && HasSAVX())
+		saveStatus = KeSaveExtendedProcessorState(XSTATE_MASK_GSSE, &SaveState);
+#else
+	KFLOATING_SAVE floatingPointState;	
+	if (HasSSE2())
+		saveStatus = KeSaveFloatingPointState (&floatingPointState);
+#endif
+#endif
    /* If the password is longer than the hash algorithm block size,
 	   let pwd = sha256(pwd), as per HMAC specifications. */
 	if (pwd_len > SHA256_BLOCKSIZE)
@@ -267,6 +301,14 @@ void derive_key_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, uint32
 	derive_u_sha256 (salt, salt_len, iterations, b, &hmac);
 	memcpy (dk, hmac.u, r);

+#if defined (DEVICE_DRIVER)
+	if (NT_SUCCESS (saveStatus))
+#ifdef _WIN64
+		KeRestoreExtendedProcessorState(&SaveState);
+#else
+		KeRestoreFloatingPointState (&floatingPointState);
+#endif
+#endif

 	/* Prevent possible leaks. */
 	burn (&hmac, sizeof(hmac));
@@ -327,11 +369,17 @@ void hmac_sha512
 	char* buf = hmac.k;
 	int b;
 	char key[SHA512_DIGESTSIZE];
-#if defined (DEVICE_DRIVER) && !defined (_WIN64)
-	KFLOATING_SAVE floatingPointState;
-	NTSTATUS saveStatus = STATUS_SUCCESS;
-	if (HasSSE2() && HasMMX())
+#if defined (DEVICE_DRIVER)
+	NTSTATUS saveStatus = STATUS_INVALID_PARAMETER;
+#ifdef _WIN64
+	XSTATE_SAVE SaveState;
+	if (g_isIntel && HasSAVX())
+		saveStatus = KeSaveExtendedProcessorState(XSTATE_MASK_GSSE, &SaveState);
+#else
+	KFLOATING_SAVE floatingPointState;	
+	if (HasSSSE3() && HasMMX())
 		saveStatus = KeSaveFloatingPointState (&floatingPointState);
+#endif
 #endif

    /* If the key is longer than the hash algorithm block size,
@@ -375,9 +423,13 @@ void hmac_sha512

 	hmac_sha512_internal (d, ld, &hmac);

-#if defined (DEVICE_DRIVER) && !defined (_WIN64)
-	if (NT_SUCCESS (saveStatus) && (HasSSE2() && HasMMX()))
+#if defined (DEVICE_DRIVER)
+	if (NT_SUCCESS (saveStatus))
+#ifdef _WIN64
+		KeRestoreExtendedProcessorState(&SaveState);
+#else
 		KeRestoreFloatingPointState (&floatingPointState);
+#endif
 #endif

 	/* Prevent leaks */
@@ -419,11 +471,17 @@ void derive_key_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, uint32
 	char* buf = hmac.k;
 	int b, l, r;
 	char key[SHA512_DIGESTSIZE];
-#if defined (DEVICE_DRIVER) && !defined (_WIN64)
-	KFLOATING_SAVE floatingPointState;
-	NTSTATUS saveStatus = STATUS_SUCCESS;
-	if (HasSSE2() && HasMMX())
+#if defined (DEVICE_DRIVER)
+	NTSTATUS saveStatus = STATUS_INVALID_PARAMETER;
+#ifdef _WIN64
+	XSTATE_SAVE SaveState;
+	if (g_isIntel && HasSAVX())
+		saveStatus = KeSaveExtendedProcessorState(XSTATE_MASK_GSSE, &SaveState);
+#else
+	KFLOATING_SAVE floatingPointState;	
+	if (HasSSSE3() && HasMMX())
 		saveStatus = KeSaveFloatingPointState (&floatingPointState);
+#endif
 #endif

    /* If the password is longer than the hash algorithm block size,
@@ -488,9 +546,13 @@ void derive_key_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, uint32
 	derive_u_sha512 (salt, salt_len, iterations, b, &hmac);
 	memcpy (dk, hmac.u, r);

-#if defined (DEVICE_DRIVER) && !defined (_WIN64)
-	if (NT_SUCCESS (saveStatus) && (HasSSE2() && HasMMX()))
+#if defined (DEVICE_DRIVER)
+	if (NT_SUCCESS (saveStatus))
+#ifdef _WIN64
+		KeRestoreExtendedProcessorState(&SaveState);
+#else
 		KeRestoreFloatingPointState (&floatingPointState);
+#endif
 #endif

 	/* Prevent possible leaks. */
@@ -771,7 +833,7 @@ void hmac_whirlpool
 	char key[WHIRLPOOL_DIGESTSIZE];
 #if defined (DEVICE_DRIVER) && !defined (_WIN64)
 	KFLOATING_SAVE floatingPointState;
-	NTSTATUS saveStatus = STATUS_SUCCESS;
+	NTSTATUS saveStatus = STATUS_INVALID_PARAMETER;
 	if (HasISSE())
 		saveStatus = KeSaveFloatingPointState (&floatingPointState);
 #endif
@@ -817,7 +879,7 @@ void hmac_whirlpool
 	hmac_whirlpool_internal(d, ld, &hmac);

 #if defined (DEVICE_DRIVER) && !defined (_WIN64)
-	if (NT_SUCCESS (saveStatus) && HasISSE())
+	if (NT_SUCCESS (saveStatus))
 		KeRestoreFloatingPointState (&floatingPointState);
 #endif
 	/* Prevent leaks */
@@ -859,7 +921,7 @@ void derive_key_whirlpool (char *pwd, int pwd_len, char *salt, int salt_len, uin
 	int b, l, r;
 #if defined (DEVICE_DRIVER) && !defined (_WIN64)
 	KFLOATING_SAVE floatingPointState;
-	NTSTATUS saveStatus = STATUS_SUCCESS;
+	NTSTATUS saveStatus = STATUS_INVALID_PARAMETER;
 	if (HasISSE())
 		saveStatus = KeSaveFloatingPointState (&floatingPointState);
 #endif
@@ -926,7 +988,7 @@ void derive_key_whirlpool (char *pwd, int pwd_len, char *salt, int salt_len, uin
 	memcpy (dk, hmac.u, r);

 #if defined (DEVICE_DRIVER) && !defined (_WIN64)
-	if (NT_SUCCESS (saveStatus) && HasISSE())
+	if (NT_SUCCESS (saveStatus))
 		KeRestoreFloatingPointState (&floatingPointState);
 #endif

@@ -986,7 +1048,7 @@ void hmac_streebog
 	CRYPTOPP_ALIGN_DATA(16) char key[STREEBOG_DIGESTSIZE];
 #if defined (DEVICE_DRIVER) && !defined (_WIN64)
 	KFLOATING_SAVE floatingPointState;
-	NTSTATUS saveStatus = STATUS_SUCCESS;
+	NTSTATUS saveStatus = STATUS_INVALID_PARAMETER;
 	if (HasSSE2() || HasSSE41())
 		saveStatus = KeSaveFloatingPointState (&floatingPointState);
 #endif
@@ -1032,7 +1094,7 @@ void hmac_streebog
 	hmac_streebog_internal(d, ld, &hmac);

 #if defined (DEVICE_DRIVER) && !defined (_WIN64)
-	if (NT_SUCCESS (saveStatus) && (HasSSE2() || HasSSE41()))
+	if (NT_SUCCESS (saveStatus))
 		KeRestoreFloatingPointState (&floatingPointState);
 #endif
 	/* Prevent leaks */
@@ -1074,7 +1136,7 @@ void derive_key_streebog (char *pwd, int pwd_len, char *salt, int salt_len, uint
 	int b, l, r;
 #if defined (DEVICE_DRIVER) && !defined (_WIN64)
 	KFLOATING_SAVE floatingPointState;
-	NTSTATUS saveStatus = STATUS_SUCCESS;
+	NTSTATUS saveStatus = STATUS_INVALID_PARAMETER;
 	if (HasSSE2() || HasSSE41())
 		saveStatus = KeSaveFloatingPointState (&floatingPointState);
 #endif
@@ -1141,7 +1203,7 @@ void derive_key_streebog (char *pwd, int pwd_len, char *salt, int salt_len, uint
 	memcpy (dk, hmac.u, r);

 #if defined (DEVICE_DRIVER) && !defined (_WIN64)
-	if (NT_SUCCESS (saveStatus) && (HasSSE2() || HasSSE41()))
+	if (NT_SUCCESS (saveStatus))
 		KeRestoreFloatingPointState (&floatingPointState);
 #endif

@@ -55,15 +55,15 @@ extern unsigned short _rotl16(unsigned short value, unsigned char shift);
 #define TC_APP_NAME						"VeraCrypt"

 // Version displayed to user 
-#define VERSION_STRING					"1.20"
+#define VERSION_STRING					"1.21"

 // Version number to compare against driver
-#define VERSION_NUM						0x0120
+#define VERSION_NUM						0x0121

 // Release date
-#define TC_STR_RELEASE_DATE			L"June 29, 2017"
+#define TC_STR_RELEASE_DATE			L"July 9, 2017"
 #define TC_RELEASE_DATE_YEAR			2017
-#define TC_RELEASE_DATE_MONTH			 06
+#define TC_RELEASE_DATE_MONTH			 07

 #define BYTES_PER_KB                    1024LL
 #define BYTES_PER_MB                    1048576LL
@@ -260,6 +260,26 @@ typedef int BOOL;
 #define FALSE !TRUE
 #endif

+typedef NTSTATUS (NTAPI *KeSaveExtendedProcessorStateFn) (
+    __in ULONG64 Mask,
+    PXSTATE_SAVE XStateSave
+    );
+
+
+typedef VOID (NTAPI *KeRestoreExtendedProcessorStateFn) (
+	PXSTATE_SAVE XStateSave
+	);
+
+extern NTSTATUS NTAPI KeSaveExtendedProcessorState (
+    __in ULONG64 Mask,
+    PXSTATE_SAVE XStateSave
+    );
+
+
+extern VOID NTAPI KeRestoreExtendedProcessorState (
+	PXSTATE_SAVE XStateSave
+	);
+
 #else				/* !TC_WINDOWS_DRIVER */
 #if !defined(_UEFI)
 #define TCalloc malloc
@@ -583,8 +583,8 @@ BOOL RunHashTest (HashFunction fn, HashTestVector* vector, BOOL bUseSSE)
 	BOOL bRet = TRUE;
 #if defined (DEVICE_DRIVER) && !defined (_WIN64)
 	KFLOATING_SAVE floatingPointState;
-	NTSTATUS saveStatus = STATUS_SUCCESS;
-	if (bUseSSE && (HasISSE() || HasSSE2()))
+	NTSTATUS saveStatus = STATUS_INVALID_PARAMETER;
+	if (bUseSSE)
 		saveStatus = KeSaveFloatingPointState (&floatingPointState);
 #endif
 	while (vector[i].hexInput && vector[i].hexOutput)
@@ -601,7 +601,7 @@ BOOL RunHashTest (HashFunction fn, HashTestVector* vector, BOOL bUseSSE)
 	}

 #if defined (DEVICE_DRIVER) && !defined (_WIN64)
-	if (NT_SUCCESS (saveStatus) && bUseSSE && (HasISSE() || HasSSE2()))
+	if (NT_SUCCESS (saveStatus))
 		KeRestoreFloatingPointState (&floatingPointState);
 #endif

@@ -1355,18 +1355,45 @@ BOOL AutoTestAlgorithms (void)
 {
 	BOOL result = TRUE;
 	BOOL hwEncryptionEnabled = IsHwEncryptionEnabled();
+#if defined (_MSC_VER) && !defined (_UEFI)
+	BOOL exceptionCatched = FALSE;
+	__try
+	{
+#endif
+		EnableHwEncryption (FALSE);

-	EnableHwEncryption (FALSE);
+		if (!DoAutoTestAlgorithms())
+			result = FALSE;

-	if (!DoAutoTestAlgorithms())
-		result = FALSE;
+		EnableHwEncryption (TRUE);

-	EnableHwEncryption (TRUE);
+		if (!DoAutoTestAlgorithms())
+			result = FALSE;

-	if (!DoAutoTestAlgorithms())
-		result = FALSE;
+		EnableHwEncryption (hwEncryptionEnabled);
+#if defined (_MSC_VER) && !defined (_UEFI)
+	}
+    __except (EXCEPTION_EXECUTE_HANDLER)
+	{
+		exceptionCatched = TRUE;
+	}

-	EnableHwEncryption (hwEncryptionEnabled);
+	if (exceptionCatched)
+	{
+		/* unexepected exception raised. Disable all CPU extended feature and try again */
+		EnableHwEncryption (hwEncryptionEnabled);
+		DisableCPUExtendedFeatures ();
+		__try
+		{
+			result = DoAutoTestAlgorithms();
+		}
+	    __except (EXCEPTION_EXECUTE_HANDLER)
+		{
+			/* exception still occuring. Report failure. */
+			result = FALSE;
+		}
+	}
+#endif
 	return result;
 }

@@ -1508,7 +1535,7 @@ BOOL test_pkcs5 ()
 		return FALSE;

 	/* STREEBOG hash tests */
-	if (RunHashTest (StreebogHash, Streebog512TestVectors, TRUE) == FALSE)
+	if (RunHashTest (StreebogHash, Streebog512TestVectors, (HasSSE2() || HasSSE41())? TRUE : FALSE) == FALSE)
 		return FALSE;

 	/* PKCS-5 test 1 with HMAC-SHA-256 used as the PRF (https://tools.ietf.org/html/draft-josefsson-scrypt-kdf-00) */
@@ -1096,15 +1096,24 @@ void camellia_decrypt(const unsigned __int8 *inBlock,  unsigned __int8 *outBlock
 void camellia_encrypt_blocks(unsigned __int8 *instance, const byte* in_blk, byte* out_blk, uint32 blockCount)
 {
 #if !defined (_UEFI)
-	if (IsCpuIntel() && IsAesHwCpuSupported () && HasSAVX()) /* on AMD cpu, AVX is too slow */
+	if ((blockCount >= 16) && IsCpuIntel() && IsAesHwCpuSupported () && HasSAVX()) /* on AMD cpu, AVX is too slow */
 	{
-		while (blockCount >= 16)
+#if defined (TC_WINDOWS_DRIVER)
+		XSTATE_SAVE SaveState;
+		if (NT_SUCCESS (KeSaveExtendedProcessorState(XSTATE_MASK_GSSE, &SaveState)))
 		{
-			camellia_ecb_enc_16way (instance, out_blk, in_blk);
-			out_blk += 16 * 16;
-			in_blk += 16 * 16;
-			blockCount -= 16;
+#endif
+			while (blockCount >= 16)
+			{
+				camellia_ecb_enc_16way (instance, out_blk, in_blk);
+				out_blk += 16 * 16;
+				in_blk += 16 * 16;
+				blockCount -= 16;
+			}
+#if defined (TC_WINDOWS_DRIVER)
+			KeRestoreExtendedProcessorState(&SaveState);
 		}
+#endif
 	}
 #endif

@@ -1123,8 +1132,13 @@ void camellia_encrypt_blocks(unsigned __int8 *instance, const byte* in_blk, byte
 void camellia_decrypt_blocks(unsigned __int8 *instance, const byte* in_blk, byte* out_blk, uint32 blockCount)
 {
 #if !defined (_UEFI)
-	if (IsCpuIntel() && IsAesHwCpuSupported () && HasSAVX()) /* on AMD cpu, AVX is too slow */
+	if ((blockCount >= 16) && IsCpuIntel() && IsAesHwCpuSupported () && HasSAVX()) /* on AMD cpu, AVX is too slow */
 	{
+#if defined (TC_WINDOWS_DRIVER)
+		XSTATE_SAVE SaveState;
+		if (NT_SUCCESS (KeSaveExtendedProcessorState(XSTATE_MASK_GSSE, &SaveState)))
+		{
+#endif
 		while (blockCount >= 16)
 		{
 			camellia_ecb_dec_16way (instance, out_blk, in_blk);
@@ -1132,6 +1146,10 @@ void camellia_decrypt_blocks(unsigned __int8 *instance, const byte* in_blk, byte
 			in_blk += 16 * 16;
 			blockCount -= 16;
 		}
+#if defined (TC_WINDOWS_DRIVER)
+			KeRestoreExtendedProcessorState(&SaveState);
+		}
+#endif
 	}
 #endif

@@ -128,8 +128,7 @@
      <AssemblerOutput>All</AssemblerOutput>
      <AssemblerListingLocation>$(IntDir)</AssemblerListingLocation>
      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>
-      </DebugInformationFormat>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
      <DisableSpecificWarnings>4100;4127;4201;%(DisableSpecificWarnings)</DisableSpecificWarnings>
    </ClCompile>
    <Lib>
@@ -152,8 +151,7 @@
      <AssemblerOutput>All</AssemblerOutput>
      <AssemblerListingLocation>$(IntDir)</AssemblerListingLocation>
      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>
-      </DebugInformationFormat>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
      <DisableSpecificWarnings>4100;4127;4201;%(DisableSpecificWarnings)</DisableSpecificWarnings>
    </ClCompile>
    <Lib>
@@ -96,7 +96,7 @@ void gost_set_key(const byte *key, gost_kds *ks, int useDynamicSbox)
 	    byte sbox_seed[64];
 #if defined (DEVICE_DRIVER) && !defined (_WIN64)
 	    KFLOATING_SAVE floatingPointState;
-	    NTSTATUS saveStatus = STATUS_SUCCESS;
+	    NTSTATUS saveStatus = STATUS_INVALID_PARAMETER;
 	    if (HasSSE2() || HasSSE41())
 		    saveStatus = KeSaveFloatingPointState (&floatingPointState);
 #endif
@@ -106,7 +106,7 @@ void gost_set_key(const byte *key, gost_kds *ks, int useDynamicSbox)
 	    STREEBOG_finalize(&sctx, sbox_seed);

 #if defined (DEVICE_DRIVER) && !defined (_WIN64)
-	    if (NT_SUCCESS (saveStatus) && (HasSSE2() || HasSSE41()))
+	    if (NT_SUCCESS (saveStatus))
 		    KeRestoreFloatingPointState (&floatingPointState);
 #endif

@@ -217,7 +217,11 @@ void sha512_begin(sha512_ctx* ctx)
 #endif

 #if CRYPTOPP_BOOL_X64 || ((CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32) && !defined (TC_MACOSX))
-		if (HasSSE2() && HasMMX())
+#if CRYPTOPP_BOOL_X64
+		if (HasSSE2())
+#else
+		if (HasSSSE3() && HasMMX())
+#endif
 				transfunc = SSE2Transform;
 		else
 #endif
@@ -480,8 +484,8 @@ static void CRYPTOPP_FASTCALL X86_SHA256_HashBlocks(uint_32t *state, const uint_
 	ASJ(	jnz,	2, f)
 	AS1(	dec		DWORD PTR K_END)
 #endif
-	AS2(	movdqa	xmm0, XMMWORD_PTR [WORD_REG(cx)+0*16])
-	AS2(	movdqa	xmm1, XMMWORD_PTR [WORD_REG(cx)+1*16])
+	AS2(	movdqu	xmm0, XMMWORD_PTR [WORD_REG(cx)+0*16])
+	AS2(	movdqu	xmm1, XMMWORD_PTR [WORD_REG(cx)+1*16])
 #endif

 #if CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32
@@ -501,8 +505,8 @@ INTEL_NOPREFIX

 #if CRYPTOPP_BOOL_SSE2_ASM_AVAILABLE
 	ASL(0)
-	AS2(	movdqa	E(0), xmm1)
-	AS2(	movdqa	A(0), xmm0)
+	AS2(	movdqu	E(0), xmm1)
+	AS2(	movdqu	A(0), xmm0)
 #endif
 #if CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32
 	ASL(3)
@@ -569,12 +573,12 @@ INTEL_NOPREFIX
 	AS2(	test	DWORD PTR K_END, 1)
 	ASJ(	jz,		4, f)
 #endif
-	AS2(	movdqa	xmm1, XMMWORD_PTR [AS_REG_7+1*16])
-	AS2(	movdqa	xmm0, XMMWORD_PTR [AS_REG_7+0*16])
+	AS2(	movdqu	xmm1, XMMWORD_PTR [AS_REG_7+1*16])
+	AS2(	movdqu	xmm0, XMMWORD_PTR [AS_REG_7+0*16])
 	AS2(	paddd	xmm1, E(0))
 	AS2(	paddd	xmm0, A(0))
-	AS2(	movdqa	[AS_REG_7+1*16], xmm1)
-	AS2(	movdqa	[AS_REG_7+0*16], xmm0)
+	AS2(	movdqu	[AS_REG_7+1*16], xmm1)
+	AS2(	movdqu	[AS_REG_7+0*16], xmm0)
 	AS2(	cmp		WORD_REG(dx), DATA_END)
 	ATT_NOPREFIX
 	ASJ(	jb,		0, b)
@@ -647,7 +647,7 @@ void WhirlpoolTransform(uint64 *digest, const uint64 *block)
 	{
 #ifdef __GNUC__
 	#if CRYPTOPP_BOOL_X64
-		uint64 workspace[16];
+		CRYPTOPP_ALIGN_DATA(16) uint64 workspace[16];
 	#endif
 	__asm__ __volatile__
 	(
@@ -200,10 +200,10 @@ static uint64 xgetbv()
 #endif
 }

-int g_x86DetectionDone = 0;
-int g_hasISSE = 0, g_hasSSE2 = 0, g_hasSSSE3 = 0, g_hasMMX = 0, g_hasAESNI = 0, g_hasCLMUL = 0, g_isP4 = 0;
-int g_hasAVX = 0, g_hasAVX2 = 0, g_hasBMI2 = 0, g_hasSSE42 = 0, g_hasSSE41 = 0, g_isIntel = 0, g_isAMD = 0;
-uint32 g_cacheLineSize = CRYPTOPP_L1_CACHE_LINE_SIZE;
+volatile int g_x86DetectionDone = 0;
+volatile int g_hasISSE = 0, g_hasSSE2 = 0, g_hasSSSE3 = 0, g_hasMMX = 0, g_hasAESNI = 0, g_hasCLMUL = 0, g_isP4 = 0;
+volatile int g_hasAVX = 0, g_hasAVX2 = 0, g_hasBMI2 = 0, g_hasSSE42 = 0, g_hasSSE41 = 0, g_isIntel = 0, g_isAMD = 0;
+volatile uint32 g_cacheLineSize = CRYPTOPP_L1_CACHE_LINE_SIZE;

 VC_INLINE int IsIntel(const uint32 output[4])
 {
@@ -305,7 +305,7 @@ void DetectX86Features()
 	g_hasMMX = (cpuid1[3] & (1 << 23)) != 0;
 	if ((cpuid1[3] & (1 << 26)) != 0)
 		g_hasSSE2 = TrySSE2();
-	if (g_hasSSE2 && (cpuid1[2] & (1 << 28)) && (cpuid1[2] & (1 << 27))) /* CPU has AVX and OS supports XSAVE/XRSTORE */
+	if (g_hasSSE2 && (cpuid1[2] & (1 << 28)) && (cpuid1[2] & (1 << 27)) && (cpuid1[2] & (1 << 26))) /* CPU has AVX and OS supports XSAVE/XRSTORE */
 	{
      uint64 xcrFeatureMask = xgetbv();
      g_hasAVX = (xcrFeatureMask & 0x6) == 0x6;
@@ -381,5 +381,23 @@ int is_aes_hw_cpu_supported ()
 	return bHasAESNI;
 }

+void DisableCPUExtendedFeatures ()
+{
+	g_hasSSE2 = 0;
+	g_hasISSE = 0;
+	g_hasMMX = 0;
+	g_hasSSE2 = 0;
+	g_hasISSE = 0;
+	g_hasMMX = 0;
+	g_hasAVX = 0;
+	g_hasAVX2 = 0;
+	g_hasBMI2 = 0;
+	g_hasSSE42 = 0;
+	g_hasSSE41 = 0;
+	g_hasSSSE3 = 0;
+	g_hasAESNI = 0;
+	g_hasCLMUL = 0;
+}
+
 #endif

@@ -186,38 +186,31 @@ extern "C" {
 #define CRYPTOPP_CPUID_AVAILABLE

 // these should not be used directly
-extern int g_x86DetectionDone;
-extern int g_hasAVX;
-extern int g_hasAVX2;
-extern int g_hasBMI2;
-extern int g_hasSSE42;
-extern int g_hasSSE41;
-extern int g_hasSSSE3;
-extern int g_hasAESNI;
-extern int g_hasCLMUL;
-extern int g_isP4;
-extern int g_isIntel;
-extern int g_isAMD;
-extern uint32 g_cacheLineSize;
+extern volatile int g_x86DetectionDone;
+extern volatile int g_hasSSE2;
+extern volatile int g_hasISSE;
+extern volatile int g_hasMMX;
+extern volatile int g_hasAVX;
+extern volatile int g_hasAVX2;
+extern volatile int g_hasBMI2;
+extern volatile int g_hasSSE42;
+extern volatile int g_hasSSE41;
+extern volatile int g_hasSSSE3;
+extern volatile int g_hasAESNI;
+extern volatile int g_hasCLMUL;
+extern volatile int g_isP4;
+extern volatile int g_isIntel;
+extern volatile int g_isAMD;
+extern volatile uint32 g_cacheLineSize;
 void DetectX86Features(); // must be called at the start of the program/driver
 int CpuId(uint32 input, uint32 *output);
-
-#if CRYPTOPP_BOOL_X64
-#define HasSSE2()	1
-#define HasISSE()	1
-#define HasMMX()	1
-#else
-
-extern int g_hasSSE2;
-extern int g_hasISSE;
-extern int g_hasMMX;
+// disable all CPU extended features (e.g. SSE, AVX, AES) that may have
+// been enabled by DetectX86Features.
+void DisableCPUExtendedFeatures (); 

 #define HasSSE2()	g_hasSSE2
 #define HasISSE()	g_hasISSE
 #define HasMMX()	g_hasMMX
-
-#endif
-
 #define HasSSE42() g_hasSSE42
 #define HasSSE41() g_hasSSE41
 #define HasSAVX() g_hasAVX
@@ -22,8 +22,9 @@
 */
 
 # Adapted for VeraCrypt
-# Adapt to Windows calling convention when building on Windows.
-# avoid using xmm6 register since it must be preserved on Windows. We use MMX registers instead.
+# Adapt to Windows build:
+#  - specific calling convention
+#  - avoid using xmm6 register since it must be preserved. We use the stack to save RBX, RDI and RSI


 /* void sha512_compress_nayuki(uint64_t state[8], const uint8_t block[128]) */
@@ -64,15 +65,19 @@ _sha512_compress_nayuki:
 movq %r13, %xmm3
 movq %r14, %xmm4
 movq %r15, %xmm5
- movq %rbx, %mm0
+
 .ifdef WINABI
- movq %rdi, %mm1
- movq %rsi, %mm2
+ subq $152, %rsp
+ movq %rbx, (0*8 + 128)(%rsp)
+ movq %rdi, (1*8 + 128)(%rsp)
+ movq %rsi, (2*8 + 128)(%rsp)
 movq %rcx, %rdi
 movq %rdx, %rsi
-.endif
+ .else
+ movq %rbx, %xmm6
 subq $128, %rsp
-
+.endif
+ 

 movq 0(%rdi), %r8
 movq 8(%rdi), %r9
@@ -182,16 +187,16 @@ _sha512_compress_nayuki:
 movq %xmm3, %r13
 movq %xmm4, %r14
 movq %xmm5, %r15
- movq %mm0, %rbx

 .ifdef WINABI
- movq %mm1, %rdi
- movq %mm2, %rsi
-.endif
-
- emms
-
+ movq (0*8 + 128)(%rsp), %rbx
+ movq (1*8 + 128)(%rsp), %rdi
+ movq (2*8 + 128)(%rsp), %rsi
+ addq $152, %rsp
+ .else
+ movq %xmm6, %rbx
 addq $128, %rsp
+.endif

 retq

@@ -327,10 +327,14 @@ static void ComputeBootLoaderFingerprint(PDEVICE_OBJECT LowerDeviceObject, byte*
 	status = TCReadDevice (LowerDeviceObject, ioBuffer, offset, TC_SECTOR_SIZE_BIOS);
 	if (NT_SUCCESS (status))
 	{
-#if !defined (_WIN64)
-		KFLOATING_SAVE floatingPointState;
-		NTSTATUS saveStatus = STATUS_SUCCESS;
-		if (HasISSE()|| (HasSSE2() && HasMMX()))
+		NTSTATUS saveStatus = STATUS_INVALID_PARAMETER;
+#ifdef _WIN64
+		XSTATE_SAVE SaveState;
+		if (g_isIntel && HasSAVX())
+			saveStatus = KeSaveExtendedProcessorState(XSTATE_MASK_GSSE, &SaveState);
+#else
+		KFLOATING_SAVE floatingPointState;		
+		if (HasISSE() || (HasSSSE3() && HasMMX()))
 			saveStatus = KeSaveFloatingPointState (&floatingPointState);
 #endif
 		WHIRLPOOL_add (ioBuffer, TC_BOOT_SECTOR_PIM_VALUE_OFFSET, &whirlpool);
@@ -367,8 +371,10 @@ static void ComputeBootLoaderFingerprint(PDEVICE_OBJECT LowerDeviceObject, byte*
 			sha512_end (&BootLoaderFingerprint [WHIRLPOOL_DIGESTSIZE], &sha2);
 		}

-#if !defined (_WIN64)
-		if (NT_SUCCESS (saveStatus) && (HasISSE() || (HasSSE2() && HasMMX())))
+		if (NT_SUCCESS (saveStatus))
+#ifdef _WIN64
+			KeRestoreExtendedProcessorState(&SaveState);
+#else
 			KeRestoreFloatingPointState (&floatingPointState);
 #endif
 	}
@@ -27,8 +27,8 @@ LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
 //

 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,20,3,4
- PRODUCTVERSION 1,20,3,4
+ FILEVERSION 1,21,5,0
+ PRODUCTVERSION 1,21,5,0
 FILEFLAGSMASK 0x17L
 #ifdef _DEBUG
 FILEFLAGS 0x1L
@@ -45,11 +45,11 @@ BEGIN
        BEGIN
            VALUE "CompanyName", "IDRIX"
            VALUE "FileDescription", "VeraCrypt Driver"
-            VALUE "FileVersion", "1.20"
+            VALUE "FileVersion", "1.21"
            VALUE "LegalTrademarks", "VeraCrypt"
            VALUE "OriginalFilename", "veracrypt.sys"
            VALUE "ProductName", "VeraCrypt"
-            VALUE "ProductVersion", "1.20"
+            VALUE "ProductVersion", "1.21"
        END
    END
    BLOCK "VarFileInfo"
@@ -14,6 +14,7 @@
 #include "DriveFilter.h"
 #include "Ntdriver.h"
 #include "Tests.h"
+#include "cpu.h"

 static DriveFilterExtension *BootDriveFilterExtension = NULL;
 static LARGE_INTEGER DumpPartitionOffset;
@@ -63,7 +64,11 @@ NTSTATUS DumpFilterEntry (PFILTER_EXTENSION filterExtension, PFILTER_INITIALIZAT
 	// KeSaveFloatingPointState() may generate a bug check during crash dump
 #if !defined (_WIN64)
 	if (filterExtension->DumpType == DumpTypeCrashdump)
+	{
 		dumpConfig.HwEncryptionEnabled = FALSE;
+		// disable also CPU extended features used in optimizations
+		DisableCPUExtendedFeatures ();
+	}
 #endif

 	EnableHwEncryption (dumpConfig.HwEncryptionEnabled);
@@ -73,6 +73,11 @@
 #pragma alloc_text(INIT,DriverEntry)
 #pragma alloc_text(INIT,TCCreateRootDeviceObject)

+/* We need to silence 'type cast' warning in order to use MmGetSystemRoutineAddress.
+ * MmGetSystemRoutineAddress() should have been declare FARPROC instead of PVOID.
+ */
+#pragma warning(disable:4055)
+
 PDRIVER_OBJECT TCDriverObject;
 PDEVICE_OBJECT RootDeviceObject = NULL;
 static KMUTEX RootDeviceControlMutex;
@@ -91,6 +96,8 @@ static size_t EncryptionThreadPoolFreeCpuCountLimit = 0;
 static BOOL SystemFavoriteVolumeDirty = FALSE;
 static BOOL PagingFileCreationPrevented = FALSE;
 static BOOL EnableExtendedIoctlSupport = FALSE;
+static KeSaveExtendedProcessorStateFn KeSaveExtendedProcessorStatePtr = NULL;
+static KeRestoreExtendedProcessorStateFn KeRestoreExtendedProcessorStatePtr = NULL;

 POOL_TYPE ExDefaultNonPagedPoolType = NonPagedPool;
 ULONG ExDefaultMdlProtection = 0;
@@ -119,6 +126,16 @@ NTSTATUS DriverEntry (PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
 		ExDefaultMdlProtection = MdlMappingNoExecute;
 	}

+	// KeSaveExtendedProcessorState/KeRestoreExtendedProcessorState are available starting from Windows 7
+	if ((OsMajorVersion > 6) || (OsMajorVersion == 6 && OsMinorVersion >= 1))
+	{
+		UNICODE_STRING saveFuncName, restoreFuncName;
+		RtlInitUnicodeString(&saveFuncName, L"KeSaveExtendedProcessorState");
+		RtlInitUnicodeString(&restoreFuncName, L"KeRestoreExtendedProcessorState");
+		KeSaveExtendedProcessorStatePtr = (KeSaveExtendedProcessorStateFn) MmGetSystemRoutineAddress(&saveFuncName);
+		KeRestoreExtendedProcessorStatePtr = (KeRestoreExtendedProcessorStateFn) MmGetSystemRoutineAddress(&restoreFuncName);
+	}
+
 	// Load dump filter if the main driver is already loaded
 	if (NT_SUCCESS (TCDeviceIoControl (NT_ROOT_PREFIX, TC_IOCTL_GET_DRIVER_VERSION, NULL, 0, &version, sizeof (version))))
 		return DumpFilterEntry ((PFILTER_EXTENSION) DriverObject, (PFILTER_INITIALIZATION_DATA) RegistryPath);
@@ -137,7 +154,16 @@ NTSTATUS DriverEntry (PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
 		if (startKeyValue->Type == REG_DWORD && *((uint32 *) startKeyValue->Data) == SERVICE_BOOT_START)
 		{
 			if (!SelfTestsPassed)
-				TC_BUG_CHECK (STATUS_INVALID_PARAMETER);
+			{
+				// in case of system encryption, if self-tests fail, disable all extended CPU
+				// features and try again in order to workaround faulty configurations
+				DisableCPUExtendedFeatures ();
+				SelfTestsPassed = AutoTestAlgorithms();
+
+				// BUG CHECK if the self-tests still fail
+				if (!SelfTestsPassed)
+					TC_BUG_CHECK (STATUS_INVALID_PARAMETER);
+			}

 			LoadBootArguments();
 			VolumeClassFilterRegistered = IsVolumeClassFilterRegistered();
@@ -3960,3 +3986,28 @@ BOOL IsOSAtLeast (OSVersionEnum reqMinOS)
 	return ((OsMajorVersion << 16 | OsMinorVersion << 8)
 		>= (major << 16 | minor << 8));
 }
+
+NTSTATUS NTAPI KeSaveExtendedProcessorState (
+    __in ULONG64 Mask,
+    PXSTATE_SAVE XStateSave
+    )
+{
+	if (KeSaveExtendedProcessorStatePtr)
+	{
+		return (KeSaveExtendedProcessorStatePtr) (Mask, XStateSave);
+	}
+	else
+	{
+		return STATUS_SUCCESS;
+	}
+}
+
+VOID NTAPI KeRestoreExtendedProcessorState (
+	PXSTATE_SAVE XStateSave
+	)
+{
+	if (KeRestoreExtendedProcessorStatePtr)
+	{
+		(KeRestoreExtendedProcessorStatePtr) (XStateSave);
+	}
+}
@@ -192,8 +192,8 @@ IDR_MOUNT_RSRC_HEADER   HEADER                  "resource.h"
 //

 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,20,3,4
- PRODUCTVERSION 1,20,3,4
+ FILEVERSION 1,21,5,0
+ PRODUCTVERSION 1,21,5,0
 FILEFLAGSMASK 0x17L
 #ifdef _DEBUG
 FILEFLAGS 0x1L
@@ -210,11 +210,11 @@ BEGIN
        BEGIN
            VALUE "CompanyName", "IDRIX"
            VALUE "FileDescription", "VeraCrypt Expander"
-            VALUE "FileVersion", "1.20"
+            VALUE "FileVersion", "1.21"
            VALUE "LegalTrademarks", "VeraCrypt"
            VALUE "OriginalFilename", "VeraCryptExpander.exe"
            VALUE "ProductName", "VeraCrypt"
-            VALUE "ProductVersion", "1.20"
+            VALUE "ProductVersion", "1.21"
        END
    END
    BLOCK "VarFileInfo"
@@ -216,8 +216,7 @@ copy $(TargetPath) "..\Debug\Setup Files\VeraCryptExpander-x64.exe" &gt;NUL:
      <AssemblerOutput>All</AssemblerOutput>
      <AssemblerListingLocation>$(IntDir)</AssemblerListingLocation>
      <WarningLevel>Level3</WarningLevel>
-      <DebugInformationFormat>
-      </DebugInformationFormat>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
      <DisableSpecificWarnings>4311;4131;%(DisableSpecificWarnings)</DisableSpecificWarnings>
    </ClCompile>
    <Link>
@@ -225,7 +224,7 @@ copy $(TargetPath) "..\Debug\Setup Files\VeraCryptExpander-x64.exe" &gt;NUL:
      <OutputFile>$(OutDir)VeraCryptExpander.exe</OutputFile>
      <IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
      <DelayLoadDLLs>mpr.dll;%(DelayLoadDLLs)</DelayLoadDLLs>
-      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
      <GenerateMapFile>true</GenerateMapFile>
      <SubSystem>Windows</SubSystem>
      <OptimizeReferences>true</OptimizeReferences>
@@ -262,8 +261,7 @@ copy $(TargetPath) "..\Debug\Setup Files\VeraCryptExpander-x64.exe" &gt;NUL:
      <AssemblerOutput>All</AssemblerOutput>
      <AssemblerListingLocation>$(IntDir)</AssemblerListingLocation>
      <WarningLevel>Level3</WarningLevel>
-      <DebugInformationFormat>
-      </DebugInformationFormat>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
      <DisableSpecificWarnings>4311;4131;%(DisableSpecificWarnings)</DisableSpecificWarnings>
    </ClCompile>
    <Link>
@@ -271,7 +269,7 @@ copy $(TargetPath) "..\Debug\Setup Files\VeraCryptExpander-x64.exe" &gt;NUL:
      <OutputFile>$(OutDir)VeraCryptExpander.exe</OutputFile>
      <IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
      <DelayLoadDLLs>mpr.dll;%(DelayLoadDLLs)</DelayLoadDLLs>
-      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
      <GenerateMapFile>true</GenerateMapFile>
      <SubSystem>Windows</SubSystem>
      <OptimizeReferences>true</OptimizeReferences>
@@ -685,7 +685,7 @@ BOOL CALLBACK ExtcvPasswordDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARA
 				*pkcs5 = (int) SendMessage (GetDlgItem (hwndDlg, IDC_PKCS5_PRF_ID), CB_GETITEMDATA, SendMessage (GetDlgItem (hwndDlg, IDC_PKCS5_PRF_ID), CB_GETCURSEL, 0, 0), 0);
 				*truecryptMode = GetCheckBox (hwndDlg, IDC_TRUECRYPT_MODE);

-				*pim = GetPim (hwndDlg, IDC_PIM);
+				*pim = GetPim (hwndDlg, IDC_PIM, 0);

 				/* check that PRF is supported in TrueCrypt Mode */
 				if (	(*truecryptMode)
@@ -28,8 +28,8 @@ LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
 //

 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,20,3,4
- PRODUCTVERSION 1,20,3,4
+ FILEVERSION 1,21,5,0
+ PRODUCTVERSION 1,21,5,0
 FILEFLAGSMASK 0x17L
 #ifdef _DEBUG
 FILEFLAGS 0x1L
@@ -46,11 +46,11 @@ BEGIN
        BEGIN
            VALUE "CompanyName", "IDRIX"
            VALUE "FileDescription", "VeraCrypt Format"
-            VALUE "FileVersion", "1.20"
+            VALUE "FileVersion", "1.21"
            VALUE "LegalTrademarks", "VeraCrypt"
            VALUE "OriginalFilename", "VeraCrypt Format.exe"
            VALUE "ProductName", "VeraCrypt"
-            VALUE "ProductVersion", "1.20"
+            VALUE "ProductVersion", "1.21"
        END
    END
    BLOCK "VarFileInfo"
@@ -226,8 +226,7 @@ copy $(TargetPath) "..\Debug\Setup Files\VeraCrypt Format-x64.exe" &gt;NUL:
      <AssemblerOutput>All</AssemblerOutput>
      <AssemblerListingLocation>$(IntDir)</AssemblerListingLocation>
      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>
-      </DebugInformationFormat>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
      <DisableSpecificWarnings>4057;4100;4127;4201;4204;4701;4706;4131;%(DisableSpecificWarnings)</DisableSpecificWarnings>
    </ClCompile>
    <Link>
@@ -235,7 +234,7 @@ copy $(TargetPath) "..\Debug\Setup Files\VeraCrypt Format-x64.exe" &gt;NUL:
      <OutputFile>$(OutDir)VeraCryptFormat.exe</OutputFile>
      <IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
      <DelayLoadDLLs>mpr.dll;%(DelayLoadDLLs)</DelayLoadDLLs>
-      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
      <GenerateMapFile>true</GenerateMapFile>
      <SubSystem>Windows</SubSystem>
      <OptimizeReferences>true</OptimizeReferences>
@@ -4404,7 +4404,7 @@ BOOL CALLBACK PageDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa

 				SetFocus (GetDlgItem (hwndDlg, IDC_PIM));

-				SetWindowTextW (GetDlgItem (hwndDlg, IDC_BOX_HELP), GetString (SysEncInEffect ()? "PIM_SYSENC_HELP" : "PIM_HELP"));
+				SetWindowTextW (GetDlgItem (hwndDlg, IDC_BOX_HELP), GetString (SysEncInEffect () && hash_algo != SHA512 && hash_algo != WHIRLPOOL? "PIM_SYSENC_HELP" : "PIM_HELP"));

 				ToHyperlink (hwndDlg, IDC_LINK_PIM_INFO);

@@ -5611,7 +5611,7 @@ BOOL CALLBACK PageDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 		{
 			if (lw == IDC_PIM)
 			{
-				if(GetPim (hwndDlg, IDC_PIM) != 0)
+				if(GetPim (hwndDlg, IDC_PIM, 0) != 0)
 				{
 					PimValueChangedWarning = TRUE;
 					SetDlgItemTextW (hwndDlg, IDC_PIM_HELP, GetString (SysEncInEffect ()? "PIM_SYSENC_CHANGE_WARNING" : "PIM_CHANGE_WARNING"));
@@ -6238,7 +6238,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 				if (volumePassword.Length > 0)
 				{
 					// Check password length (check also done for outer volume which is not the case in TrueCrypt).
-					if (!CheckPasswordLength (NULL, volumePassword.Length, volumePim, FALSE, Silent, Silent))
+					if (!CheckPasswordLength (NULL, volumePassword.Length, volumePim, FALSE, 0, Silent, Silent))
 					{
 						exit (1);
 					}
@@ -7514,7 +7514,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 						return 1;
 					}
 					// Check password length (check also done for outer volume which is not the case in TrueCrypt).
-					else if (!CheckPasswordLength (hwndDlg, volumePassword.Length, 0, SysEncInEffect(), FALSE, FALSE))
+					else if (!CheckPasswordLength (hwndDlg, volumePassword.Length, 0, SysEncInEffect(), SysEncInEffect()? hash_algo : 0, FALSE, FALSE))
 					{
 						return 1;
 					}
@@ -7582,7 +7582,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa

 			else if (nCurPageNo == PIM_PAGE)
 			{
-				volumePim = GetPim (hCurPage, IDC_PIM);
+				volumePim = GetPim (hCurPage, IDC_PIM, 0);

 				if (!SysEncInEffect() && (volumePim > MAX_PIM_VALUE))
 				{
@@ -7601,7 +7601,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 						return 1;
 					}
 					// Check password length (check also done for outer volume which is not the case in TrueCrypt).
-					else if (!CheckPasswordLength (hwndDlg, volumePassword.Length, volumePim, SysEncInEffect(), TRUE, FALSE))
+					else if (!CheckPasswordLength (hwndDlg, volumePassword.Length, volumePim, SysEncInEffect(), SysEncInEffect()? hash_algo : 0, TRUE, FALSE))
 					{
 						return 1;
 					}
@@ -7639,7 +7639,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa

 				hash_algo = (int) SendMessage (GetDlgItem (hCurPage, IDC_PKCS5_PRF_ID), CB_GETITEMDATA, SendMessage (GetDlgItem (hCurPage, IDC_PKCS5_PRF_ID), CB_GETCURSEL, 0, 0), 0);

-				volumePim = GetPim (hCurPage, IDC_PIM);
+				volumePim = GetPim (hCurPage, IDC_PIM, 0);

 				// Store the password in case we need to restore it after keyfile is applied to it
 				if (!GetPassword (hCurPage, IDC_PASSWORD_DIRECT, szRawPassword, sizeof (szRawPassword), TRUE))
@@ -8764,7 +8764,7 @@ ovf_end:

 			else if (nCurPageNo == PIM_PAGE)
 			{
-				volumePim = GetPim (hCurPage, IDC_PIM);
+				volumePim = GetPim (hCurPage, IDC_PIM, 0);
 			}

 			else if (nCurPageNo == HIDDEN_VOL_HOST_PASSWORD_PAGE
@@ -133,6 +133,25 @@ INSTALLER_NAME := veracrypt-$(TC_VERSION)-setup-$(INSTALLER_TYPE)-$(CPU_ARCH)
 endif
 #-----------------------------------

+#------ FreeBSD package naming ------
+ifeq "$(PLATFORM)" "FreeBSD"
+
+SYSTEMNAME = $(shell uname -n)
+
+ifdef TC_NO_GUI
+INSTALLER_TYPE := console
+PACKAGE_NAME := $(APPNAME)_$(TC_VERSION)_$(SYSTEMNAME)_console_$(PLATFORM_ARCH).tar.gz
+else
+INSTALLER_TYPE := gui
+PACKAGE_NAME := $(APPNAME)_$(TC_VERSION)_$(SYSTEMNAME)_$(PLATFORM_ARCH).tar.gz
+endif
+
+INTERNAL_INSTALLER_NAME := veracrypt_install_f$(SYSTEMNAME)_$(INSTALLER_TYPE)_$(CPU_ARCH).sh
+INSTALLER_NAME := veracrypt-$(TC_VERSION)-$(SYSTEMNAME)-setup-$(INSTALLER_TYPE)-$(CPU_ARCH)
+
+endif
+#-----------------------------------
+
 $(APPNAME): $(LIBS) $(OBJS)
 	@echo Linking $@
 	$(CXX) -o $(APPNAME) $(OBJS) $(LIBS) $(FUSE_LIBS) $(WX_LIBS) $(LFLAGS)
@@ -204,6 +223,7 @@ endif

 ifeq "$(PLATFORM)" "Linux"
 prepare: $(APPNAME)
+	rm -fr $(PWD)/Setup/Linux/usr
 	mkdir -p $(PWD)/Setup/Linux/usr/bin
 	mkdir -p $(PWD)/Setup/Linux/usr/share/$(APPNAME)/doc/HTML
 	cp $(PWD)/Main/$(APPNAME) $(PWD)/Setup/Linux/usr/bin/$(APPNAME)
@@ -221,7 +241,7 @@ endif


 install: prepare
-	cp -R $(PWD)/Setup/Linux/usr /.
+	cp -R $(CURDIR)/Setup/Linux/usr $(DESTDIR)/.

 ifeq "$(TC_BUILD_CONFIG)" "Release"
 package: prepare
@@ -249,19 +269,50 @@ endif
 endif

 ifeq "$(PLATFORM)" "FreeBSD"
-install: $(APPNAME)
-	mkdir -p /usr/share/$(APPNAME)/doc/HTML
-	cp $(PWD)/Main/$(APPNAME) /usr/bin/$(APPNAME)
-	cp $(PWD)/Setup/Linux/$(APPNAME)-uninstall.sh /usr/bin/$(APPNAME)-uninstall.sh
-	chmod +x /usr/bin/$(APPNAME)-uninstall.sh
-	cp $(PWD)/License.txt /usr/share/$(APPNAME)/doc/License.txt
-	cp $(PWD)/../doc/html/* "/usr/share/$(APPNAME)/doc/HTML"
+prepare: $(APPNAME)
+	rm -fr $(PWD)/Setup/FreeBSD/usr
+	mkdir -p $(PWD)/Setup/FreeBSD/usr/bin
+	mkdir -p $(PWD)/Setup/FreeBSD/usr/share/$(APPNAME)/doc/HTML
+	cp $(PWD)/Main/$(APPNAME) $(PWD)/Setup/FreeBSD/usr/bin/$(APPNAME)
+	cp $(PWD)/Setup/Linux/$(APPNAME)-uninstall.sh $(PWD)/Setup/FreeBSD/usr/bin/$(APPNAME)-uninstall.sh
+	chmod +x $(PWD)/Setup/FreeBSD/usr/bin/$(APPNAME)-uninstall.sh
+	cp $(PWD)/License.txt $(PWD)/Setup/FreeBSD/usr/share/$(APPNAME)/doc/License.txt
+	cp $(PWD)/../doc/html/* "$(PWD)/Setup/FreeBSD/usr/share/$(APPNAME)/doc/HTML"

 ifndef TC_NO_GUI
-	mkdir -p /usr/share/applications
-	mkdir -p /usr/share/pixmaps
-	cp $(PWD)/Resources/Icons/VeraCrypt-256x256.xpm /usr/share/pixmaps/$(APPNAME).xpm
-	cp $(PWD)/Setup/Linux/$(APPNAME).desktop /usr/share/applications/$(APPNAME).desktop
+	mkdir -p $(PWD)/Setup/FreeBSD/usr/share/applications
+	mkdir -p $(PWD)/Setup/FreeBSD/usr/share/pixmaps
+	cp $(PWD)/Resources/Icons/VeraCrypt-256x256.xpm $(PWD)/Setup/FreeBSD/usr/share/pixmaps/$(APPNAME).xpm
+	cp $(PWD)/Setup/Linux/$(APPNAME).desktop $(PWD)/Setup/FreeBSD/usr/share/applications/$(APPNAME).desktop
+endif
+	chown -R root:wheel $(PWD)/Setup/FreeBSD/usr
+	chmod -R go-w $(PWD)/Setup/FreeBSD/usr
+
+
+install: prepare
+	cp -R $(CURDIR)/Setup/FreeBSD/usr $(DESTDIR)/.
+
+ifeq "$(TC_BUILD_CONFIG)" "Release"
+package: prepare
+	tar cfz $(PWD)/Setup/FreeBSD/$(PACKAGE_NAME) --directory $(PWD)/Setup/FreeBSD usr
+
+	@rm -fr $(INTERNAL_INSTALLER_NAME)
+	@echo "#!/bin/sh" > $(INTERNAL_INSTALLER_NAME)
+	@echo "VERSION=$(TC_VERSION)" >> $(INTERNAL_INSTALLER_NAME)
+	@echo "PACKAGE_TYPE=tar" >> $(INTERNAL_INSTALLER_NAME)
+	@echo "PACKAGE_NAME=$(PACKAGE_NAME)" >> $(INTERNAL_INSTALLER_NAME)
+	@echo "PACKAGE_START=1107" >> $(INTERNAL_INSTALLER_NAME)
+	@echo "INSTALLER_TYPE=$(INSTALLER_TYPE)" >> $(INTERNAL_INSTALLER_NAME)
+
+	@cat $(PWD)/Setup/FreeBSD/veracrypt_install_template.sh >> $(INTERNAL_INSTALLER_NAME)
+	@cat $(PWD)/Setup/FreeBSD/$(PACKAGE_NAME) >> $(INTERNAL_INSTALLER_NAME)
+	chmod +x $(INTERNAL_INSTALLER_NAME)
+
+	rm -fr $(PWD)/Setup/FreeBSD/packaging
+	mkdir -p $(PWD)/Setup/FreeBSD/packaging
+	cp $(INTERNAL_INSTALLER_NAME) $(PWD)/Setup/FreeBSD/packaging/.
+	makeself $(PWD)/Setup/FreeBSD/packaging $(PWD)/Setup/FreeBSD/$(INSTALLER_NAME) "VeraCrypt $(TC_VERSION) $(SYSTEMNAME) Installer" ./$(INTERNAL_INSTALLER_NAME)
+
 endif

 endif
@@ -287,6 +287,18 @@ ifeq "$(shell uname -s)" "FreeBSD"
 	
 	CC := cc
 	CXX := c++
+	
+	ifeq "$(TC_BUILD_CONFIG)" "Release"
+		C_CXX_FLAGS += -fdata-sections -ffunction-sections -fpie
+		LFLAGS += -Wl,--gc-sections -pie
+
+		ifneq "$(shell ld --help 2>&1 | grep sysv | wc -l)" "0"
+			LFLAGS += -Wl,--hash-style=sysv
+		endif
+
+		WXCONFIG_CFLAGS += -fpie -fPIC
+		WXCONFIG_CXXFLAGS += -fpie -fPIC
+	endif

 	ifeq "$(SIMD_SUPPORTED)" "1"
 		CFLAGS += -msse2 -maes
@@ -391,7 +391,7 @@ namespace VeraCrypt
 			case IDC_PIM:
 				if (hw == EN_CHANGE)
 				{
-					int pim = GetPim (hwndDlg, IDC_PIM);
+					int pim = GetPim (hwndDlg, IDC_PIM, -1);
 					if (pim > (SystemFavoritesMode? MAX_BOOT_PIM_VALUE: MAX_PIM_VALUE))
 					{
 						SetDlgItemText (hwndDlg, IDC_PIM, L"");
@@ -618,9 +618,14 @@ namespace VeraCrypt
 				/* support old attribute name before it was changed to PIM*/
 				XmlGetAttributeText (xml, "pin", label, sizeof (label));
 			}
-			favorite.Pim = strtol (label, NULL, 10);
-			if (favorite.Pim < 0 || favorite.Pim > (systemFavorites? MAX_BOOT_PIM_VALUE : MAX_PIM_VALUE))
-				favorite.Pim = 0;
+			if (label[0])
+			{
+				favorite.Pim = strtol (label, NULL, 10);
+				if (favorite.Pim < 0 || favorite.Pim > (systemFavorites? MAX_BOOT_PIM_VALUE : MAX_PIM_VALUE))
+					favorite.Pim = -1;
+			}
+			else
+				favorite.Pim = -1;

 			char boolVal[2];
 			XmlGetAttributeText (xml, "readonly", boolVal, sizeof (boolVal));
@@ -678,7 +683,7 @@ namespace VeraCrypt
 			else
 				favorite.TrueCryptMode = -1;
 			
-			if (favorite.TrueCryptMode)
+			if (favorite.TrueCryptMode > 0)
 				favorite.Pim = 0;

 			XmlGetAttributeText (xml, "pkcs5", label, sizeof (label));
@@ -786,7 +791,7 @@ namespace VeraCrypt
 			if (!favorite.Label.empty())
 				s += L" label=\"" + favorite.Label + L"\"";

-			if (favorite.Pim > 0)
+			if ((favorite.Pim >= 0) && (favorite.TrueCryptMode <= 0))
 				s += L" pim=\"" + IntToWideString(favorite.Pim) + L"\"";

 			if (favorite.Pkcs5 > 0)
@@ -1029,7 +1034,7 @@ namespace VeraCrypt
 		else
 			favorite.Label.clear();

-		favorite.Pim = GetPim (hwndDlg, IDC_PIM);
+		favorite.Pim = GetPim (hwndDlg, IDC_PIM, -1);
 		favorite.UseLabelInExplorer = (IsDlgButtonChecked (hwndDlg, IDC_FAVORITE_USE_LABEL_IN_EXPLORER) != 0);
 		favorite.UseVolumeID = (IsDlgButtonChecked (hwndDlg, IDC_FAVORITE_USE_VOLUME_ID) != 0);
 		int nSelected = (int) SendMessage (GetDlgItem (hwndDlg, IDC_PKCS5_PRF_ID), CB_GETCURSEL, 0, 0);
@@ -494,6 +494,9 @@ static void InitMainDialog (HWND hwndDlg)
 		e.Show (NULL);
 	}

+	// initialize the list of devices available for mounting as early as possible
+	UpdateMountableHostDeviceList ();
+
 	// Resize the logo bitmap if the user has a non-default DPI
 	if (ScreenDPI != USER_DEFAULT_SCREEN_DPI
 		&& hbmLogoBitmapRescaled == NULL)	// If not re-called (e.g. after language pack change)
@@ -2434,7 +2437,7 @@ BOOL CALLBACK PasswordChangeDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPAR

 			if (lw == IDC_PIM)
 			{
-				if(GetPim (hwndDlg, IDC_OLD_PIM) != GetPim (hwndDlg, IDC_PIM))
+				if(GetPim (hwndDlg, IDC_OLD_PIM, 0) != GetPim (hwndDlg, IDC_PIM, 0))
 				{
 					PimValueChangedWarning = TRUE;
 					SetDlgItemTextW (hwndDlg, IDC_PIM_HELP, GetString (bSysEncPwdChangeDlgMode? "PIM_SYSENC_CHANGE_WARNING" : "PIM_CHANGE_WARNING"));
@@ -2631,8 +2634,8 @@ BOOL CALLBACK PasswordChangeDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPAR
 					SendMessage (GetDlgItem (hwndDlg, IDC_PKCS5_PRF_ID), CB_GETCURSEL, 0, 0), 0);
 			BOOL truecryptMode = GetCheckBox (hwndDlg, IDC_TRUECRYPT_MODE);

-			int old_pim = GetPim (hwndDlg, IDC_OLD_PIM);
-			int pim = GetPim (hwndDlg, IDC_PIM);
+			int old_pim = GetPim (hwndDlg, IDC_OLD_PIM, 0);
+			int pim = GetPim (hwndDlg, IDC_PIM, 0);

 			if (truecryptMode && !is_pkcs5_prf_supported (old_pkcs5, TRUE, PRF_BOOT_NO))
 			{
@@ -2672,7 +2675,19 @@ BOOL CALLBACK PasswordChangeDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPAR
 			else if (!(newKeyFilesParam.EnableKeyFiles && newKeyFilesParam.FirstKeyFile != NULL)
 				&& pwdChangeDlgMode == PCDM_CHANGE_PASSWORD)
 			{
-				if (!CheckPasswordLength (hwndDlg, GetWindowTextLength(GetDlgItem (hwndDlg, IDC_PASSWORD)), pim, bSysEncPwdChangeDlgMode, FALSE, FALSE))
+				int bootPRF = 0;
+				if (bSysEncPwdChangeDlgMode)
+				{
+					try
+					{
+						VOLUME_PROPERTIES_STRUCT properties;
+						BootEncObj->GetVolumeProperties(&properties);
+						bootPRF = properties.pkcs5;
+					}
+					catch(...)
+					{}
+				}
+				if (!CheckPasswordLength (hwndDlg, GetWindowTextLength(GetDlgItem (hwndDlg, IDC_PASSWORD)), pim, bSysEncPwdChangeDlgMode, bootPRF, FALSE, FALSE))
 					return 1;
 			}

@@ -3099,7 +3114,7 @@ BOOL CALLBACK PasswordDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 				*pkcs5 = (int) SendMessage (GetDlgItem (hwndDlg, IDC_PKCS5_PRF_ID), CB_GETITEMDATA, SendMessage (GetDlgItem (hwndDlg, IDC_PKCS5_PRF_ID), CB_GETCURSEL, 0, 0), 0);
 				*truecryptMode = GetCheckBox (hwndDlg, IDC_TRUECRYPT_MODE);

-				*pim = GetPim (hwndDlg, IDC_PIM);
+				*pim = GetPim (hwndDlg, IDC_PIM, 0);

 				/* check that PRF is supported in TrueCrypt Mode */
 				if (	(*truecryptMode)
@@ -3651,7 +3666,7 @@ BOOL CALLBACK MountOptionsDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM
 				mountOptions->ProtectedHidVolPkcs5Prf = (int) SendMessage (GetDlgItem (hwndDlg, IDC_PKCS5_PRF_ID), CB_GETITEMDATA,
 					SendMessage (GetDlgItem (hwndDlg, IDC_PKCS5_PRF_ID), CB_GETCURSEL, 0, 0), 0);

-				mountOptions->ProtectedHidVolPim = GetPim (hwndDlg, IDC_PIM);
+				mountOptions->ProtectedHidVolPim = GetPim (hwndDlg, IDC_PIM, 0);
 			}

 			// Cleanup
@@ -4816,8 +4831,8 @@ static BOOL Mount (HWND hwndDlg, int nDosDriveNo, wchar_t *szFileName, int pim,
 		// try TrueCrypt mode first as it is quick, only if no custom pim specified
 		if (EffectiveVolumeTrueCryptMode)
 			mounted = MountVolume (hwndDlg, nDosDriveNo, szFileName, &VolumePassword, EffectiveVolumePkcs5, 0, TRUE, bCacheInDriver, bIncludePimInCache, bForceMount, &mountOptions, Silent, FALSE);
-		else
-			mounted = MountVolume (hwndDlg, nDosDriveNo, szFileName, &VolumePassword, EffectiveVolumePkcs5, EffectiveVolumePim, FALSE, bCacheInDriver, bIncludePimInCache, bForceMount, &mountOptions, Silent, FALSE);
+		else // if no PIM specified for favorite, we use also the PIM of the previous volume alongside its password.
+			mounted = MountVolume (hwndDlg, nDosDriveNo, szFileName, &VolumePassword, EffectiveVolumePkcs5, (EffectiveVolumePim < 0)? VolumePim : EffectiveVolumePim, FALSE, bCacheInDriver, bIncludePimInCache, bForceMount, &mountOptions, Silent, FALSE);
 	}

 	NormalCursor ();
@@ -9118,6 +9133,21 @@ static VOID WINAPI SystemFavoritesServiceCtrlHandler (DWORD control)
 		SystemFavoritesServiceSetStatus (SystemFavoritesServiceStatus.dwCurrentState);
 }

+static LONG WINAPI SystemFavoritesServiceExceptionHandler (EXCEPTION_POINTERS *ep)
+{
+	SetUnhandledExceptionFilter (NULL);
+
+	if (!(ReadDriverConfigurationFlags() & TC_DRIVER_CONFIG_CACHE_BOOT_PASSWORD))
+		WipeCache (NULL, TRUE);
+
+	UnhandledExceptionFilter (ep);
+	return EXCEPTION_EXECUTE_HANDLER;
+}
+
+static void SystemFavoritesServiceInvalidParameterHandler (const wchar_t *expression, const wchar_t *function, const wchar_t *file, unsigned int line, uintptr_t reserved)
+{
+	TC_THROW_FATAL_EXCEPTION;
+}

 static VOID WINAPI SystemFavoritesServiceMain (DWORD argc, LPTSTR *argv)
 {
@@ -9129,8 +9159,17 @@ static VOID WINAPI SystemFavoritesServiceMain (DWORD argc, LPTSTR *argv)
 	if (!SystemFavoritesServiceStatusHandle)
 		return;

+	InitGlobalLocks ();
+
+	SetUnhandledExceptionFilter (SystemFavoritesServiceExceptionHandler);
+	_set_invalid_parameter_handler (SystemFavoritesServiceInvalidParameterHandler);
+
 	SystemFavoritesServiceSetStatus (SERVICE_START_PENDING, 120000);

+	SystemFavoritesServiceLogInfo (wstring (L"Initializing list of host devices"));
+	// initialize the list of devices available for mounting as early as possible
+	UpdateMountableHostDeviceList ();
+
 	SystemFavoritesServiceLogInfo (wstring (L"Starting System Favorites mounting process"));

 	try
@@ -9148,6 +9187,8 @@ static VOID WINAPI SystemFavoritesServiceMain (DWORD argc, LPTSTR *argv)
 		SystemFavoritesServiceLogError (wstring (L"System Favorites mounting process failed."));
 	}

+	FinalizeGlobalLocks ();
+
 	SystemFavoritesServiceSetStatus (SERVICE_RUNNING);
 	SystemFavoritesServiceSetStatus (SERVICE_STOPPED);
 }
@@ -9199,7 +9240,7 @@ int WINAPI wWinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance, wchar_t *lpsz
 	VirtualLock (&CmdVolumePassword, sizeof (CmdVolumePassword));
 	VirtualLock (&mountOptions, sizeof (mountOptions));
 	VirtualLock (&defaultMountOptions, sizeof (defaultMountOptions));
-	VirtualLock (&szFileName, sizeof(szFileName));
+	VirtualLock (&szFileName, sizeof(szFileName));	

 	DetectX86Features ();

@@ -9660,6 +9701,9 @@ BOOL MountFavoriteVolumes (HWND hwnd, BOOL systemFavorites, BOOL logOnMount, BOO
 		{
 			Sleep (5000);

+			SystemFavoritesServiceLogInfo (wstring (L"Updating list of host devices"));
+			UpdateMountableHostDeviceList ();
+
 			SystemFavoritesServiceLogInfo (wstring (L"Trying to mount skipped system favorites"));

 			// Update the service status to avoid being killed
@@ -530,8 +530,8 @@ END
 //

 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,20,3,4
- PRODUCTVERSION 1,20,3,4
+ FILEVERSION 1,21,5,0
+ PRODUCTVERSION 1,21,5,0
 FILEFLAGSMASK 0x17L
 #ifdef _DEBUG
 FILEFLAGS 0x1L
@@ -548,11 +548,11 @@ BEGIN
        BEGIN
            VALUE "CompanyName", "IDRIX"
            VALUE "FileDescription", "VeraCrypt"
-            VALUE "FileVersion", "1.20"
+            VALUE "FileVersion", "1.21"
            VALUE "LegalTrademarks", "VeraCrypt"
            VALUE "OriginalFilename", "VeraCrypt.exe"
            VALUE "ProductName", "VeraCrypt"
-            VALUE "ProductVersion", "1.20"
+            VALUE "ProductVersion", "1.21"
        END
    END
    BLOCK "VarFileInfo"
@@ -206,8 +206,7 @@ copy $(TargetPath) "..\Debug\Setup Files\VeraCrypt-x64.exe" &gt;NUL:
      <AssemblerOutput>All</AssemblerOutput>
      <AssemblerListingLocation>$(IntDir)</AssemblerListingLocation>
      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>
-      </DebugInformationFormat>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
      <DisableSpecificWarnings>4057;4100;4127;4201;4701;4706;4131;%(DisableSpecificWarnings)</DisableSpecificWarnings>
    </ClCompile>
    <Link>
@@ -215,7 +214,7 @@ copy $(TargetPath) "..\Debug\Setup Files\VeraCrypt-x64.exe" &gt;NUL:
      <OutputFile>$(OutDir)VeraCrypt.exe</OutputFile>
      <IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
      <DelayLoadDLLs>mpr.dll;%(DelayLoadDLLs)</DelayLoadDLLs>
-      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
      <GenerateMapFile>true</GenerateMapFile>
      <SubSystem>Windows</SubSystem>
      <OptimizeReferences>true</OptimizeReferences>
@@ -251,8 +250,7 @@ copy $(TargetPath) "..\Debug\Setup Files\VeraCrypt-x64.exe" &gt;NUL:
      <AssemblerOutput>All</AssemblerOutput>
      <AssemblerListingLocation>$(IntDir)</AssemblerListingLocation>
      <WarningLevel>Level4</WarningLevel>
-      <DebugInformationFormat>
-      </DebugInformationFormat>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
      <DisableSpecificWarnings>4057;4100;4127;4201;4701;4706;4131;%(DisableSpecificWarnings)</DisableSpecificWarnings>
    </ClCompile>
    <Link>
@@ -260,7 +258,7 @@ copy $(TargetPath) "..\Debug\Setup Files\VeraCrypt-x64.exe" &gt;NUL:
      <OutputFile>$(OutDir)VeraCrypt.exe</OutputFile>
      <IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
      <DelayLoadDLLs>mpr.dll;%(DelayLoadDLLs)</DelayLoadDLLs>
-      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
      <GenerateMapFile>true</GenerateMapFile>
      <SubSystem>Windows</SubSystem>
      <OptimizeReferences>true</OptimizeReferences>
@@ -18,16 +18,16 @@ Contents
 ========

 I. Windows
-Requirements for Building VeraCrypt for Windows
-Instructions for Building VeraCrypt for Windows
-Instructions for Signing and Packaging VeraCrypt for Windows
+   Requirements for Building VeraCrypt for Windows.
+   Instructions for Building VeraCrypt for Windows.
+	Instructions for Signing and Packaging VeraCrypt for Windows.

 II. Linux and Mac OS X
-Requirements for Building VeraCrypt for Linux and Mac OS X
-Instructions for Building VeraCrypt for Linux and Mac OS X
-Mac OS X specifics
+    Requirements for Building VeraCrypt for Linux and Mac OS X.
+    Instructions for Building VeraCrypt for Linux and Mac OS X.
+	Mac OS X specifics

-III. FreeBSD and OpenSolaris
+III. FreeBSD

 IV. Third-Party Developers (Contributors)

@@ -78,16 +78,16 @@ Instructions for Building VeraCrypt for Windows:
 ------------------------------------------------

 1) Create an environment variable 'MSVC16_ROOT' pointing to the folder 'MSVC15'
-extracted from the Visual C++ 1.52 self-extracting package.
+   extracted from the Visual C++ 1.52 self-extracting package.

-Note: The 16-bit installer MSVC15\SETUP.EXE cannot be run on 64-bit Windows,
-but it is actually not necessary to run it. You only need to extract the
-folder 'MSVC15', which contains the 32-bit binaries required to build the
-VeraCrypt Boot Loader.
+   Note: The 16-bit installer MSVC15\SETUP.EXE cannot be run on 64-bit Windows,
+   but it is actually not necessary to run it. You only need to extract the
+   folder 'MSVC15', which contains the 32-bit binaries required to build the
+   VeraCrypt Boot Loader.

 2) If you have installed the Windows Driver Development Kit in another
-directory than '%SYSTEMDRIVE%\WinDDK', create an environment variable
-'WINDDK_ROOT' pointing to the DDK installation directory.
+   directory than '%SYSTEMDRIVE%\WinDDK', create an environment variable
+   'WINDDK_ROOT' pointing to the DDK installation directory.

 3) Open the solution file 'VeraCrypt.sln' in Microsoft Visual Studio 2010.

@@ -96,7 +96,7 @@ directory than '%SYSTEMDRIVE%\WinDDK', create an environment variable
 5) Build the solution.

 6) If successful, there should be newly built VeraCrypt binaries in the
-'Release' folder.
+   'Release' folder.

 Instructions for Signing and Packaging VeraCrypt for Windows:
 -------------------------------------------------------------
@@ -115,7 +115,7 @@ VeraCrypt EFI Boot Loader:
 --------------------------

 VeraCrypt source code contains pre-built EFI binaries under src\Boot\EFI.
-The source code of VeraCrypt EFI Boot Loader is licensed under LGPL and
+The source code of VeraCrypt EFI Boot Loader is licensed under LGPL and 
 it is available at https://github.com/veracrypt/VeraCrypt-DCS.
 For build instructions, please refer to the file src\Boot\EFI\Readme.txt.

@@ -132,9 +132,9 @@ Requirements for Building VeraCrypt for Linux and Mac OS X:
 - YASM 1.3.0 or newer (Linux only, x86/x64 architecture only)
 - pkg-config
 - wxWidgets 3.0 shared library and header files installed or
-wxWidgets 3.0 library source code (available at https://www.wxwidgets.org)
+  wxWidgets 3.0 library source code (available at https://www.wxwidgets.org)
 - FUSE library and header files (available at https://github.com/libfuse/libfuse
-and https://osxfuse.github.io/)
+  and https://osxfuse.github.io/)


 Instructions for Building VeraCrypt for Linux and Mac OS X:
@@ -143,33 +143,33 @@ Instructions for Building VeraCrypt for Linux and Mac OS X:
 1) Change the current directory to the root of the VeraCrypt source code.

 2) If you have no wxWidgets shared library installed, run the following
-command to configure the wxWidgets static library for VeraCrypt and to
-build it:
+   command to configure the wxWidgets static library for VeraCrypt and to
+   build it:

-$ make WXSTATIC=1 WX_ROOT=/usr/src/wxWidgets wxbuild
+   $ make WXSTATIC=1 WX_ROOT=/usr/src/wxWidgets wxbuild

-The variable WX_ROOT must point to the location of the source code of the
-wxWidgets library. Output files will be placed in the './wxrelease/'
-directory.
+   The variable WX_ROOT must point to the location of the source code of the
+   wxWidgets library. Output files will be placed in the './wxrelease/'
+   directory.

 3) To build VeraCrypt, run the following command:

-$ make
+   $ make

-or if you have no wxWidgets shared library installed:
+   or if you have no wxWidgets shared library installed:

-$ make WXSTATIC=1
+   $ make WXSTATIC=1

 4) If successful, the VeraCrypt executable should be located in the directory
-'Main'.
+   'Main'.

 By default, a universal executable supporting both graphical and text user
 interface (through the switch --text) is built.
 On Linux, a console-only executable, which requires no GUI library, can be
 built using the 'NOGUI' parameter:

-$ make NOGUI=1 WXSTATIC=1 WX_ROOT=/usr/src/wxWidgets wxbuild
-$ make NOGUI=1 WXSTATIC=1
+   $ make NOGUI=1 WXSTATIC=1 WX_ROOT=/usr/src/wxWidgets wxbuild
+   $ make NOGUI=1 WXSTATIC=1

 On MacOSX, building a console-only executable is not supported.

@@ -179,16 +179,16 @@ Mac OS X specifics:
 Under MacOSX, the SDK for OSX 10.7 is used by default. To use another version
 of the SDK (i.e. 10.6), you can export the environment variable VC_OSX_TARGET:

-$ export VC_OSX_TARGET=10.6
+	$ export VC_OSX_TARGET=10.6


 Before building under MacOSX, pkg-config must be installed if not yet available.
 Get it from https://pkgconfig.freedesktop.org/releases/pkg-config-0.28.tar.gz and
 compile using the following commands :

-$ ./configure --with-internal-glib
-$ make
-$ sudo make install
+	$ ./configure --with-internal-glib
+	$ make
+	$ sudo make install

 After making sure pkg-config is available, download and install OSXFuse from
 https://osxfuse.github.io/ (MacFUSE compatibility layer must selected)
@@ -200,7 +200,7 @@ VeraCrypt sources (i.e. if "src" path is "/Users/joe/Projects/VeraCrypt/src"
 then wxWidgets should be at "/Users/joe/Projects/wxWidgets-3.0.3")

 The build process uses Code Signing certificates whose ID is specified in
-src/Main/Main.make (look for lines containing "Developer ID Application" and
+src/Main/Main.make (look for lines containing "Developer ID Application" and 
 "Developer ID Installer"). You'll have to modify these lines to put the ID of
 your Code Signing certificates or comment them if you don't have one.

@@ -210,10 +210,12 @@ Thus, we recommend using a different OSX SDK version for building VeraCrypt.



-III. FreeBSD and OpenSolaris
+III. FreeBSD
 ============================

-FreeBSD and OpenSolaris are not yet supported.
+FreeBSD is supported starting from version 11.
+The build requirements and instructions are the same as Linux except that gmake
+should be used instead of make.



@@ -223,7 +225,7 @@ IV. Third-Party Developers (Contributors)
 If you intend to implement a feature, please contact us first to make sure:

 1) That the feature has not been implemented (we may have already implemented
-it, but haven't released the code yet).
+   it, but haven't released the code yet).
 2) That the feature is acceptable.
 3) Whether we need help of third-party developers with implementing the feature.

@@ -0,0 +1,11 @@
+#!/bin/sh
+V="$(mount | grep veracrypt_aux_mnt)"
+[ "$V" ] && echo Error: All volumes must be dismounted first. && exit 1
+
+rm -f /usr/bin/veracrypt
+rm -f /usr/share/applications/veracrypt.desktop
+rm -f /usr/share/pixmaps/veracrypt.xpm
+rm -fr /usr/share/veracrypt
+
+echo VeraCrypt uninstalled.
+rm -f /usr/bin/veracrypt-uninstall.sh
@@ -0,0 +1,10 @@
+[Desktop Entry]
+Encoding=UTF-8
+Name=VeraCrypt
+GenericName=VeraCrypt
+Comment=VeraCrypt
+Exec=/usr/bin/veracrypt
+Icon=veracrypt
+Terminal=false
+Type=Application
+Categories=Encryption;Encryption Tools;Utility;
@@ -495,7 +495,7 @@
 				<key>OVERWRITE_PERMISSIONS</key>
 				<false/>
 				<key>VERSION</key>
-				<string>1.20.3</string>
+				<string>1.21.5</string>
 			</dict>
 			<key>UUID</key>
 			<string>B14381D9-EC5F-43E4-B971-82AB3D132A64</string>
@@ -1004,7 +1004,7 @@ https://osxfuse.github.io/
 				</dict>
 			</array>
 			<key>NAME</key>
-			<string>VeraCrypt 1.20</string>
+			<string>VeraCrypt 1.21</string>
 		</dict>
 	</dict>
 	<key>SHARED_GLOBAL_DATA</key>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Mounir IDRASSI	d49432dc88	FreeBSD: make official FreeBSD build script executable	2017-07-10 00:31:19 +02:00
Mounir IDRASSI	b7e1614b58	FreeBSD: enable wxWidgets static build by default in official build script	2017-07-10 00:18:28 +02:00
Mounir IDRASSI	bc9e722211	Update Readme to mention FreeBSD support and remove reference to OpenSolaris	2017-07-10 00:14:19 +02:00
Mounir IDRASSI	342b8636d8	Add support for building under FreeBSD 11	2017-07-10 00:14:18 +02:00
Mounir IDRASSI	e273149541	Windows: Update EFI bootloader files from VeraCrypt-DCS 1.21 after Camellia 64bit assembly changes	2017-07-09 10:55:38 +02:00
Mounir IDRASSI	6358b00b69	Windows: continue fix documentation about iteration calculation formula for key derivation	2017-07-09 10:49:32 +02:00
Mounir IDRASSI	3f36836a3b	Change 1.21 release date to July 9th 2017	2017-07-09 09:49:36 +02:00
Mounir IDRASSI	9833a753dd	Windows: when listing connected devices, consider that a partition exists if CreateFile returns ERROR_ACCESS_DENIED	2017-07-09 09:49:35 +02:00
Mounir IDRASSI	ac37fb0003	Windows: generate pdb files for binaries in order to help investigate crashes in the future.	2017-07-09 09:49:33 +02:00
Mounir IDRASSI	f5841b8841	Windows: install crash handler in case of system favorites service in order to be able to clear Pre-Boot password from cache before the service is terminate if a crash happens.	2017-07-09 09:49:32 +02:00
Mounir IDRASSI	1ebb0bf00f	Windows: correctly initialize global critical sections in case if system favorites service.	2017-07-09 00:19:17 +02:00
Mounir IDRASSI	37a070cdea	Windows: Update signed driver files for 1.21 release (1.21.5)	2017-07-09 00:19:16 +02:00
Mounir IDRASSI	795aa4318e	Increment version to 1.21.5	2017-07-09 00:19:14 +02:00
Mounir IDRASSI	d2eacde0da	Remove unnecessary code from Camellia assembly implementation that checks for key size since we always use it with 256-bit keys.	2017-07-09 00:19:14 +02:00
Mounir IDRASSI	2577797fc4	Windows: preserve volatile registers XMM6-XMM15 in 64-bit assembly of Camellia.	2017-07-09 00:19:12 +02:00
Mounir IDRASSI	bf571681fe	Windows: Add PDF documents about DCS configuration for EFI system encryption: TPM support, full disk encryption and hidden OS. Include this in Windows installer.	2017-07-07 20:25:30 +02:00
Mounir IDRASSI	37aeeaf204	Windows: display prompt to upgrade Rescue Disk when installing 1.21 version.	2017-07-07 12:04:21 +02:00
Mounir IDRASSI	b7ed0c4892	Windows: Don't remove last digit of version string if it is zero. This is a legacy code that applied to previous versioning scheme.	2017-07-07 11:52:40 +02:00
Mounir IDRASSI	753894cb7e	Change 1.21 release date to July 7th 2017	2017-07-07 11:52:38 +02:00
Mounir IDRASSI	4e0ced43a4	Windows: in case of system favorite mounting, update list of host devices before each retry to mount disconnected favorites.	2017-07-07 01:06:59 +02:00
Mounir IDRASSI	1c3156a17b	Windows: fix regression affecting automatic mount of favorites and system favorites at logon	2017-07-07 00:41:08 +02:00
Mounir IDRASSI	048e161d15	Windows: Update EFI bootloader files from VeraCrypt-DCS 1.21	2017-07-07 00:41:06 +02:00
Mounir IDRASSI	edac097822	Windows: Update signed driver files for 1.21 release (1.21.4)	2017-07-05 16:21:39 +02:00
Mounir IDRASSI	d9f9e6d231	Increment version to 1.21.4	2017-07-05 16:21:37 +02:00
Mounir IDRASSI	384c5cc259	Windows Driver: correctly get KeRestoreExtendedProcessorState function pointer.	2017-07-05 16:21:35 +02:00
Mounir IDRASSI	b0827e9b74	Increment version to 1.21.3	2017-07-04 12:28:19 +02:00
Mounir IDRASSI	88cc8a00f4	Windows: correctly handle SEH exceptions during self-tests in order to disable CPU extended features in such case.	2017-07-04 12:28:17 +02:00
Mounir IDRASSI	0358eb6c71	Don't check for SSSE3 to use 64-bit SHA-512 assembly code since it uses only SSE2 instructions.	2017-07-04 02:26:26 +02:00
Mounir IDRASSI	89efcdb8cd	Windows Driver: correctly save and restore extended processor state when performing AVX operations on Windows 7 and later. Enhance readability of code handling save/restore of floating point state.	2017-07-04 02:26:24 +02:00
Mounir IDRASSI	c2f6190627	Windows: use stack instead of MMX register to save registers in 64-bit assembly implementation of SHA-512 in order to avoid issues with the driver.	2017-07-04 02:26:23 +02:00
Mounir IDRASSI	840756ead1	Windows: workaround for some cases where the system return ERROR_INVALID_PARAMETER when we try to write EFI bootloader files into ESP partition.	2017-07-03 01:55:45 +02:00
Mounir IDRASSI	f78242fac6	Change 1.21 release date to July 3rd 2017	2017-07-03 00:50:09 +02:00
Mounir IDRASSI	f5bbb5e33f	Documentation: Update Incompatibilities section to mention both Outpost Firewall or Outpost Security Suite and to point to corresponding ticket at Sourceforce.	2017-07-03 00:44:45 +02:00
Mounir IDRASSI	1937470dc2	Documentation: Update the FAQ to mention CHM file of User Guide instead of PDF	2017-07-03 00:44:44 +02:00
Mounir IDRASSI	d52b5664f8	Documentation: Add workaround for hang issues encountered on some Windows machine during mount/dismount.	2017-07-03 00:44:43 +02:00
Mounir IDRASSI	d1b26d4bfe	Windows: fix documentation and UI messages about the PIM constraints and calculation formula when EFI system encryption is using SHA-512 or Whirlpool. For historical reasons, if SHA-512 or Whirlpool is selected for EFI system encryption, then iterations = 15000 + (PIM x 1000) and not iterations = PIM x 2048 like the other algorithms.	2017-07-02 19:36:53 +02:00
Mounir IDRASSI	a0f2ffb90b	Windows: when mounting multiple favorites, use PIM of previous favorite alongside its password if option "Include PIM when caching password" is selected alongside option "Temporarily cache password during Mount Favorite Volumes operations".	2017-07-02 19:36:52 +02:00
Mounir IDRASSI	2db0061741	Windows: set PIM of favorite to 0 only if TrueCryptMode is explicitly selected.	2017-07-02 14:27:25 +02:00
Mounir IDRASSI	d761076903	Linux/MacOSX: use aligned memory for allocating hash context to avoid issues on some platforms especially for Streebog.	2017-07-02 12:08:04 +02:00
Mounir IDRASSI	235b52027b	Windows: Update EFI bootloader file from latest VeraCrypt-DCS 1.21	2017-07-02 00:51:59 +02:00
Mounir IDRASSI	553e707879	Windows: Update signed driver files for 1.21 release	2017-07-02 00:51:58 +02:00
Mounir IDRASSI	5540af7c57	Windows: increment version to 1.21.2	2017-07-02 00:51:58 +02:00
Mounir IDRASSI	e5728bd36e	Linux/MacOSX: align workspace stack variable in WhirlpoolTransform SSE code.	2017-07-02 00:51:57 +02:00
Mounir IDRASSI	d8dd1accb4	Avoid alignement issues with some old compilers by using movdqu instead of movdqa in SHA-256 SSE2 assembly.	2017-07-02 00:51:56 +02:00
Mounir IDRASSI	c193911655	Linux: remove existing "Setup/Linux/usr" if any before preparing for packaging.	2017-07-02 00:51:55 +02:00
Mounir IDRASSI	bded7901c5	Linux: Use $(CURDIR) instead of $(PWD) for the install target, as well as $(DESTDIR)/ (which will still install into / if 'DESTDIR' is unset.)	2017-07-02 00:51:55 +02:00
Mounir IDRASSI	04b4ff3651	Language XML files: Update Arabic translation (contributed by Ali Khojah)	2017-07-02 00:51:54 +02:00
Mounir IDRASSI	3c4e36ecdf	Increment version to 1.21 (1.21.1)	2017-07-02 00:51:50 +02:00
Mounir IDRASSI	77fe1f7c76	Windows: Update signed driver files for 1.21 release	2017-07-01 02:15:13 +02:00
Mounir IDRASSI	fe278afb18	Fix crash on machines without SSSE3 support in CPU by correctly checking for SSSE3 before using SHA-512 SSE2 assembly which uses PSHUFB instruction.	2017-07-01 01:56:33 +02:00
Mounir IDRASSI	f5e6136830	For code logic clarity, add check for xgetbv support in CPU before using it.	2017-07-01 01:56:32 +02:00
Mounir IDRASSI	33bb507fde	Windows: fix missing resource in 64-bit build.	2017-06-30 13:52:45 +02:00