MacOSX: add shell script to perform build under MacOSX

Linux/MacOSX: solve compilation warning by explicitly converting wxCStrData to (const wchar_t*)
Replace deprecated wxTextValidator::SetBellOnError whose logic whose inverted by the new wxTextValidator::SuppressBellOnError. Since its used in constructor only for TC_WINDOWS, we do the same in the destructor.
2026-08-29 04:07:37 +00:00 · 2014-11-08 23:24:57 +01:00 · 2014-11-08 23:24:54 +01:00 · 2014-11-08 23:24:51 +01:00 · 2014-11-08 23:24:49 +01:00 · 2014-11-08 23:24:46 +01:00
107 changed files with 1901 additions and 775 deletions
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="ar" name="العربية" en-name="Arabic" version="0.1.0" translators="Ahmad Gharbeia, Khaled Hosny" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="be" name="Беларуская" en-name="Belarusian" version="0.1.0" translators="Aleg Azarousky" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="bg" name="Български" en-name="Bulgarian" version="0.1.0" translators="Lachezar Gorchev" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="ca" name="Català" en-name="Catalan" version="0.1.0" translators="CESICAT, Centre de Seguretat de la Informació de Catalunya" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="cs" name="Čeština" en-name="Czech" version="1.0.0" translators="Vítek Moser" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="da" name="Dansk" en-name="Danish" version="0.1.0" translators="Lasse Bond" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="de" name="Deutsch" en-name="German" version="1.0.1" translators="Harry Haller, Alexander Schorg, Simon Frankenberger, David Arndt" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="el" name="Ελληνικά" en-name="Greek" version="0.1.0" translators="Βασίλης Κοσμίδης" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="es" name="Español" en-name="Spanish" version="1.0.0" translators="Juan Antonio Auñón Ochando" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="et" name="Eesti" en-name="Estonian" version="0.1.0" translators="Maiko Mõtsar" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="eu" name="Euskara" en-name="Basque" version="1.0.0" translators="Ander Genua" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="fa" name="فارسي" en-name="Persian" version="0.1.0" translators="Ali Bitazar, Rodabeh Sarmadi" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="fi" name="Suomi" en-name="Finnish" version="0.1.0" translators="Matti Ruhanen" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="fr" name="Français" en-name="French" version="0.2.0" translators="Stéphane S., Olivier M." />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="hu" name="Magyar" en-name="Hungarian" version="0.1.0" translators="Nyul Balazs" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="id" name="Bahasa Indonesia" en-name="Indonesian" version="0.1.0" translators="Tajuddin N. F." />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="it" name="Italiano" en-name="Italian" version="1.0.1" translators="Maurizio Ballo, Consiglio Gaetano" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="ja" name="日本語" en-name="Japanese" version="1.0.0" translators="OGOSHI Masayuki" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="ka" name="ქართული" en-name="Georgian" version="0.1.0" translators="Kakha Lomiashvili" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="ko" name="한국어" en-name="Korean" version="0.1.0" translators="Kim Young" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="lv" name="Latviešu" en-name="Latvian" version="0.1.0" translators="Edmunds Melkers" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="my" name="မြန်မာ" en-name="Burmese" version="1.0.0" translators="Zaw Myo Htet" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="nl" name="Nederlands" en-name="Dutch" version="0.1.0" translators="Jan van der Wal" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="nn" name="Norsk Nynorsk" en-name="Norwegian (Nynorsk)" version="0.1.0" translators="Kjell Rune Helland" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="pl" name="Polski" en-name="Polish" version="1.0.0" translators="Mirek Druchowicz, Janusz Zamecki, Sobiesław Antolak, Begina Felicysym" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="pt-br" name="Português-Brasil" en-name="Portuguese (Brazil)" version="0.1.0" translators="Thiago C. L. Mendes, Lecidio S. Alencar , Lucas C. Ferreira" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="ru" name="Русский" en-name="Russian" version="1.0.0" translators="Dmitry Yerokhin" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="sk" name="Slovenčina" en-name="Slovak" version="0.1.0" translators="Kamil David" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="sl" name="Slovenščina" en-name="Slovenian" version="0.1.0" translators="Erik David Salam" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="sv" name="Svenska" en-name="Swedish" version="1.0.0" translators="Peter Runesson" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="tr" name="Türkçe" en-name="Turkish" version="0.1.0" translators="Ali İskender Turan, Zeynel Abidin Öztürk" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="uk" name="Українська" en-name="Ukrainian" version="1.0.0" translators="Kravchuk Olexandr, Babchuk Volodymyr" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="uz" name="Ўзбекча" en-name="Uzbek (Cyrillic)" version="0.1.0" translators="Abdurauf Azizov, Dmitry Yerokhin" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="vi" name="Tiếng Việt" en-name="Vietnamese" version="0.1.0" translators="Nguyễn Kim Huy" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="zh-cn" name="简体中文" en-name="Chinese (Simplified)" version="1.0.0" translators="Barney Li" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="zh-hk" name="繁體中文" en-name="Chinese (Hong Kong)" version="0.1.0" translators="PUN Chi Ho" />
    <!-- Fonts -->
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.0d">
+  <localization prog-version="1.0e">
    <!-- Languages -->
    <language langid="zh-tw" name="繁體中文" en-name="Chinese (Taiwan)" version="0.1.0" translators="Barney Li, Simon Ma, ChangMing Hsu" />
    <!-- Fonts -->
@@ -24,9 +24,9 @@
 			>
 			<Tool
 				Name="VCNMakeTool"
-				BuildCommandLine="md Release 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1&#x0D;&#x0A;&#x0D;&#x0A;md Release_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES&#x0D;&#x0A;&#x0D;&#x0A;md Release_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT&#x0D;&#x0A;&#x0D;&#x0A;md Release_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH&#x0D;&#x0A;&#x0D;&#x0A;md Rescue 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH RESCUE_DISK=1"
-				ReBuildCommandLine="del /q /s Release &gt;NUL:&#x0D;&#x0A;md Release 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_AES &gt;NUL:&#x0D;&#x0A;md Release_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_Serpent &gt;NUL:&#x0D;&#x0A;md Release_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_Twofish &gt;NUL:&#x0D;&#x0A;md Release_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue &gt;NUL:&#x0D;&#x0A;md Rescue 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_AES &gt;NUL:&#x0D;&#x0A;md Rescue_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_Serpent &gt;NUL:&#x0D;&#x0A;md Rescue_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_Twofish &gt;NUL:&#x0D;&#x0A;md Rescue_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH RESCUE_DISK=1"
-				CleanCommandLine="del /q /s Release Release_AES Release_Serpent Release_Twofish Rescue Rescue_AES Rescue_Serpent Rescue_Twofish &gt;NUL:"
+				BuildCommandLine="md Release 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1&#x0D;&#x0A;&#x0D;&#x0A;md Release_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;md Release_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES&#x0D;&#x0A;&#x0D;&#x0A;md Release_AES_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;md Release_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT&#x0D;&#x0A;&#x0D;&#x0A;md Release_Serpent_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;md Release_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH&#x0D;&#x0A;&#x0D;&#x0A;md Release_Twofish_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;md Rescue 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 RESCUE_DISK=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_AES_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES RESCUE_DISK=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_Serpent_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT RESCUE_DISK=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;md Rescue_Twofish_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH RESCUE_DISK=1 SINGLE_PRF=SHA2"
+				ReBuildCommandLine="del /q /s Release &gt;NUL:&#x0D;&#x0A;md Release 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_SHA2 &gt;NUL:&#x0D;&#x0A;md Release_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_AES &gt;NUL:&#x0D;&#x0A;md Release_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_AES_SHA2 &gt;NUL:&#x0D;&#x0A;md Release_AES_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_Serpent &gt;NUL:&#x0D;&#x0A;md Release_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_Serpent_SHA2 &gt;NUL:&#x0D;&#x0A;md Release_Serpent_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_Twofish &gt;NUL:&#x0D;&#x0A;md Release_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Release_Twofish_SHA2 &gt;NUL:&#x0D;&#x0A;md Release_Twofish_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue &gt;NUL:&#x0D;&#x0A;md Rescue 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_SHA2 &gt;NUL:&#x0D;&#x0A;md Rescue_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 RESCUE_DISK=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_AES &gt;NUL:&#x0D;&#x0A;md Rescue_AES 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_AES_SHA2 &gt;NUL:&#x0D;&#x0A;md Rescue_AES_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=AES RESCUE_DISK=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_Serpent &gt;NUL:&#x0D;&#x0A;md Rescue_Serpent 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_Serpent_SHA2 &gt;NUL:&#x0D;&#x0A;md Rescue_Serpent_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=SERPENT RESCUE_DISK=1 SINGLE_PRF=SHA2&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_Twofish &gt;NUL:&#x0D;&#x0A;md Rescue_Twofish 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH RESCUE_DISK=1&#x0D;&#x0A;&#x0D;&#x0A;del /q /s Rescue_Twofish_SHA2 &gt;NUL:&#x0D;&#x0A;md Rescue_Twofish_SHA2 2&gt;NUL:&#x0D;&#x0A;nmake.exe /nologo RELEASE=1 SINGLE_CIPHER=TWOFISH RESCUE_DISK=1 SINGLE_PRF=SHA2"
+				CleanCommandLine="del /q /s Release Release_AES Release_Serpent Release_Twofish Rescue Rescue_AES Rescue_Serpent Rescue_Twofish &gt;NUL:&#x0D;&#x0A;del /q /s Release_SHA2 Release_AES_SHA2 Release_Serpent_SHA2 Release_Twofish_SHA2 Rescue_SHA2 Rescue_AES_SHA2 Rescue_Serpent_SHA2 Rescue_Twofish_SHA2 &gt;NUL:&#x0D;&#x0A;"
 				Output="Release\BootLoader.com"
 				PreprocessorDefinitions="WIN32;NDEBUG"
 				IncludeSearchPath="&quot;$(SolutionDir)&quot;;&quot;$(SolutionDir)\Common&quot;;&quot;$(SolutionDir)\Crypto&quot;;&quot;$(MSVC16_ROOT)\Include&quot;"
@@ -164,6 +164,10 @@
 					RelativePath="..\..\Crypto\Serpent.c"
 					>
 				</File>
+				<File
+					RelativePath="..\..\Crypto\Sha2Small.c"
+					>
+				</File>
 				<File
 					RelativePath="..\..\Crypto\Twofish.c"
 					>
@@ -13,7 +13,7 @@
 #include "BootDefs.h"

 // The user will be advised to upgrade the rescue disk if upgrading from the following or any previous version
-#define TC_RESCUE_DISK_UPGRADE_NOTICE_MAX_VERSION 0x010a
+#define TC_RESCUE_DISK_UPGRADE_NOTICE_MAX_VERSION 0x010e

 #define TC_BOOT_LOADER_AREA_SIZE (TC_BOOT_LOADER_AREA_SECTOR_COUNT * TC_SECTOR_SIZE_BIOS)

@@ -134,6 +134,8 @@ checksum_ok:
 	push dx
 	
 	; Decompress boot loader
+	mov cx, word ptr [start + TC_BOOT_SECTOR_LOADER_LENGTH_OFFSET]
+	push cx																		; Compressed data size
 	push TC_BOOT_LOADER_COMPRESSED_BUFFER_OFFSET + TC_GZIP_HEADER_SIZE			; Compressed data
 	push TC_MAX_BOOT_LOADER_DECOMPRESSED_SIZE									; Output buffer size
 	push TC_BOOT_LOADER_DECOMPRESSOR_MEMORY_SIZE + TC_COM_EXECUTABLE_OFFSET		; Output buffer
@@ -145,7 +147,7 @@ checksum_ok:
 	retf
 decompressor_ret:

-	add sp, 6
+	add sp, 8
 	pop dx
 	
 	; Restore boot sector segment
@@ -1,410 +1,432 @@
-/*
-  puff.c
-  Copyright (C) 2002-2004 Mark Adler, all rights reserved
-  version 1.8, 9 Jan 2004
-
-  This software is provided 'as-is', without any express or implied
-  warranty.  In no event will the author be held liable for any damages
-  arising from the use of this software.
-
-  Permission is granted to anyone to use this software for any purpose,
-  including commercial applications, and to alter it and redistribute it
-  freely, subject to the following restrictions:
-
-  1. The origin of this software must not be misrepresented; you must not
-     claim that you wrote the original software. If you use this software
-     in a product, an acknowledgment in the product documentation would be
-     appreciated but is not required.
-  2. Altered source versions must be plainly marked as such, and must not be
-     misrepresented as being the original software.
-  3. This notice may not be removed or altered from any source distribution.
-
-  Mark Adler    madler@alumni.caltech.edu
-*/
-
-/* Adapted for TrueCrypt */
-
-
-#define local static            /* for local function definitions */
-#define NIL ((unsigned char *)0)        /* for no output option */
-
-/*
- * Maximums for allocations and loops.  It is not useful to change these --
- * they are fixed by the deflate format.
- */
-#define MAXBITS 15              /* maximum bits in a code */
-#define MAXLCODES 286           /* maximum number of literal/length codes */
-#define MAXDCODES 30            /* maximum number of distance codes */
-#define MAXCODES (MAXLCODES+MAXDCODES)  /* maximum codes lengths to read */
-#define FIXLCODES 288           /* number of fixed literal/length codes */
-
-/* input and output state */
-struct state {
-    /* output state */
-    unsigned char *out;         /* output buffer */
-    unsigned int outlen;       /* available space at out */
-    unsigned int outcnt;       /* bytes written to out so far */
-
-    /* input state */
-    unsigned char *in;          /* input buffer */
-    unsigned int incnt;        /* bytes read so far */
-    int bitbuf;                 /* bit buffer */
-    int bitcnt;                 /* number of bits in bit buffer */
-};
-
-
-local int bits(struct state *s, int need)
-{
-    long val;           /* bit accumulator (can use up to 20 bits) */
-
-    /* load at least need bits into val */
-    val = s->bitbuf;
-    while (s->bitcnt < need) {
-        val |= (long)(s->in[s->incnt++]) << s->bitcnt;  /* load eight bits */
-        s->bitcnt += 8;
-    }
-
-    /* drop need bits and update buffer, always zero to seven bits left */
-    s->bitbuf = (int)(val >> need);
-    s->bitcnt -= need;
-
-    /* return need bits, zeroing the bits above that */
-    return (int)(val & ((1L << need) - 1));
-}
-
-
-local int stored(struct state *s)
-{
-    unsigned len;       /* length of stored block */
-
-    /* discard leftover bits from current byte (assumes s->bitcnt < 8) */
-    s->bitbuf = 0;
-    s->bitcnt = 0;
-
-    /* get length and check against its one's complement */
-    len = s->in[s->incnt++];
-    len |= s->in[s->incnt++] << 8;
-    if (s->in[s->incnt++] != (~len & 0xff) ||
-        s->in[s->incnt++] != ((~len >> 8) & 0xff))
-        return -2;                              /* didn't match complement! */
-
-    /* copy len bytes from in to out */
-    if (s->out != NIL) {
-        if (s->outcnt + len > s->outlen)
-            return 1;                           /* not enough output space */
-        while (len--)
-            s->out[s->outcnt++] = s->in[s->incnt++];
-    }
-    else {                                      /* just scanning */
-        s->outcnt += len;
-        s->incnt += len;
-    }
-
-    /* done with a valid stored block */
-    return 0;
-}
-
-
-struct huffman {
-    short *count;       /* number of symbols of each length */
-    short *symbol;      /* canonically ordered symbols */
-};
-
-
-#ifdef SLOW
-local int decode(struct state *s, struct huffman *h)
-{
-    int len;            /* current number of bits in code */
-    int code;           /* len bits being decoded */
-    int first;          /* first code of length len */
-    int count;          /* number of codes of length len */
-    int index;          /* index of first code of length len in symbol table */
-
-    code = first = index = 0;
-    for (len = 1; len <= MAXBITS; len++) {
-        code |= bits(s, 1);             /* get next bit */
-        count = h->count[len];
-        if (code < first + count)       /* if length len, return symbol */
-            return h->symbol[index + (code - first)];
-        index += count;                 /* else update for next length */
-        first += count;
-        first <<= 1;
-        code <<= 1;
-    }
-    return -9;                          /* ran out of codes */
-}
-
-/*
- * A faster version of decode() for real applications of this code.   It's not
- * as readable, but it makes puff() twice as fast.  And it only makes the code
- * a few percent larger.
- */
-#else /* !SLOW */
-local int decode(struct state *s, struct huffman *h)
-{
-    int len;            /* current number of bits in code */
-    int code;           /* len bits being decoded */
-    int first;          /* first code of length len */
-    int count;          /* number of codes of length len */
-    int index;          /* index of first code of length len in symbol table */
-    int bitbuf;         /* bits from stream */
-    int left;           /* bits left in next or left to process */
-    short *next;        /* next number of codes */
-
-    bitbuf = s->bitbuf;
-    left = s->bitcnt;
-    code = first = index = 0;
-    len = 1;
-    next = h->count + 1;
-    while (1) {
-        while (left--) {
-            code |= bitbuf & 1;
-            bitbuf >>= 1;
-            count = *next++;
-            if (code < first + count) { /* if length len, return symbol */
-                s->bitbuf = bitbuf;
-                s->bitcnt = (s->bitcnt - len) & 7;
-                return h->symbol[index + (code - first)];
-            }
-            index += count;             /* else update for next length */
-            first += count;
-            first <<= 1;
-            code <<= 1;
-            len++;
-        }
-        left = (MAXBITS+1) - len;
-        if (left == 0) break;
-        bitbuf = s->in[s->incnt++];
-        if (left > 8) left = 8;
-    }
-    return -9;                          /* ran out of codes */
-}
-#endif /* SLOW */
-
-
-local int construct(struct huffman *h, short *length, int n)
-{
-    int symbol;         /* current symbol when stepping through length[] */
-    int len;            /* current length when stepping through h->count[] */
-    int left;           /* number of possible codes left of current length */
-    short offs[MAXBITS+1];      /* offsets in symbol table for each length */
-
-    /* count number of codes of each length */
-    for (len = 0; len <= MAXBITS; len++)
-        h->count[len] = 0;
-    for (symbol = 0; symbol < n; symbol++)
-        (h->count[length[symbol]])++;   /* assumes lengths are within bounds */
-    if (h->count[0] == n)               /* no codes! */
-        return 0;                       /* complete, but decode() will fail */
-
-    /* check for an over-subscribed or incomplete set of lengths */
-    left = 1;                           /* one possible code of zero length */
-    for (len = 1; len <= MAXBITS; len++) {
-        left <<= 1;                     /* one more bit, double codes left */
-        left -= h->count[len];          /* deduct count from possible codes */
-        if (left < 0) return left;      /* over-subscribed--return negative */
-    }                                   /* left > 0 means incomplete */
-
-    /* generate offsets into symbol table for each length for sorting */
-    offs[1] = 0;
-    for (len = 1; len < MAXBITS; len++)
-        offs[len + 1] = offs[len] + h->count[len];
-
-    /*
-     * put symbols in table sorted by length, by symbol order within each
-     * length
-     */
-    for (symbol = 0; symbol < n; symbol++)
-        if (length[symbol] != 0)
-            h->symbol[offs[length[symbol]]++] = symbol;
-
-    /* return zero for complete set, positive for incomplete set */
-    return left;
-}
-
-
-local int codes(struct state *s,
-                struct huffman *lencode,
-                struct huffman *distcode)
-{
-    int symbol;         /* decoded symbol */
-    int len;            /* length for copy */
-    unsigned dist;      /* distance for copy */
-    static const short lens[29] = { /* Size base for length codes 257..285 */
-        3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
-        35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
-    static const short lext[29] = { /* Extra bits for length codes 257..285 */
-        0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
-        3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
-    static const short dists[30] = { /* Offset base for distance codes 0..29 */
-        1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
-        257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
-        8193, 12289, 16385, 24577};
-    static const short dext[30] = { /* Extra bits for distance codes 0..29 */
-        0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
-        7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
-        12, 12, 13, 13};
-
-    /* decode literals and length/distance pairs */
-    do {
-        symbol = decode(s, lencode);
-        if (symbol < 0) return symbol;  /* invalid symbol */
-        if (symbol < 256) {             /* literal: symbol is the byte */
-            /* write out the literal */
-            if (s->out != NIL) {
-                if (s->outcnt == s->outlen) return 1;
-                s->out[s->outcnt] = symbol;
-            }
-            s->outcnt++;
-        }
-        else if (symbol > 256) {        /* length */
-            /* get and compute length */
-            symbol -= 257;
-            if (symbol >= 29) return -9;        /* invalid fixed code */
-            len = lens[symbol] + bits(s, lext[symbol]);
-
-            /* get and check distance */
-            symbol = decode(s, distcode);
-            if (symbol < 0) return symbol;      /* invalid symbol */
-            dist = dists[symbol] + bits(s, dext[symbol]);
-            if (dist > s->outcnt)
-                return -10;     /* distance too far back */
-
-            /* copy length bytes from distance bytes back */
-            if (s->out != NIL) {
-                if (s->outcnt + len > s->outlen) return 1;
-                while (len--) {
-                    s->out[s->outcnt] = s->out[s->outcnt - dist];
-                    s->outcnt++;
-                }
-            }
-            else
-                s->outcnt += len;
-        }
-    } while (symbol != 256);            /* end of block symbol */
-
-    /* done with a valid fixed or dynamic block */
-    return 0;
-}
-
-
-local int fixed(struct state *s)
-{
-    static int virgin = 1;
-    static short lencnt[MAXBITS+1], lensym[FIXLCODES];
-    static short distcnt[MAXBITS+1], distsym[MAXDCODES];
-    static struct huffman lencode = {lencnt, lensym};
-    static struct huffman distcode = {distcnt, distsym};
-
-    /* build fixed huffman tables if first call (may not be thread safe) */
-    if (virgin) {
-        int symbol;
-        short lengths[FIXLCODES];
-
-        /* literal/length table */
-        for (symbol = 0; symbol < 144; symbol++)
-            lengths[symbol] = 8;
-        for (; symbol < 256; symbol++)
-            lengths[symbol] = 9;
-        for (; symbol < 280; symbol++)
-            lengths[symbol] = 7;
-        for (; symbol < FIXLCODES; symbol++)
-            lengths[symbol] = 8;
-        construct(&lencode, lengths, FIXLCODES);
-
-        /* distance table */
-        for (symbol = 0; symbol < MAXDCODES; symbol++)
-            lengths[symbol] = 5;
-        construct(&distcode, lengths, MAXDCODES);
-
-        /* do this just once */
-        virgin = 0;
-    }
-
-    /* decode data until end-of-block code */
-    return codes(s, &lencode, &distcode);
-}
-
-
-local int dynamic(struct state *s)
-{
-    int nlen, ndist, ncode;             /* number of lengths in descriptor */
-    int index;                          /* index of lengths[] */
-    int err;                            /* construct() return value */
-    short lengths[MAXCODES];            /* descriptor code lengths */
-    short lencnt[MAXBITS+1], lensym[MAXLCODES];         /* lencode memory */
-    short distcnt[MAXBITS+1], distsym[MAXDCODES];       /* distcode memory */
-    struct huffman lencode = {lencnt, lensym};          /* length code */
-    struct huffman distcode = {distcnt, distsym};       /* distance code */
-    static const short order[19] =      /* permutation of code length codes */
-        {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
-
-    /* get number of lengths in each table, check lengths */
-    nlen = bits(s, 5) + 257;
-    ndist = bits(s, 5) + 1;
-    ncode = bits(s, 4) + 4;
-    if (nlen > MAXLCODES || ndist > MAXDCODES)
-        return -3;                      /* bad counts */
-
-    /* read code length code lengths (really), missing lengths are zero */
-    for (index = 0; index < ncode; index++)
-        lengths[order[index]] = bits(s, 3);
-    for (; index < 19; index++)
-        lengths[order[index]] = 0;
-
-    /* build huffman table for code lengths codes (use lencode temporarily) */
-    err = construct(&lencode, lengths, 19);
-    if (err != 0) return -4;            /* require complete code set here */
-
-    /* read length/literal and distance code length tables */
-    index = 0;
-    while (index < nlen + ndist) {
-        int symbol;             /* decoded value */
-        int len;                /* last length to repeat */
-
-        symbol = decode(s, &lencode);
-        if (symbol < 16)                /* length in 0..15 */
-            lengths[index++] = symbol;
-        else {                          /* repeat instruction */
-            len = 0;                    /* assume repeating zeros */
-            if (symbol == 16) {         /* repeat last length 3..6 times */
-                if (index == 0) return -5;      /* no last length! */
-                len = lengths[index - 1];       /* last length */
-                symbol = 3 + bits(s, 2);
-            }
-            else if (symbol == 17)      /* repeat zero 3..10 times */
-                symbol = 3 + bits(s, 3);
-            else                        /* == 18, repeat zero 11..138 times */
-                symbol = 11 + bits(s, 7);
-            if (index + symbol > nlen + ndist)
-                return -6;              /* too many lengths! */
-            while (symbol--)            /* repeat last or zero symbol times */
-                lengths[index++] = len;
-        }
-    }
-
-    /* build huffman table for literal/length codes */
-    err = construct(&lencode, lengths, nlen);
-    if (err < 0 || (err > 0 && nlen - lencode.count[0] != 1))
-        return -7;      /* only allow incomplete codes if just one code */
-
-    /* build huffman table for distance codes */
-    err = construct(&distcode, lengths + nlen, ndist);
-    if (err < 0 || (err > 0 && ndist - distcode.count[0] != 1))
-        return -8;      /* only allow incomplete codes if just one code */
-
-    /* decode data until end-of-block code */
-    return codes(s, &lencode, &distcode);
-}
-
-
-void _acrtused () { }
-
-// Decompress deflated data
+/*
+  puff.c
+  Copyright (C) 2002-2004 Mark Adler, all rights reserved
+  version 1.8, 9 Jan 2004
+
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the author be held liable for any damages
+  arising from the use of this software.
+
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+  Mark Adler    madler@alumni.caltech.edu
+*/
+
+/* Adapted for TrueCrypt */
+
+
+#define local static            /* for local function definitions */
+#define NIL ((unsigned char *)0)        /* for no output option */
+
+/*
+ * Maximums for allocations and loops.  It is not useful to change these --
+ * they are fixed by the deflate format.
+ */
+#define MAXBITS 15              /* maximum bits in a code */
+#define MAXLCODES 286           /* maximum number of literal/length codes */
+#define MAXDCODES 30            /* maximum number of distance codes */
+#define MAXCODES (MAXLCODES+MAXDCODES)  /* maximum codes lengths to read */
+#define FIXLCODES 288           /* number of fixed literal/length codes */
+
+/* input and output state */
+struct state {
+    /* output state */
+    unsigned char *out;         /* output buffer */
+    unsigned int outlen;       /* available space at out */
+    unsigned int outcnt;       /* bytes written to out so far */
+
+    /* input state */
+    unsigned char *in;          /* input buffer */
+    unsigned int inlen;			 /* available input at in */
+    unsigned int incnt;        /* bytes read so far */
+    int bitbuf;                 /* bit buffer */
+    int bitcnt;                 /* number of bits in bit buffer */
+};
+
+
+local int bits(struct state *s, int need)
+{
+    long val;           /* bit accumulator (can use up to 20 bits) */
+
+    /* load at least need bits into val */
+    val = s->bitbuf;
+    while (s->bitcnt < need) {
+        val |= (long)(s->in[s->incnt++]) << s->bitcnt;  /* load eight bits */
+        s->bitcnt += 8;
+    }
+
+    /* drop need bits and update buffer, always zero to seven bits left */
+    s->bitbuf = (int)(val >> need);
+    s->bitcnt -= need;
+
+    /* return need bits, zeroing the bits above that */
+    return (int)(val & ((1L << need) - 1));
+}
+
+
+local int stored(struct state *s)
+{
+    unsigned len;       /* length of stored block */
+
+    /* discard leftover bits from current byte (assumes s->bitcnt < 8) */
+    s->bitbuf = 0;
+    s->bitcnt = 0;
+
+    if (s->incnt + 4 > s->inlen)
+        return 2;                               /* not enough input */
+
+    /* get length and check against its one's complement */
+    len = s->in[s->incnt++];
+    len |= s->in[s->incnt++] << 8;
+    if (s->in[s->incnt++] != (~len & 0xff) ||
+        s->in[s->incnt++] != ((~len >> 8) & 0xff))
+        return -2;                              /* didn't match complement! */
+
+    if (s->incnt + len > s->inlen)
+        return 2;                               /* not enough input */
+
+    /* copy len bytes from in to out */
+    if (s->out != NIL) {
+        if (s->outcnt + len > s->outlen)
+            return 1;                           /* not enough output space */
+        while (len--)
+            s->out[s->outcnt++] = s->in[s->incnt++];
+    }
+    else {                                      /* just scanning */
+        s->outcnt += len;
+        s->incnt += len;
+    }
+
+    /* done with a valid stored block */
+    return 0;
+}
+
+
+struct huffman {
+    short *count;       /* number of symbols of each length */
+    short *symbol;      /* canonically ordered symbols */
+};
+
+/* reduce code size by using slow version of the decompressor */
+#define SLOW
+
+#ifdef SLOW
+local int decode(struct state *s, struct huffman *h)
+{
+    int len;            /* current number of bits in code */
+    int code;           /* len bits being decoded */
+    int first;          /* first code of length len */
+    int count;          /* number of codes of length len */
+    int index;          /* index of first code of length len in symbol table */
+
+    code = first = index = 0;
+    for (len = 1; len <= MAXBITS; len++) {
+        code |= bits(s, 1);             /* get next bit */
+        count = h->count[len];
+        if (code < first + count)       /* if length len, return symbol */
+            return h->symbol[index + (code - first)];
+        index += count;                 /* else update for next length */
+        first += count;
+        first <<= 1;
+        code <<= 1;
+    }
+    return -9;                          /* ran out of codes */
+}
+
+/*
+ * A faster version of decode() for real applications of this code.   It's not
+ * as readable, but it makes puff() twice as fast.  And it only makes the code
+ * a few percent larger.
+ */
+#else /* !SLOW */
+local int decode(struct state *s, struct huffman *h)
+{
+    int len;            /* current number of bits in code */
+    int code;           /* len bits being decoded */
+    int first;          /* first code of length len */
+    int count;          /* number of codes of length len */
+    int index;          /* index of first code of length len in symbol table */
+    int bitbuf;         /* bits from stream */
+    int left;           /* bits left in next or left to process */
+    short *next;        /* next number of codes */
+
+    bitbuf = s->bitbuf;
+    left = s->bitcnt;
+    code = first = index = 0;
+    len = 1;
+    next = h->count + 1;
+    while (1) {
+        while (left--) {
+            code |= bitbuf & 1;
+            bitbuf >>= 1;
+            count = *next++;
+            if (code < first + count) { /* if length len, return symbol */
+                s->bitbuf = bitbuf;
+                s->bitcnt = (s->bitcnt - len) & 7;
+                return h->symbol[index + (code - first)];
+            }
+            index += count;             /* else update for next length */
+            first += count;
+            first <<= 1;
+            code <<= 1;
+            len++;
+        }
+        left = (MAXBITS+1) - len;
+        if (left == 0) break;
+        bitbuf = s->in[s->incnt++];
+        if (left > 8) left = 8;
+    }
+    return -9;                          /* ran out of codes */
+}
+#endif /* SLOW */
+
+
+local int construct(struct huffman *h, short *length, int n)
+{
+    int symbol;         /* current symbol when stepping through length[] */
+    int len;            /* current length when stepping through h->count[] */
+    int left;           /* number of possible codes left of current length */
+    short offs[MAXBITS+1];      /* offsets in symbol table for each length */
+
+    /* count number of codes of each length */
+    for (len = 0; len <= MAXBITS; len++)
+        h->count[len] = 0;
+    for (symbol = 0; symbol < n; symbol++)
+        (h->count[length[symbol]])++;   /* assumes lengths are within bounds */
+    if (h->count[0] == n)               /* no codes! */
+        return 0;                       /* complete, but decode() will fail */
+
+    /* check for an over-subscribed or incomplete set of lengths */
+    left = 1;                           /* one possible code of zero length */
+    for (len = 1; len <= MAXBITS; len++) {
+        left <<= 1;                     /* one more bit, double codes left */
+        left -= h->count[len];          /* deduct count from possible codes */
+        if (left < 0) return left;      /* over-subscribed--return negative */
+    }                                   /* left > 0 means incomplete */
+
+    /* generate offsets into symbol table for each length for sorting */
+    offs[1] = 0;
+    for (len = 1; len < MAXBITS; len++)
+        offs[len + 1] = offs[len] + h->count[len];
+
+    /*
+     * put symbols in table sorted by length, by symbol order within each
+     * length
+     */
+    for (symbol = 0; symbol < n; symbol++)
+        if (length[symbol] != 0)
+            h->symbol[offs[length[symbol]]++] = symbol;
+
+    /* return zero for complete set, positive for incomplete set */
+    return left;
+}
+
+
+local int codes(struct state *s,
+                struct huffman *lencode,
+                struct huffman *distcode)
+{
+    int symbol;         /* decoded symbol */
+    int len;            /* length for copy */
+    unsigned dist;      /* distance for copy */
+    static const short lens[29] = { /* Size base for length codes 257..285 */
+        3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
+        35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
+    static const short lext[29] = { /* Extra bits for length codes 257..285 */
+        0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
+        3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
+    static const short dists[30] = { /* Offset base for distance codes 0..29 */
+        1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
+        257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
+        8193, 12289, 16385, 24577};
+    static const short dext[30] = { /* Extra bits for distance codes 0..29 */
+        0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
+        7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
+        12, 12, 13, 13};
+
+    /* decode literals and length/distance pairs */
+    do {
+        symbol = decode(s, lencode);
+        if (symbol < 0) return symbol;  /* invalid symbol */
+        if (symbol < 256) {             /* literal: symbol is the byte */
+            /* write out the literal */
+            if (s->out != NIL) {
+                if (s->outcnt == s->outlen) return 1;
+                s->out[s->outcnt] = symbol;
+            }
+            s->outcnt++;
+        }
+        else if (symbol > 256) {        /* length */
+            /* get and compute length */
+            symbol -= 257;
+            if (symbol >= 29) return -9;        /* invalid fixed code */
+            len = lens[symbol] + bits(s, lext[symbol]);
+
+            /* get and check distance */
+            symbol = decode(s, distcode);
+            if (symbol < 0) return symbol;          /* invalid symbol */
+            dist = dists[symbol] + bits(s, dext[symbol]);
+            if (dist > s->outcnt)
+                return -10;     /* distance too far back */
+
+            /* copy length bytes from distance bytes back */
+            if (s->out != NIL) {
+                if (s->outcnt + len > s->outlen) return 1;
+                while (len--) {
+                    s->out[s->outcnt] = s->out[s->outcnt - dist];
+                    s->outcnt++;
+                }
+            }
+            else
+                s->outcnt += len;
+        }
+    } while (symbol != 256);            /* end of block symbol */
+
+    /* done with a valid fixed or dynamic block */
+    return 0;
+}
+
+
+local int fixed(struct state *s)
+{
+    static int virgin = 1;
+    static short lencnt[MAXBITS+1], lensym[FIXLCODES];
+    static short distcnt[MAXBITS+1], distsym[MAXDCODES];
+    static struct huffman lencode = {lencnt, lensym};
+    static struct huffman distcode = {distcnt, distsym};
+
+    /* build fixed huffman tables if first call (may not be thread safe) */
+    if (virgin) {
+        int symbol;
+        short lengths[FIXLCODES];
+
+        /* literal/length table */
+        for (symbol = 0; symbol < 144; symbol++)
+            lengths[symbol] = 8;
+        for (; symbol < 256; symbol++)
+            lengths[symbol] = 9;
+        for (; symbol < 280; symbol++)
+            lengths[symbol] = 7;
+        for (; symbol < FIXLCODES; symbol++)
+            lengths[symbol] = 8;
+        construct(&lencode, lengths, FIXLCODES);
+
+        /* distance table */
+        for (symbol = 0; symbol < MAXDCODES; symbol++)
+            lengths[symbol] = 5;
+        construct(&distcode, lengths, MAXDCODES);
+
+        /* do this just once */
+        virgin = 0;
+    }
+
+    /* decode data until end-of-block code */
+    return codes(s, &lencode, &distcode);
+}
+
+
+local int dynamic(struct state *s)
+{
+    int nlen, ndist, ncode;             /* number of lengths in descriptor */
+    int index;                          /* index of lengths[] */
+    int err;                            /* construct() return value */
+    short lengths[MAXCODES];            /* descriptor code lengths */
+    short lencnt[MAXBITS+1], lensym[MAXLCODES];         /* lencode memory */
+    short distcnt[MAXBITS+1], distsym[MAXDCODES];       /* distcode memory */
+    struct huffman lencode = {lencnt, lensym};          /* length code */
+    struct huffman distcode = {distcnt, distsym};       /* distance code */
+    static const short order[19] =      /* permutation of code length codes */
+        {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
+
+    /* get number of lengths in each table, check lengths */
+    nlen = bits(s, 5) + 257;
+    ndist = bits(s, 5) + 1;
+    ncode = bits(s, 4) + 4;
+    if (nlen > MAXLCODES || ndist > MAXDCODES)
+        return -3;                      /* bad counts */
+
+    /* read code length code lengths (really), missing lengths are zero */
+    for (index = 0; index < ncode; index++)
+        lengths[order[index]] = bits(s, 3);
+    for (; index < 19; index++)
+        lengths[order[index]] = 0;
+
+    /* build huffman table for code lengths codes (use lencode temporarily) */
+    err = construct(&lencode, lengths, 19);
+    if (err != 0) return -4;            /* require complete code set here */
+
+    /* read length/literal and distance code length tables */
+    index = 0;
+    while (index < nlen + ndist) {
+        int symbol;             /* decoded value */
+        int len;                /* last length to repeat */
+
+        symbol = decode(s, &lencode);
+        if (symbol < 0)
+            return symbol;          /* invalid symbol */
+        if (symbol < 16)                /* length in 0..15 */
+            lengths[index++] = symbol;
+        else {                          /* repeat instruction */
+            len = 0;                    /* assume repeating zeros */
+            switch(symbol)
+            {
+               case 16: {         /* repeat last length 3..6 times */
+                  if (index == 0) return -5;      /* no last length! */
+                  len = lengths[index - 1];       /* last length */
+                  symbol = 3 + bits(s, 2);
+                  break;
+               }
+               case  17:      /* repeat zero 3..10 times */
+                  symbol = 3 + bits(s, 3);
+                  break;
+               default:                  /* == 18, repeat zero 11..138 times */
+                   symbol = 11 + bits(s, 7);
+                   break;
+             }
+            if ((index + symbol > nlen + ndist))
+                return -6;              /* too many lengths! */
+            while (symbol--)            /* repeat last or zero symbol times */
+                lengths[index++] = len;
+        }
+    }
+
+    /* check for end-of-block code -- there better be one! */
+    if (lengths[256] == 0)
+        return -9;
+
+    /* build huffman table for literal/length codes */
+    err = construct(&lencode, lengths, nlen);
+    if (err < 0 || (err > 0 && nlen - lencode.count[0] != 1))
+        return -7;      /* only allow incomplete codes if just one code */
+
+    /* build huffman table for distance codes */
+    err = construct(&distcode, lengths + nlen, ndist);
+    if (err < 0 || (err > 0 && ndist - distcode.count[0] != 1))
+        return -8;      /* only allow incomplete codes if just one code */
+
+    /* decode data until end-of-block code */
+    return codes(s, &lencode, &distcode);
+}
+
+
+void _acrtused () { }
+
+// Decompress deflated data
 int far main (
         unsigned char *dest,         /* pointer to destination pointer */
         unsigned int destlen,        /* amount of output space */
-         unsigned char *source)       /* pointer to source data pointer */
+         unsigned char *source,       /* pointer to source data pointer */
+         unsigned int sourcelen)
 {
    struct state s;             /* input/output state */
    int last, type;             /* block information */
@@ -417,6 +439,7 @@ int far main (

    /* initialize input state */
    s.in = source;
+    s.inlen = sourcelen;
    s.incnt = 0;
    s.bitbuf = 0;
    s.bitcnt = 0;
@@ -425,12 +448,24 @@ int far main (
 	do {
 		last = bits(&s, 1);         /* one if last block */
 		type = bits(&s, 2);         /* block type 0..3 */
-		err = type == 0 ? stored(&s) :
-			(type == 1 ? fixed(&s) :
-			(type == 2 ? dynamic(&s) :
-			-1));               /* type == 3, invalid */
+		switch(type)
+		{
+		case 0:
+			err = stored(&s);
+			break;
+		case 1:
+			err = fixed(&s);
+			break;
+		case 2:
+			err = dynamic(&s);
+			break;
+		default:
+			err = -1; /* type == 3, invalid */
+			break;
+		}
+
 		if (err != 0) break;        /* return with error */
 	} while (!last);

 	return err;
-}
+}
@@ -39,6 +39,13 @@ OBJDIR = $(OBJDIR)_$(SINGLE_CIPHER)
 CFLAGS = $(CFLAGS) /D TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE /D TC_WINDOWS_BOOT_$(SINGLE_CIPHER)
 !endif

+!ifdef SINGLE_PRF
+OBJDIR = $(OBJDIR)_$(SINGLE_PRF)
+CFLAGS = $(CFLAGS) /D TC_WINDOWS_BOOT_$(SINGLE_PRF)
+!else
+CFLAGS = $(CFLAGS) /D TC_WINDOWS_BOOT_RIPEMD160
+!endif
+
 OUTDIR = $(OBJDIR)
 TARGETEXT = com
 TARGETS = $(OUTDIR)\BootDefs.i $(OUTDIR)\BootSector.bin $(OUTDIR)\Decompressor.com
@@ -72,7 +79,11 @@ OBJS = $(OBJS) $(OUTDIR)\Pkcs5.obj
 OBJS = $(OBJS) $(OUTDIR)\Volumes.obj
 OBJS = $(OBJS) $(OUTDIR)\Xts.obj

+!if "$(SINGLE_PRF)" == "SHA2"
+OBJS = $(OBJS) $(OUTDIR)\Sha2Small.obj
+!else
 OBJS = $(OBJS) $(OUTDIR)\Rmd160.obj
+!endif

 !if !DEFINED (SINGLE_CIPHER)
 OBJS = $(OBJS) $(OUTDIR)\AesSmall.obj
@@ -0,0 +1,29 @@
+# Absolute path to this script
+SCRIPT=$(readlink -f "$0")
+# Absolute path this script is in
+SCRIPTPATH=$(dirname "$SCRIPT")
+# source directory which contains the Makefile
+SOURCEPATH=$(readlink -f "$SCRIPTPATH/..")
+# directory where the VeraCrypt has been checked out
+PARENTDIR=$(readlink -f "$SCRIPTPATH/../../..")
+
+# Make sure only root can run our script
+if [ "$(id -u)" != "0" ]; then
+   echo "VeraCrypt must be built by root" 1>&2
+   exit 1
+fi
+
+# the sources of wxWidgets 3.0.2 must be extracted to the parent directory
+export WX_ROOT=$PARENTDIR/wxWidgets-3.0.2
+echo "Using wxWidgets sources in $WX_ROOT"
+
+# this will be the temporary wxWidgets directory
+export WX_BUILD_DIR=$PARENTDIR/wxBuild
+
+cd $SOURCEPATH
+
+echo "Building GUI version of VeraCrypt"
+make WXSTATIC=1 wxbuild && make WXSTATIC=1 clean && make WXSTATIC=1
+
+echo "Building console version of VeraCrypt"
+make WXSTATIC=1 NOGUI=1 wxbuild && make WXSTATIC=1 NOGUI=1 clean && make WXSTATIC=1 NOGUI=1
@@ -0,0 +1,24 @@
+# Absolute path this script is in
+SCRIPTPATH=$(cd "$(dirname "$0")"; pwd)
+# source directory which contains the Makefile
+SOURCEPATH=$(cd "$(dirname "$SCRIPTPATH/../.")"; pwd)
+# directory where the VeraCrypt project has been checked out
+PARENTDIR=$(cd "$(dirname "$SCRIPTPATH/../../../.")"; pwd)
+
+# the sources of wxWidgets 3.0.2 must be extracted to the parent directory
+export WX_ROOT=$PARENTDIR/wxWidgets-3.0.2
+echo "Using wxWidgets sources in $WX_ROOT"
+
+# this will be the temporary wxWidgets directory
+export WX_BUILD_DIR=$PARENTDIR/wxBuild
+
+# define the SDK version to use. We use 10.6 by default
+export VC_OSX_TARGET=10.6
+echo "Using MacOSX SDK $VC_OSX_TARGET"
+
+
+cd $SOURCEPATH
+
+echo "Building VeraCrypt"
+make WXSTATIC=1 wxbuild && make WXSTATIC=1 clean && make WXSTATIC=1
+
@@ -241,6 +241,7 @@ typedef struct
 typedef struct
 {
 	char BootEncryptionAlgorithmName[256];
+	char BootPrfAlgorithmName[256];
 } GetBootEncryptionAlgorithmNameRequest;

 typedef struct
@@ -375,6 +375,7 @@ namespace VeraCrypt
 		RescueIsoImage (nullptr),
 		RescueVolumeHeaderValid (false),
 		SelectedEncryptionAlgorithmId (0),
+		SelectedPrfAlgorithmId (0),
 		VolumeHeaderValid (false)
 	{
      HiddenOSCandidatePartition.IsGPT = FALSE;
@@ -975,11 +976,16 @@ namespace VeraCrypt
 		ZeroMemory (buffer, bufferSize);

 		int ea = 0;
+		int pkcs5_prf = 0;
 		if (GetStatus().DriveMounted)
 		{
 			try
 			{
 				GetBootEncryptionAlgorithmNameRequest request;
+				// since we added new field to GetBootEncryptionAlgorithmNameRequest since version 1.0f
+				// we zero all the structure so that if we are talking to an older driver, the field
+				// BootPrfAlgorithmName will be an empty string
+				ZeroMemory(&request, sizeof(request));
 				CallDriver (TC_IOCTL_GET_BOOT_ENCRYPTION_ALGORITHM_NAME, NULL, 0, &request, sizeof (request));

 				if (_stricmp (request.BootEncryptionAlgorithmName, "AES") == 0)
@@ -988,6 +994,13 @@ namespace VeraCrypt
 					ea = SERPENT;
 				else if (_stricmp (request.BootEncryptionAlgorithmName, "Twofish") == 0)
 					ea = TWOFISH;
+
+				if (_stricmp(request.BootPrfAlgorithmName, "SHA-256") == 0)
+					pkcs5_prf = SHA256;
+				else if (_stricmp(request.BootPrfAlgorithmName, "RIPEMD-160") == 0)
+					pkcs5_prf = RIPEMD160;
+				else if (strlen(request.BootPrfAlgorithmName) == 0) // case of version < 1.0f
+					pkcs5_prf = RIPEMD160;
 			}
 			catch (...)
 			{
@@ -996,36 +1009,77 @@ namespace VeraCrypt
 					VOLUME_PROPERTIES_STRUCT properties;
 					GetVolumeProperties (&properties);
 					ea = properties.ea;
+					pkcs5_prf = properties.pkcs5;
 				}
 				catch (...) { }
 			}
 		}
 		else
 		{
-			if (SelectedEncryptionAlgorithmId == 0)
+			if (SelectedEncryptionAlgorithmId == 0 || SelectedPrfAlgorithmId == 0)
 				throw ParameterIncorrect (SRC_POS);

 			ea = SelectedEncryptionAlgorithmId;
+			pkcs5_prf = SelectedPrfAlgorithmId;
 		}

-		int bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR : IDR_BOOT_SECTOR;
-		int bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER : IDR_BOOT_LOADER;
+		// Only RIPEMD160 and SHA-256 are supported for boot loader
+		if (pkcs5_prf != RIPEMD160 && pkcs5_prf != SHA256)
+			throw ParameterIncorrect (SRC_POS);
+
+		int bootSectorId = 0;
+		int bootLoaderId = 0;
+
+		if (pkcs5_prf == SHA256)
+		{
+			bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_SHA2 : IDR_BOOT_SECTOR_SHA2;
+			bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_SHA2 : IDR_BOOT_LOADER_SHA2;
+		}
+		else
+		{
+			bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR : IDR_BOOT_SECTOR;
+			bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER : IDR_BOOT_LOADER;
+		}

 		switch (ea)
 		{
 		case AES:
-			bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_AES : IDR_BOOT_SECTOR_AES;
-			bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_AES : IDR_BOOT_LOADER_AES;
+			if (pkcs5_prf == SHA256)
+			{
+				bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_AES_SHA2 : IDR_BOOT_SECTOR_AES_SHA2;
+				bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_AES_SHA2 : IDR_BOOT_LOADER_AES_SHA2;
+			}
+			else
+			{
+				bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_AES : IDR_BOOT_SECTOR_AES;
+				bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_AES : IDR_BOOT_LOADER_AES;
+			}
 			break;

 		case SERPENT:
-			bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_SERPENT : IDR_BOOT_SECTOR_SERPENT;
-			bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_SERPENT : IDR_BOOT_LOADER_SERPENT;
+			if (pkcs5_prf == SHA256)
+			{
+				bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_SERPENT_SHA2 : IDR_BOOT_SECTOR_SERPENT_SHA2;
+				bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_SERPENT_SHA2 : IDR_BOOT_LOADER_SERPENT_SHA2;
+			}
+			else
+			{
+				bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_SERPENT : IDR_BOOT_SECTOR_SERPENT;
+				bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_SERPENT : IDR_BOOT_LOADER_SERPENT;
+			}
 			break;

 		case TWOFISH:
-			bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_TWOFISH : IDR_BOOT_SECTOR_TWOFISH;
-			bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_TWOFISH : IDR_BOOT_LOADER_TWOFISH;
+			if (pkcs5_prf == SHA256)
+			{
+				bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_TWOFISH_SHA2 : IDR_BOOT_SECTOR_TWOFISH_SHA2;
+				bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_TWOFISH_SHA2 : IDR_BOOT_LOADER_TWOFISH_SHA2;
+			}
+			else
+			{
+				bootSectorId = rescueDisk ? IDR_RESCUE_BOOT_SECTOR_TWOFISH : IDR_BOOT_SECTOR_TWOFISH;
+				bootLoaderId = rescueDisk ? IDR_RESCUE_LOADER_TWOFISH : IDR_BOOT_LOADER_TWOFISH;
+			}
 			break;
 		}

@@ -1084,7 +1138,7 @@ namespace VeraCrypt

 			buffer[TC_BOOT_SECTOR_CONFIG_OFFSET] |= TC_BOOT_CFG_FLAG_BACKUP_LOADER_AVAILABLE;
 		}
-		else if (!rescueDisk && bootLoaderId != IDR_BOOT_LOADER)
+		else if (!rescueDisk && bootLoaderId != IDR_BOOT_LOADER && bootLoaderId != IDR_BOOT_LOADER_SHA2)
 		{
 			throw ParameterIncorrect (SRC_POS);
 		}
@@ -2064,7 +2118,7 @@ namespace VeraCrypt
 	{
 		BootEncryptionStatus encStatus = GetStatus();

-		if (encStatus.SetupInProgress)
+		if (encStatus.SetupInProgress || (wipePassCount <= 0))
 			throw ParameterIncorrect (SRC_POS);

 		SystemDriveConfiguration config = GetSystemDriveConfiguration ();
@@ -2253,6 +2307,7 @@ namespace VeraCrypt
 		BackupSystemLoader();

 		SelectedEncryptionAlgorithmId = ea;
+		SelectedPrfAlgorithmId = pkcs5;
 	}


@@ -2307,6 +2362,7 @@ namespace VeraCrypt
 		}

 		SelectedEncryptionAlgorithmId = ea;
+		SelectedPrfAlgorithmId = pkcs5;
 		CreateVolumeHeader (volumeSize, encryptedAreaStart, &password, ea, mode, pkcs5);
 		
 		if (!rescueIsoImagePath.empty())
@@ -215,6 +215,7 @@ namespace VeraCrypt
 		HWND ParentWindow;
 		SystemDriveConfiguration DriveConfig;
 		int SelectedEncryptionAlgorithmId;
+		int SelectedPrfAlgorithmId;
 		Partition HiddenOSCandidatePartition;
 		byte *RescueIsoImage;
 		byte RescueVolumeHeader[TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE];
@@ -449,6 +449,17 @@ IDR_BOOT_LOADER         BIN                     "..\\Boot\\Windows\\Release\\Boo
 IDR_BOOT_LOADER_AES     BIN                     "..\\Boot\\Windows\\Release_AES\\BootLoader.com.gz"
 IDR_BOOT_LOADER_SERPENT BIN                     "..\\Boot\\Windows\\Release_Serpent\\BootLoader.com.gz"
 IDR_BOOT_LOADER_TWOFISH BIN                     "..\\Boot\\Windows\\Release_Twofish\\BootLoader.com.gz"
+
+IDR_BOOT_SECTOR_SHA2         BIN                     "..\\Boot\\Windows\\Release_SHA2\\BootSector.bin"
+IDR_BOOT_SECTOR_AES_SHA2     BIN                     "..\\Boot\\Windows\\Release_AES_SHA2\\BootSector.bin"
+IDR_BOOT_SECTOR_SERPENT_SHA2 BIN                     "..\\Boot\\Windows\\Release_Serpent_SHA2\\BootSector.bin"
+IDR_BOOT_SECTOR_TWOFISH_SHA2 BIN                     "..\\Boot\\Windows\\Release_Twofish_SHA2\\BootSector.bin"
+IDR_BOOT_LOADER_SHA2         BIN                     "..\\Boot\\Windows\\Release_SHA2\\BootLoader.com.gz"
+IDR_BOOT_LOADER_AES_SHA2	  BIN                     "..\\Boot\\Windows\\Release_AES_SHA2\\BootLoader.com.gz"
+IDR_BOOT_LOADER_SERPENT_SHA2 BIN                     "..\\Boot\\Windows\\Release_Serpent_SHA2\\BootLoader.com.gz"
+IDR_BOOT_LOADER_TWOFISH_SHA2 BIN                     "..\\Boot\\Windows\\Release_Twofish_SHA2\\BootLoader.com.gz"
+
+
 IDR_RESCUE_BOOT_SECTOR  BIN                     "..\\Boot\\Windows\\Rescue\\BootSector.bin"
 IDR_RESCUE_BOOT_SECTOR_AES BIN                     "..\\Boot\\Windows\\Rescue_AES\\BootSector.bin"
 IDR_RESCUE_BOOT_SECTOR_SERPENT BIN                     "..\\Boot\\Windows\\Rescue_Serpent\\BootSector.bin"
@@ -458,6 +469,15 @@ IDR_RESCUE_LOADER_AES   BIN                     "..\\Boot\\Windows\\Rescue_AES\\
 IDR_RESCUE_LOADER_SERPENT BIN                     "..\\Boot\\Windows\\Rescue_Serpent\\BootLoader.com.gz"
 IDR_RESCUE_LOADER_TWOFISH BIN                     "..\\Boot\\Windows\\Rescue_Twofish\\BootLoader.com.gz"

+IDR_RESCUE_BOOT_SECTOR_SHA2  BIN                     "..\\Boot\\Windows\\Rescue_SHA2\\BootSector.bin"
+IDR_RESCUE_BOOT_SECTOR_AES_SHA2 BIN                     "..\\Boot\\Windows\\Rescue_AES_SHA2\\BootSector.bin"
+IDR_RESCUE_BOOT_SECTOR_SERPENT_SHA2 BIN                     "..\\Boot\\Windows\\Rescue_Serpent_SHA2\\BootSector.bin"
+IDR_RESCUE_BOOT_SECTOR_TWOFISH_SHA2 BIN                     "..\\Boot\\Windows\\Rescue_Twofish_SHA2\\BootSector.bin"
+IDR_RESCUE_LOADER_SHA2   BIN                     "..\\Boot\\Windows\\Rescue_SHA2\\BootLoader.com.gz"
+IDR_RESCUE_LOADER_AES_SHA2   BIN                 "..\\Boot\\Windows\\Rescue_AES_SHA2\\BootLoader.com.gz"
+IDR_RESCUE_LOADER_SERPENT_SHA2 BIN               "..\\Boot\\Windows\\Rescue_Serpent_SHA2\\BootLoader.com.gz"
+IDR_RESCUE_LOADER_TWOFISH_SHA2 BIN               "..\\Boot\\Windows\\Rescue_Twofish_SHA2\\BootLoader.com.gz"
+
 /////////////////////////////////////////////////////////////////////////////
 //
 // XML
@@ -90,11 +90,12 @@ static EncryptionAlgorithm EncryptionAlgorithms[] =
 // Hash algorithms
 static Hash Hashes[] =
 {	// ID			Name			Deprecated		System Encryption
-	{ RIPEMD160,	"RIPEMD-160",	FALSE,			TRUE },
 #ifndef TC_WINDOWS_BOOT
 	{ SHA512,		"SHA-512",		FALSE,			FALSE },
 	{ WHIRLPOOL,	"Whirlpool",	FALSE,			FALSE },
 #endif
+	{ SHA256,		"SHA-256",		FALSE,			TRUE },
+	{ RIPEMD160,	"RIPEMD-160",	TRUE,			TRUE },
 	{ 0, 0, 0 }
 };

@@ -119,11 +120,11 @@ int CipherInit (int cipher, unsigned char *key, unsigned __int8 *ks)
 		break;

 	case SERPENT:
-		serpent_set_key (key, CipherGetKeySize(SERPENT) * 8, ks);
+		serpent_set_key (key, ks);
 		break;
 		
 	case TWOFISH:
-		twofish_set_key ((TwofishInstance *)ks, (const u4byte *)key, CipherGetKeySize(TWOFISH) * 8);
+		twofish_set_key ((TwofishInstance *)ks, (const u4byte *)key);
 		break;

 	default:
@@ -275,28 +276,47 @@ Cipher *CipherGet (int id)
 	return NULL;
 }

-const char *CipherGetName (int cipherId)
+#ifndef TC_WINDOWS_BOOT
+const
+#endif
+char *CipherGetName (int cipherId)
 {
+#ifdef TC_WINDOWS_BOOT
+	return CipherGet (cipherId) -> Name;
+#else
   Cipher* pCipher = CipherGet (cipherId);
   return  pCipher? pCipher -> Name : "";
+#endif
 }

 int CipherGetBlockSize (int cipherId)
 {
+#ifdef TC_WINDOWS_BOOT
+	return CipherGet (cipherId) -> BlockSize;
+#else
   Cipher* pCipher = CipherGet (cipherId);
   return pCipher? pCipher -> BlockSize : 0;
+#endif
 }

 int CipherGetKeySize (int cipherId)
 {
+#ifdef TC_WINDOWS_BOOT
+	return CipherGet (cipherId) -> KeySize;
+#else
   Cipher* pCipher = CipherGet (cipherId);
   return pCipher? pCipher -> KeySize : 0;
+#endif
 }

 int CipherGetKeyScheduleSize (int cipherId)
 {
+#ifdef TC_WINDOWS_BOOT
+	return CipherGet (cipherId) -> KeyScheduleSize;
+#else
   Cipher* pCipher = CipherGet (cipherId);
   return pCipher? pCipher -> KeyScheduleSize : 0;
+#endif
 }

 #ifndef TC_WINDOWS_BOOT
@@ -619,20 +639,55 @@ int HashGetIdByName (char *name)
 	return 0;
 }

-
-const char *HashGetName (int hashId)
+#ifndef TC_WINDOWS_BOOT
+const
+#endif
+char *HashGetName (int hashId)
 {
+#ifdef TC_WINDOWS_BOOT
+	return HashGet(hashId) -> Name;
+#else
   Hash* pHash = HashGet(hashId);
   return pHash? pHash -> Name : "";
+#endif
 }

+#ifndef TC_WINDOWS_BOOT
+void HashGetName2 (char *buf, int hashId)
+{
+   Hash* pHash = HashGet(hashId);
+   if (pHash)
+		strcpy(buf, pHash -> Name);
+	else
+		buf[0] = '\0';
+}

 BOOL HashIsDeprecated (int hashId)
 {
   Hash* pHash = HashGet(hashId);
   return pHash? pHash -> Deprecated : FALSE;
+
 }

+BOOL HashForSystemEncryption (int hashId)
+{
+   Hash* pHash = HashGet(hashId);
+   return pHash? pHash -> SystemEncryption : FALSE;
+
+}
+
+// Returns the maximum number of bytes necessary to be generated by the PBKDF2 (PKCS #5)
+int GetMaxPkcs5OutSize (void)
+{
+	int size = 32;
+
+	size = max (size, EAGetLargestKeyForMode (XTS) * 2);	// Sizes of primary + secondary keys
+
+	return size;
+}
+
+#endif
+

 #endif // TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE

@@ -875,17 +930,6 @@ void DecryptDataUnitsCurrentThread (unsigned __int8 *buf, const UINT64_STRUCT *s
 }


-// Returns the maximum number of bytes necessary to be generated by the PBKDF2 (PKCS #5)
-int GetMaxPkcs5OutSize (void)
-{
-	int size = 32;
-
-	size = max (size, EAGetLargestKeyForMode (XTS) * 2);	// Sizes of primary + secondary keys
-
-	return size;
-}
-
-
 #else // TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE


@@ -921,20 +965,11 @@ void DecipherBlock(int cipher, void *data, void *ks)
 #endif
 }

-int EAGetFirst ()
-{
-	return 1;
-}

-int EAGetNext (int previousEA)
-{
-	return 0;
-}
-
-int EAInit (int ea, unsigned char *key, unsigned __int8 *ks)
-{
 #ifdef TC_WINDOWS_BOOT_AES

+int EAInit (unsigned char *key, unsigned __int8 *ks)
+{
 	aes_init();

 	if (aes_encrypt_key256 (key, (aes_encrypt_ctx *) ks) != EXIT_SUCCESS)
@@ -942,23 +977,11 @@ int EAInit (int ea, unsigned char *key, unsigned __int8 *ks)
 	if (aes_decrypt_key256 (key, (aes_decrypt_ctx *) (ks + sizeof (aes_encrypt_ctx))) != EXIT_SUCCESS)
 		return ERR_CIPHER_INIT_FAILURE;

-#elif defined (TC_WINDOWS_BOOT_SERPENT)
-	serpent_set_key (key, 32 * 8, ks);
-#elif defined (TC_WINDOWS_BOOT_TWOFISH)
-	twofish_set_key ((TwofishInstance *)ks, (const u4byte *)key, 32 * 8);
-#endif
 	return ERR_SUCCESS;
 }

-int EAGetKeySize (int ea)
-{
-	return 32;
-}
+#endif

-int EAGetFirstCipher (int ea)
-{
-	return 1;
-}

 void EncryptBuffer (unsigned __int8 *buf, TC_LARGEST_COMPILER_UINT len, PCRYPTO_INFO cryptoInfo)
 {
@@ -48,11 +48,10 @@ extern "C" {
 // Hash algorithms (pseudorandom functions). 
 enum
 {
-	RIPEMD160 = FIRST_PRF_ID,
-#ifndef TC_WINDOWS_BOOT
-	SHA512,
+	SHA512 = FIRST_PRF_ID,
 	WHIRLPOOL,
-#endif
+	SHA256,
+	RIPEMD160,
 	HASH_ENUM_END_ID
 };

@@ -62,6 +61,9 @@ enum
 #define RIPEMD160_BLOCKSIZE		64
 #define RIPEMD160_DIGESTSIZE	20

+#define SHA256_BLOCKSIZE		64
+#define SHA256_DIGESTSIZE		32
+
 #define SHA512_BLOCKSIZE		128
 #define SHA512_DIGESTSIZE		64

@@ -71,7 +73,7 @@ enum
 #define MAX_DIGESTSIZE			WHIRLPOOL_DIGESTSIZE

 #define DEFAULT_HASH_ALGORITHM			FIRST_PRF_ID
-#define DEFAULT_HASH_ALGORITHM_BOOT		RIPEMD160
+#define DEFAULT_HASH_ALGORITHM_BOOT		SHA256

 // The mode of operation used for newly created volumes and first to try when mounting
 #define FIRST_MODE_OF_OPERATION_ID		1
@@ -207,8 +209,7 @@ typedef struct CRYPTO_INFO_t
 	unsigned __int8 master_keydata[MASTER_KEYDATA_SIZE];	/* This holds the volume header area containing concatenated master key(s) and secondary key(s) (XTS mode). For LRW (deprecated/legacy), it contains the tweak key before the master key(s). For CBC (deprecated/legacy), it contains the IV seed before the master key(s). */
 	unsigned __int8 k2[MASTER_KEYDATA_SIZE];				/* For XTS, this contains the secondary key (if cascade, multiple concatenated). For LRW (deprecated/legacy), it contains the tweak key. For CBC (deprecated/legacy), it contains the IV seed. */
 	unsigned __int8 salt[PKCS5_SALT_SIZE];
-	int noIterations;
-	int pkcs5;
+	int noIterations;	

 	uint64 volume_creation_time;	// Legacy
 	uint64 header_creation_time;	// Legacy
@@ -239,6 +240,7 @@ typedef struct CRYPTO_INFO_t
 	UINT64_STRUCT EncryptedAreaLength;

 	uint32 HeaderFlags;
+	int pkcs5;

 } CRYPTO_INFO, *PCRYPTO_INFO;

@@ -250,10 +252,18 @@ int CipherGetBlockSize (int cipher);
 int CipherGetKeySize (int cipher);
 int CipherGetKeyScheduleSize (int cipher);
 BOOL CipherSupportsIntraDataUnitParallelization (int cipher);
-const char * CipherGetName (int cipher);
+
+#ifndef TC_WINDOWS_BOOT
+const
+#endif
+char * CipherGetName (int cipher);

 int CipherInit (int cipher, unsigned char *key, unsigned char *ks);
+#ifndef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
 int EAInit (int ea, unsigned char *key, unsigned char *ks);
+#else
+int EAInit (unsigned char *key, unsigned char *ks);
+#endif
 BOOL EAInitMode (PCRYPTO_INFO ci);
 void EncipherBlock(int cipher, void *data, void *ks);
 void DecipherBlock(int cipher, void *data, void *ks);
@@ -283,10 +293,19 @@ int EAGetPreviousCipher (int ea, int previousCipherId);
 int EAIsFormatEnabled (int ea);
 BOOL EAIsModeSupported (int ea, int testedMode);

-const char *HashGetName (int hash_algo_id);
-BOOL HashIsDeprecated (int hashId);

+#ifndef TC_WINDOWS_BOOT
+const
+#endif
+char *HashGetName (int hash_algo_id);
+
+#ifndef TC_WINDOWS_BOOT
+void HashGetName2 (char *buf, int hashId);
+BOOL HashIsDeprecated (int hashId);
+BOOL HashForSystemEncryption (int hashId);
 int GetMaxPkcs5OutSize (void);
+#endif
+

 void EncryptDataUnits (unsigned __int8 *buf, const UINT64_STRUCT *structUnitNo, uint32 nbrUnits, PCRYPTO_INFO ci);
 void EncryptDataUnitsCurrentThread (unsigned __int8 *buf, const UINT64_STRUCT *structUnitNo, TC_LARGEST_COMPILER_UINT nbrUnits, PCRYPTO_INFO ci);
@@ -4363,6 +4363,7 @@ static BOOL PerformBenchmark(HWND hwndDlg)
 		WHIRLPOOL_CTX	wctx;
 		RMD160_CTX		rctx;
 		sha512_ctx		s2ctx;
+		sha256_ctx		s256ctx;
 		int hid;

 		for (hid = FIRST_PRF_ID; hid <= LAST_PRF_ID; hid++) 
@@ -4379,6 +4380,12 @@ static BOOL PerformBenchmark(HWND hwndDlg)
 				sha512_end ((unsigned char *) digest, &s2ctx);
 				break;

+			case SHA256:
+				sha256_begin (&s256ctx);
+				sha256_hash (lpTestBuffer, benchmarkBufferSize, &s256ctx);
+				sha256_end ((unsigned char *) digest, &s256ctx);
+				break;
+
 			case RIPEMD160:
 				RMD160Init(&rctx);
 				RMD160Update(&rctx, lpTestBuffer, benchmarkBufferSize);
@@ -4433,9 +4440,14 @@ static BOOL PerformBenchmark(HWND hwndDlg)
 					derive_key_sha512 ("passphrase-1234567890", 21, tmp_salt, 64, get_pkcs5_iteration_count(thid, FALSE), dk, MASTER_KEYDATA_SIZE);
 					break;

+				case SHA256:
+					/* PKCS-5 test with HMAC-SHA-256 used as the PRF */
+					derive_key_sha256 ("passphrase-1234567890", 21, tmp_salt, 64, get_pkcs5_iteration_count(thid, FALSE), dk, MASTER_KEYDATA_SIZE);
+					break;
+
 				case RIPEMD160:
 					/* PKCS-5 test with HMAC-RIPEMD-160 used as the PRF */
-					derive_key_ripemd160 (FALSE, "passphrase-1234567890", 21, tmp_salt, 64, get_pkcs5_iteration_count(thid, FALSE), dk, MASTER_KEYDATA_SIZE);
+					derive_key_ripemd160 ("passphrase-1234567890", 21, tmp_salt, 64, get_pkcs5_iteration_count(thid, FALSE), dk, MASTER_KEYDATA_SIZE);
 					break;

 				case WHIRLPOOL:
@@ -6949,7 +6961,7 @@ BOOL PrintHardCopyTextUTF16 (wchar_t *text, char *title, int textByteLen)
 		StringCbCopyA(filename, sizeof(filename), "C:\\Windows\\" PRINT_TOOL);

 	WaitCursor ();
-	ShellExecute (NULL, "open", PRINT_TOOL, cl, NULL, SW_HIDE);
+	ShellExecute (NULL, "open", filename, cl, NULL, SW_HIDE);
 	Sleep (6000);
 	NormalCursor();

@@ -8414,7 +8426,8 @@ void HandleDriveNotReadyError ()

 BOOL CALLBACK CloseTCWindowsEnum (HWND hwnd, LPARAM lParam)
 {
-	if (GetWindowLongPtr (hwnd, GWLP_USERDATA) == (LONG_PTR) 'VERA')
+	LONG_PTR userDataVal = GetWindowLongPtr (hwnd, GWLP_USERDATA);
+	if ((userDataVal == (LONG_PTR) 'VERA') || (userDataVal == (LONG_PTR) 'TRUE')) // Prior to 1.0e, 'TRUE' was used for VeraCrypt dialogs
 	{
 		char name[1024] = { 0 };
 		GetWindowText (hwnd, name, sizeof (name) - 1);
@@ -8422,9 +8435,6 @@ BOOL CALLBACK CloseTCWindowsEnum (HWND hwnd, LPARAM lParam)
 		{
 			PostMessage (hwnd, TC_APPMSG_CLOSE_BKG_TASK, 0, 0);

-			if (DriverVersion < 0x0430)
-				PostMessage (hwnd, WM_ENDSESSION, 0, 0);
-
 			PostMessage (hwnd, WM_CLOSE, 0, 0);

 			if (lParam != 0)
@@ -8439,7 +8449,8 @@ BOOL CALLBACK FindTCWindowEnum (HWND hwnd, LPARAM lParam)
 	if (*(HWND *)lParam == hwnd)
 		return TRUE;

-	if (GetWindowLongPtr (hwnd, GWLP_USERDATA) == (LONG_PTR) 'VERA')
+	LONG_PTR userDataVal = GetWindowLongPtr (hwnd, GWLP_USERDATA);
+	if ((userDataVal == (LONG_PTR) 'VERA') || (userDataVal == (LONG_PTR) 'TRUE')) // Prior to 1.0e, 'TRUE' was used for VeraCrypt dialogs
 	{
 		char name[32] = { 0 };
 		GetWindowText (hwnd, name, sizeof (name) - 1);
@@ -159,7 +159,7 @@ static TC_THREAD_PROC EncryptionThreadProc (void *threadArg)
 			switch (workItem->KeyDerivation.Pkcs5Prf)
 			{
 			case RIPEMD160:
-				derive_key_ripemd160 (TRUE, workItem->KeyDerivation.Password, workItem->KeyDerivation.PasswordLength, workItem->KeyDerivation.Salt, PKCS5_SALT_SIZE,
+				derive_key_ripemd160 (workItem->KeyDerivation.Password, workItem->KeyDerivation.PasswordLength, workItem->KeyDerivation.Salt, PKCS5_SALT_SIZE,
 					workItem->KeyDerivation.IterationCount, workItem->KeyDerivation.DerivedKey, GetMaxPkcs5OutSize());
 				break;

@@ -173,6 +173,11 @@ static TC_THREAD_PROC EncryptionThreadProc (void *threadArg)
 					workItem->KeyDerivation.IterationCount, workItem->KeyDerivation.DerivedKey, GetMaxPkcs5OutSize());
 				break;

+			case SHA256:
+				derive_key_sha256 (workItem->KeyDerivation.Password, workItem->KeyDerivation.PasswordLength, workItem->KeyDerivation.Salt, PKCS5_SALT_SIZE,
+					workItem->KeyDerivation.IterationCount, workItem->KeyDerivation.DerivedKey, GetMaxPkcs5OutSize());
+				break;
+
 			default:		
 				TC_THROW_FATAL_EXCEPTION;
 			} 
@@ -726,22 +726,6 @@ static void GfMul128Basic (unsigned __int8 *a, unsigned __int8 *b, unsigned __in
 	}
 }

-static void xor64 (uint64 *a, uint64 *b)
-{
-	*a ^= *b;
-}
-
-static void shl64 (unsigned __int8 *a)
-{
-	int i, x = 0, xx;
-	for (i = 7; i >= 0; i--)
-	{
-		xx = (a[i] & 0x80) >> 7;
-		a[i] = (char) ((a[i] << 1) | x);
-		x = xx;
-	}
-}
-

 BOOL GfMulSelfTest ()
 {
@@ -476,7 +476,7 @@
    <string lang="en" key="FORMAT_FINISHED_HELP">\n\nThe VeraCrypt volume has been created and is ready for use. If you wish to create another VeraCrypt volume, click Next. Otherwise, click Exit.</string>
    <string lang="en" key="SYSENC_HIDDEN_VOL_FORMAT_FINISHED_HELP">\n\nThe hidden VeraCrypt volume has been successfully created (the hidden operating system will reside within this hidden volume).\n\nClick Next to continue.</string>
    <string lang="en" key="NONSYS_INPLACE_ENC_FINISHED_TITLE">Volume Fully Encrypted</string>
-    <string lang="en" key="NONSYS_INPLACE_ENC_FINISHED_INFO">IMPORTANT: TO MOUNT THIS NEWLY CREATED HDCRYPT VOLUME AND TO ACCESS DATA STORED IN IT, CLICK 'Auto-Mount Devices' IN THE MAIN TRUECRYPT WINDOW. After you enter the correct password (and/or supply correct keyfiles), the volume will be mounted to the drive letter you select from the list in the main VeraCrypt window (and you will be able to access the encrypted data via the selected drive letter).\n\nPLEASE REMEMBER OR WRITE DOWN THE ABOVE STEPS. YOU MUST FOLLOW THEM WHENEVER YOU WANT TO MOUNT THE VOLUME AND ACCESS DATA STORED IN IT. Alternatively, in the main VeraCrypt window, click 'Select Device', then select this partition/volume, and click 'Mount'.\n\nThe partition/volume has been successfully encrypted (it contains a fully encrypted VeraCrypt volume now) and is ready for use.</string>
+    <string lang="en" key="NONSYS_INPLACE_ENC_FINISHED_INFO">IMPORTANT: TO MOUNT THIS NEWLY CREATED VERACRYPT VOLUME AND TO ACCESS DATA STORED IN IT, CLICK 'Auto-Mount Devices' IN THE MAIN TRUECRYPT WINDOW. After you enter the correct password (and/or supply correct keyfiles), the volume will be mounted to the drive letter you select from the list in the main VeraCrypt window (and you will be able to access the encrypted data via the selected drive letter).\n\nPLEASE REMEMBER OR WRITE DOWN THE ABOVE STEPS. YOU MUST FOLLOW THEM WHENEVER YOU WANT TO MOUNT THE VOLUME AND ACCESS DATA STORED IN IT. Alternatively, in the main VeraCrypt window, click 'Select Device', then select this partition/volume, and click 'Mount'.\n\nThe partition/volume has been successfully encrypted (it contains a fully encrypted VeraCrypt volume now) and is ready for use.</string>
    <string lang="en" key="FORMAT_FINISHED_INFO">The VeraCrypt volume has been successfully created.</string>
    <string lang="en" key="FORMAT_FINISHED_TITLE">Volume Created</string>
    <string lang="en" key="FORMAT_HELP">IMPORTANT: Move your mouse as randomly as possible within this window. The longer you move it, the better. This significantly increases the cryptographic strength of the encryption keys. Then click Format to create the volume.</string>
@@ -489,7 +489,7 @@
    <string lang="en" key="HIDDEN_VOL_WIZARD_MODE_DIRECT_HELP">If you select this option, you will create a hidden volume within an existing VeraCrypt volume. It will be assumed that you have already created a VeraCrypt volume that is suitable to host the hidden volume.</string>
    <string lang="en" key="HIDDEN_VOL_WIZARD_MODE_TITLE">Volume Creation Mode</string>
    <string lang="en" key="HIDVOL_FORMAT_FINISHED_TITLE">Hidden Volume Created</string>
-    <string lang="en" key="HIDVOL_FORMAT_FINISHED_HELP">The hidden VeraCrypt volume has been successfully created and is ready for use. If all the instructions have been followed and if the precautions and requirements listed in the section "Security Requirements and Precautions Pertaining to Hidden Volumes" in the VeraCrypt User's Guide are followed, it should be impossible to prove that the hidden volume exists, even when the outer volume is mounted.\n\nWARNING: IF YOU DO NOT PROTECT THE HIDDEN VOLUME (FOR INFORMATION ON HOW TO DO SO, REFER TO THE SECTION "PROTECTION OF HIDDEN VOLUMES AGAINST DAMAGE" IN THE HDCRYPT USER'S GUIDE), DO NOT WRITE TO THE OUTER VOLUME. OTHERWISE, YOU MAY OVERWRITE AND DAMAGE THE HIDDEN VOLUME!</string>
+    <string lang="en" key="HIDVOL_FORMAT_FINISHED_HELP">The hidden VeraCrypt volume has been successfully created and is ready for use. If all the instructions have been followed and if the precautions and requirements listed in the section "Security Requirements and Precautions Pertaining to Hidden Volumes" in the VeraCrypt User's Guide are followed, it should be impossible to prove that the hidden volume exists, even when the outer volume is mounted.\n\nWARNING: IF YOU DO NOT PROTECT THE HIDDEN VOLUME (FOR INFORMATION ON HOW TO DO SO, REFER TO THE SECTION "PROTECTION OF HIDDEN VOLUMES AGAINST DAMAGE" IN THE VERACRYPT USER'S GUIDE), DO NOT WRITE TO THE OUTER VOLUME. OTHERWISE, YOU MAY OVERWRITE AND DAMAGE THE HIDDEN VOLUME!</string>
    <string lang="en" key="FIRST_HIDDEN_OS_BOOT_INFO">You have started the hidden operating system. As you may have noticed, the hidden operating system appears to be installed on the same partition as the original operating system. However, in reality, it is installed within the partition behind it (in the hidden volume). All read and write operations are being transparently redirected from the original system partition to the hidden volume.\n\nNeither the operating system nor applications will know that data written to and read from the system partition are actually written to and read from the partition behind it (from/to a hidden volume). Any such data is encrypted and decrypted on the fly as usual (with an encryption key different from the one that will be used for the decoy operating system).\n\n\nPlease click Next to continue.</string>
    <string lang="en" key="HIDVOL_HOST_FILLING_HELP_SYSENC">The outer volume has been created and mounted as drive %hc:. To this outer volume you should now copy some sensitive-looking files that you actually do NOT want to hide. They will be there for anyone forcing you to disclose the password for the first partition behind the system partition, where both the outer volume and the hidden volume (containing the hidden operating system) will reside. You will be able to reveal the password for this outer volume, and the existence of the hidden volume (and of the hidden operating system) will remain secret.\n\nIMPORTANT: The files you copy to the outer volume should not occupy more than %s. Otherwise, there may not be enough free space on the outer volume for the hidden volume (and you will not be able to continue). After you finish copying, click Next (do not dismount the volume).</string>
    <string lang="en" key="HIDVOL_HOST_FILLING_HELP">Outer volume has been successfully created and mounted as drive %hc:. To this volume you should now copy some sensitive-looking files that you actually do NOT want to hide. The files will be there for anyone forcing you to disclose your password. You will reveal only the password for this outer volume, not for the hidden one. The files that you really care about will be stored in the hidden volume, which will be created later on. When you finish copying, click Next. Do not dismount the volume.\n\nNote: After you click Next, cluster bitmap of the outer volume will be scanned to determine the size of uninterrupted area of free space whose end is aligned with the end of the volume. This area will accommodate the hidden volume, so it will limit its maximum possible size. Cluster bitmap scanning ensures that no data on the outer volume are overwritten by the hidden volume.</string>
@@ -549,7 +549,7 @@
    <string lang="en" key="SELECT_PKCS11_MODULE">Select PKCS #11 Library</string>
    <string lang="en" key="OUTOFMEMORY">Out of Memory</string>
    <string lang="en" key="FORMAT_DEVICE_FOR_ADVANCED_ONLY">IMPORTANT: We strongly recommend that inexperienced users create a VeraCrypt file container on the selected device/partition, instead of attempting to encrypt the entire device/partition.\n\nWhen you create a VeraCrypt file container (as opposed to encrypting a device or partition) there is, for example, no risk of destroying a large number of files. Note that a VeraCrypt file container (even though it contains a virtual encrypted disk) is actually just like any normal file. For more information, see the chapter Beginner's Tutorial in the VeraCrypt User Guide.\n\nAre you sure you want to encrypt the entire device/partition?</string>
-    <string lang="en" key="OVERWRITEPROMPT">WARNING: The file '%hs' already exists!\n\nIMPORTANT: HDCRYPT WILL NOT ENCRYPT THE FILE, BUT IT WILL DELETE IT. Are you sure you want to delete the file and replace it with a new VeraCrypt container?</string>
+    <string lang="en" key="OVERWRITEPROMPT">WARNING: The file '%hs' already exists!\n\nIMPORTANT: VERACRYPT WILL NOT ENCRYPT THE FILE, BUT IT WILL DELETE IT. Are you sure you want to delete the file and replace it with a new VeraCrypt container?</string>
    <string lang="en" key="OVERWRITEPROMPT_DEVICE">CAUTION: ALL FILES CURRENTLY STORED ON THE SELECTED %s '%hs'%s WILL BE ERASED AND LOST (THEY WILL NOT BE ENCRYPTED)!\n\nAre you sure you want to proceed with format?</string>
    <string lang="en" key="NONSYS_INPLACE_ENC_CONFIRM">WARNING: You will not be able to mount the volume or access any files stored on it until it has been fully encrypted.\n\nAre you sure you want to start encrypting the selected %s '%hs'%s?</string>
    <string lang="en" key="NONSYS_INPLACE_ENC_CONFIRM_BACKUP">WARNING: Please note that if power supply is suddenly interrupted while encrypting existing data in place, or when the operating system crashes due to a software error or hardware malfunction while VeraCrypt is encrypting existing data in place, portions of the data will be corrupted or lost. Therefore, before you start encrypting, please make sure that you have backup copies of the files you want to encrypt.\n\nDo you have such a backup?</string>
@@ -143,6 +143,13 @@ int ChangePwd (const char *lpszVolume, Password *oldPassword, Password *newPassw

 	if (oldPassword->Length == 0 || newPassword->Length == 0) return -1;

+	if (wipePassCount <= 0)
+	{
+      nStatus = ERR_PARAMETER_INCORRECT;
+      handleError (hwndDlg, nStatus);
+      return nStatus;
+	}
+
   if (!lpszVolume)
   {
      nStatus = ERR_OUTOFMEMORY;
@@ -16,6 +16,8 @@
 #ifndef TC_WINDOWS_BOOT
 #include "Sha2.h"
 #include "Whirlpool.h"
+#else
+#include "Sha2Small.h"
 #endif
 #include "Pkcs5.h"
 #include "Crypto.h"
@@ -32,6 +34,167 @@ void hmac_truncate
 		d2[i] = d1[i];
 }

+#if !defined(TC_WINDOWS_BOOT) || defined(TC_WINDOWS_BOOT_SHA2)
+
+void hmac_sha256
+(
+	  char *k,		/* secret key */
+	  int lk,		/* length of the key in bytes */
+	  char *d,		/* data */
+	  int ld,		/* length of data in bytes */
+	  char *out		/* output buffer, at least "t" bytes */
+)
+{
+	sha256_ctx ictx, octx;
+	char isha[SHA256_DIGESTSIZE], osha[SHA256_DIGESTSIZE];
+#ifndef TC_WINDOWS_BOOT
+	char key[SHA256_DIGESTSIZE];
+#endif
+	char buf[SHA256_BLOCKSIZE];
+	int i;
+
+#ifndef TC_WINDOWS_BOOT
+    /* If the key is longer than the hash algorithm block size,
+	   let key = sha256(key), as per HMAC specifications. */
+	if (lk > SHA256_BLOCKSIZE)
+	{
+		sha256_ctx tctx;
+
+		sha256_begin (&tctx);
+		sha256_hash ((unsigned char *) k, lk, &tctx);
+		sha256_end ((unsigned char *) key, &tctx);
+
+		k = key;
+		lk = SHA256_DIGESTSIZE;
+
+		burn (&tctx, sizeof(tctx));		// Prevent leaks
+	}
+#endif
+	/**** Inner Digest ****/
+
+	sha256_begin (&ictx);
+
+	/* Pad the key for inner digest */
+	for (i = 0; i < lk; ++i)
+		buf[i] = (char) (k[i] ^ 0x36);
+	for (i = lk; i < SHA256_BLOCKSIZE; ++i)
+		buf[i] = 0x36;
+
+	sha256_hash ((unsigned char *) buf, SHA256_BLOCKSIZE, &ictx);
+	sha256_hash ((unsigned char *) d, ld, &ictx);
+
+	sha256_end ((unsigned char *) isha, &ictx);
+
+	/**** Outer Digest ****/
+
+	sha256_begin (&octx);
+
+	for (i = 0; i < lk; ++i)
+		buf[i] = (char) (k[i] ^ 0x5C);
+	for (i = lk; i < SHA256_BLOCKSIZE; ++i)
+		buf[i] = 0x5C;
+
+	sha256_hash ((unsigned char *) buf, SHA256_BLOCKSIZE, &octx);
+	sha256_hash ((unsigned char *) isha, SHA256_DIGESTSIZE, &octx);
+
+	sha256_end ((unsigned char *) osha, &octx);
+
+	/* truncate and print the results */
+	hmac_truncate (osha, out, SHA256_DIGESTSIZE);
+
+	/* Prevent leaks */
+	burn (&ictx, sizeof(ictx));
+	burn (&octx, sizeof(octx));
+	burn (isha, sizeof(isha));
+	burn (osha, sizeof(osha));
+	burn (buf, sizeof(buf));
+#ifndef TC_WINDOWS_BOOT
+	burn (key, sizeof(key));
+#endif
+}
+
+
+void derive_u_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b)
+{
+	char j[SHA256_DIGESTSIZE], k[SHA256_DIGESTSIZE];
+	char init[128];
+	char counter[4];
+	uint32 c;
+	int i;
+
+#ifdef TC_WINDOWS_BOOT
+	/* In bootloader, iterations is a boolean : TRUE for boot derivation mode, FALSE otherwise 
+	 * This enables us to save code space needed for implementing other features.
+	 */
+	if (iterations)
+		c = 200000;
+	else
+		c = 500000;
+#else
+	c = iterations;
+#endif
+
+	/* iteration 1 */
+	memset (counter, 0, 4);
+	counter[3] = (char) b;
+	memcpy (init, salt, salt_len);	/* salt */
+	memcpy (&init[salt_len], counter, 4);	/* big-endian block number */
+	hmac_sha256 (pwd, pwd_len, init, salt_len + 4, j);
+	memcpy (u, j, SHA256_DIGESTSIZE);
+
+	/* remaining iterations */
+	while (c > 1)
+	{
+		hmac_sha256 (pwd, pwd_len, j, SHA256_DIGESTSIZE, k);
+		for (i = 0; i < SHA256_DIGESTSIZE; i++)
+		{
+			u[i] ^= k[i];
+			j[i] = k[i];
+		}
+		c--;
+	}
+
+	/* Prevent possible leaks. */
+	burn (j, sizeof(j));
+	burn (k, sizeof(k));
+}
+
+
+void derive_key_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen)
+{
+	char u[SHA256_DIGESTSIZE];
+	int b, l, r;
+
+	if (dklen % SHA256_DIGESTSIZE)
+	{
+		l = 1 + dklen / SHA256_DIGESTSIZE;
+	}
+	else
+	{
+		l = dklen / SHA256_DIGESTSIZE;
+	}
+
+	r = dklen - (l - 1) * SHA256_DIGESTSIZE;
+
+	/* first l - 1 blocks */
+	for (b = 1; b < l; b++)
+	{
+		derive_u_sha256 (pwd, pwd_len, salt, salt_len, iterations, u, b);
+		memcpy (dk, u, SHA256_DIGESTSIZE);
+		dk += SHA256_DIGESTSIZE;
+	}
+
+	/* last block */
+	derive_u_sha256 (pwd, pwd_len, salt, salt_len, iterations, u, b);
+	memcpy (dk, u, r);
+
+
+	/* Prevent possible leaks. */
+	burn (u, sizeof(u));
+}
+
+#endif
+
 #ifndef TC_WINDOWS_BOOT

 void hmac_sha512
@@ -46,10 +209,13 @@ void hmac_sha512
 {
 	sha512_ctx ictx, octx;
 	char isha[SHA512_DIGESTSIZE], osha[SHA512_DIGESTSIZE];
+#ifndef TC_WINDOWS_BOOT
 	char key[SHA512_DIGESTSIZE];
+#endif
 	char buf[SHA512_BLOCKSIZE];
 	int i;

+#ifndef TC_WINDOWS_BOOT
    /* If the key is longer than the hash algorithm block size,
 	   let key = sha512(key), as per HMAC specifications. */
 	if (lk > SHA512_BLOCKSIZE)
@@ -65,7 +231,7 @@ void hmac_sha512

 		burn (&tctx, sizeof(tctx));		// Prevent leaks
 	}
-
+#endif
 	/**** Inner Digest ****/

 	sha512_begin (&ictx);
@@ -105,7 +271,9 @@ void hmac_sha512
 	burn (isha, sizeof(isha));
 	burn (osha, sizeof(osha));
 	burn (buf, sizeof(buf));
+#ifndef TC_WINDOWS_BOOT
 	burn (key, sizeof(key));
+#endif
 }


@@ -176,14 +344,19 @@ void derive_key_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, int it

 #endif // TC_WINDOWS_BOOT

+#if !defined(TC_WINDOWS_BOOT) || defined(TC_WINDOWS_BOOT_RIPEMD160)
+
 void hmac_ripemd160 (char *key, int keylen, char *input, int len, char *digest)
 {
    RMD160_CTX context;
    unsigned char k_ipad[65];  /* inner padding - key XORd with ipad */
    unsigned char k_opad[65];  /* outer padding - key XORd with opad */
+#ifndef TC_WINDOWS_BOOT
    unsigned char tk[RIPEMD160_DIGESTSIZE];
+#endif
    int i;

+#ifndef TC_WINDOWS_BOOT
    /* If the key is longer than the hash algorithm block size,
 	   let key = ripemd160(key), as per HMAC specifications. */
    if (keylen > RIPEMD160_BLOCKSIZE) 
@@ -199,7 +372,7 @@ void hmac_ripemd160 (char *key, int keylen, char *input, int len, char *digest)

 		burn (&tctx, sizeof(tctx));	// Prevent leaks
    }
-
+#endif
 	/*

 	RMD160(K XOR opad, RMD160(K XOR ipad, text))
@@ -238,17 +411,31 @@ void hmac_ripemd160 (char *key, int keylen, char *input, int len, char *digest)
 	/* Prevent possible leaks. */
    burn (k_ipad, sizeof(k_ipad));
    burn (k_opad, sizeof(k_opad));
+#ifndef TC_WINDOWS_BOOT
 	burn (tk, sizeof(tk));
+#endif
 	burn (&context, sizeof(context));
 }

-void derive_u_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b)
+void derive_u_ripemd160 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b)
 {
 	char j[RIPEMD160_DIGESTSIZE], k[RIPEMD160_DIGESTSIZE];
 	char init[128];
 	char counter[4];
-	int c, i, l;
-   int EnhanceSecurityLoops = (bNotTest)? 20 : 1;
+	uint32 c;
+	int i;
+
+#ifdef TC_WINDOWS_BOOT
+	/* In bootloader, iterations is a boolean : TRUE for boot derivation mode, FALSE otherwise 
+	 * This enables us to save code space needed for implementing other features.
+	 */
+	if (iterations)
+		c = 327661;
+	else
+		c = 655331;
+#else
+	c  = iterations;
+#endif

 	/* iteration 1 */
 	memset (counter, 0, 4);
@@ -259,40 +446,23 @@ void derive_u_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int
 	memcpy (u, j, RIPEMD160_DIGESTSIZE);

 	/* remaining iterations */
-	for (l = 0; l < EnhanceSecurityLoops; l++)
+	while ( c > 1)
 	{
-		for (c = 1; c < iterations; c++)
+		hmac_ripemd160 (pwd, pwd_len, j, RIPEMD160_DIGESTSIZE, k);
+		for (i = 0; i < RIPEMD160_DIGESTSIZE; i++)
 		{
-			hmac_ripemd160 (pwd, pwd_len, j, RIPEMD160_DIGESTSIZE, k);
-			for (i = 0; i < RIPEMD160_DIGESTSIZE; i++)
-			{
-				u[i] ^= k[i];
-				j[i] = k[i];
-			}
+			u[i] ^= k[i];
+			j[i] = k[i];
 		}
+		c--;
 	}

-   /* add extra 10 loops to ensure backward compatibilty with the previous count (327661 for boot, 655331 for normal) */
-   if (iterations == 32767)
-   {
-      /* case of normal partition : add 10 iterations to have a total of 655331 = (32767 - 1)*20 + 1 + 10 */
-		for (c = 0; c < 10; c++)
-		{
-			hmac_ripemd160 (pwd, pwd_len, j, RIPEMD160_DIGESTSIZE, k);
-			for (i = 0; i < RIPEMD160_DIGESTSIZE; i++)
-			{
-				u[i] ^= k[i];
-				j[i] = k[i];
-			}
-		}
-   }
-
 	/* Prevent possible leaks. */
 	burn (j, sizeof(j));
 	burn (k, sizeof(k));
 }

-void derive_key_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen)
+void derive_key_ripemd160 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen)
 {
 	char u[RIPEMD160_DIGESTSIZE];
 	int b, l, r;
@@ -311,19 +481,20 @@ void derive_key_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, in
 	/* first l - 1 blocks */
 	for (b = 1; b < l; b++)
 	{
-		derive_u_ripemd160 (bNotTest, pwd, pwd_len, salt, salt_len, iterations, u, b);
+		derive_u_ripemd160 (pwd, pwd_len, salt, salt_len, iterations, u, b);
 		memcpy (dk, u, RIPEMD160_DIGESTSIZE);
 		dk += RIPEMD160_DIGESTSIZE;
 	}

 	/* last block */
-	derive_u_ripemd160 (bNotTest, pwd, pwd_len, salt, salt_len, iterations, u, b);
+	derive_u_ripemd160 (pwd, pwd_len, salt, salt_len, iterations, u, b);
 	memcpy (dk, u, r);


 	/* Prevent possible leaks. */
 	burn (u, sizeof(u));
 }
+#endif // TC_WINDOWS_BOOT

 #ifndef TC_WINDOWS_BOOT

@@ -339,10 +510,13 @@ void hmac_whirlpool
 {
 	WHIRLPOOL_CTX ictx, octx;
 	char iwhi[WHIRLPOOL_DIGESTSIZE], owhi[WHIRLPOOL_DIGESTSIZE];
+#ifndef TC_WINDOWS_BOOT
 	char key[WHIRLPOOL_DIGESTSIZE];
+#endif
 	char buf[WHIRLPOOL_BLOCKSIZE];
 	int i;

+#ifndef TC_WINDOWS_BOOT
    /* If the key is longer than the hash algorithm block size,
 	   let key = whirlpool(key), as per HMAC specifications. */
 	if (lk > WHIRLPOOL_BLOCKSIZE)
@@ -358,7 +532,7 @@ void hmac_whirlpool

 		burn (&tctx, sizeof(tctx));		// Prevent leaks
 	}
-
+#endif
 	/**** Inner Digest ****/

 	WHIRLPOOL_init (&ictx);
@@ -398,7 +572,9 @@ void hmac_whirlpool
 	burn (owhi, sizeof(owhi));
 	burn (iwhi, sizeof(iwhi));
 	burn (buf, sizeof(buf));
+#ifndef TC_WINDOWS_BOOT
 	burn (key, sizeof(key));
+#endif
 }

 void derive_u_whirlpool (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b)
@@ -473,6 +649,9 @@ char *get_pkcs5_prf_name (int pkcs5_prf_id)
 	case SHA512:	
 		return "HMAC-SHA-512";

+	case SHA256:	
+		return "HMAC-SHA-256";
+
 	case RIPEMD160:	
 		return "HMAC-RIPEMD-160";

@@ -484,7 +663,6 @@ char *get_pkcs5_prf_name (int pkcs5_prf_id)
 	}
 }

-#endif //!TC_WINDOWS_BOOT


 int get_pkcs5_iteration_count (int pkcs5_prf_id, BOOL bBoot)
@@ -493,19 +671,21 @@ int get_pkcs5_iteration_count (int pkcs5_prf_id, BOOL bBoot)
 	{

 	case RIPEMD160:	
-		return bBoot? 16384 : 32767; /* we multiply this number by 10 inside derive_u_ripemd160 */
-
-#ifndef TC_WINDOWS_BOOT
+		return bBoot? 327661 : 655331;

 	case SHA512:	
 		return 500000;

 	case WHIRLPOOL:	
 		return 500000;
-#endif
+
+	case SHA256:
+		return bBoot? 200000 : 500000;

 	default:		
 		TC_THROW_FATAL_EXCEPTION;	// Unknown/wrong ID
 	}
 	return 0;
 }
+
+#endif //!TC_WINDOWS_BOOT
@@ -18,13 +18,16 @@
 extern "C"
 {
 #endif
+void hmac_sha256 (char *k, int lk, char *d, int ld, char *out);
+void derive_u_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b);
+void derive_key_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen);

 void hmac_sha512 (char *k, int lk, char *d, int ld, char *out, int t);
 void derive_u_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b);
 void derive_key_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen);
 void hmac_ripemd160 (char *key, int keylen, char *input, int len, char *digest);
-void derive_u_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b);
-void derive_key_ripemd160 (BOOL bNotTest, char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen);
+void derive_u_ripemd160 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b);
+void derive_key_ripemd160 (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen);
 void hmac_whirlpool (char *k, int lk, char *d, int ld, char *out, int t);
 void derive_u_whirlpool (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *u, int b);
 void derive_key_whirlpool (char *pwd, int pwd_len, char *salt, int salt_len, int iterations, char *dk, int dklen);
@@ -210,6 +210,7 @@ BOOL Randmix ()
 		WHIRLPOOL_CTX	wctx;
 		RMD160_CTX		rctx;
 		sha512_ctx		sctx;
+		sha256_ctx		s256ctx;
 		int poolIndex, digestIndex, digestSize;

 		switch (HashFunction)
@@ -222,6 +223,10 @@ BOOL Randmix ()
 			digestSize = SHA512_DIGESTSIZE;
 			break;

+		case SHA256:
+			digestSize = SHA256_DIGESTSIZE;
+			break;
+
 		case WHIRLPOOL:
 			digestSize = WHIRLPOOL_DIGESTSIZE;
 			break;
@@ -250,6 +255,12 @@ BOOL Randmix ()
 				sha512_end (hashOutputBuffer, &sctx);
 				break;

+			case SHA256:
+				sha256_begin (&s256ctx);
+				sha256_hash (pRandPool, RNG_POOL_SIZE, &s256ctx);
+				sha256_end (hashOutputBuffer, &s256ctx);
+				break;
+
 			case WHIRLPOOL:
 				WHIRLPOOL_init (&wctx);
 				WHIRLPOOL_add (pRandPool, RNG_POOL_SIZE * 8, &wctx);
@@ -280,6 +291,10 @@ BOOL Randmix ()
 			burn (&sctx, sizeof(sctx));		
 			break;

+		case SHA256:
+			burn (&s256ctx, sizeof(s256ctx));		
+			break;
+
 		case WHIRLPOOL:
 			burn (&wctx, sizeof(wctx));		
 			break;
@@ -114,7 +114,8 @@ char *ReadRegistryString (char *subKey, char *name, char *defaultValue, char *st
 		if (RegQueryValueEx (hkey, name, 0,	0, (LPBYTE) value,	&size) == ERROR_SUCCESS)
 			StringCbCopyA (str, maxLen,value);

-	RegCloseKey (hkey);
+	if (hkey)
+		RegCloseKey (hkey);
 	return str;
 }

@@ -43,6 +43,22 @@
 #define IDD_NEW_TOKEN_KEYFILE           539
 #define IDD_RANDOM_POOL_ENRICHMENT      540
 #define IDI_TRUECRYPT_MOUNTED_ICON      541
+#define IDR_BOOT_SECTOR_SHA2             542
+#define IDR_BOOT_SECTOR_AES_SHA2         543
+#define IDR_BOOT_SECTOR_SERPENT_SHA2     544
+#define IDR_BOOT_SECTOR_TWOFISH_SHA2     545
+#define IDR_BOOT_LOADER_SHA2            546
+#define IDR_BOOT_LOADER_AES_SHA2        547
+#define IDR_BOOT_LOADER_SERPENT_SHA2    548
+#define IDR_BOOT_LOADER_TWOFISH_SHA2	 549
+#define IDR_RESCUE_BOOT_SECTOR_SHA2          550
+#define IDR_RESCUE_BOOT_SECTOR_AES_SHA2      551
+#define IDR_RESCUE_BOOT_SECTOR_SERPENT_SHA2  552
+#define IDR_RESCUE_BOOT_SECTOR_TWOFISH_SHA2  553
+#define IDR_RESCUE_LOADER_SHA2          554
+#define IDR_RESCUE_LOADER_AES_SHA2      555
+#define IDR_RESCUE_LOADER_SERPENT_SHA2  556
+#define IDR_RESCUE_LOADER_TWOFISH_SHA2  557
 #define IDC_HW_AES_LABEL_LINK           5000
 #define IDC_HW_AES                      5001
 #define IDC_PARALLELIZATION_LABEL_LINK  5002
@@ -15,15 +15,15 @@
 #define TC_APP_NAME						"VeraCrypt"

 // Version displayed to user 
-#define VERSION_STRING					"1.0d"
+#define VERSION_STRING					"1.0e"

 // Version number to compare against driver
-#define VERSION_NUM						0x010d
+#define VERSION_NUM						0x010e

 // Release date
-#define TC_STR_RELEASE_DATE				"June 3, 2014"
+#define TC_STR_RELEASE_DATE				"August 26, 2014"
 #define TC_RELEASE_DATE_YEAR			2014
-#define TC_RELEASE_DATE_MONTH			06
+#define TC_RELEASE_DATE_MONTH			8

 #define BYTES_PER_KB                    1024LL
 #define BYTES_PER_MB                    1048576LL
@@ -1055,12 +1055,12 @@ BOOL test_pkcs5 ()
 		return FALSE;

 	/* PKCS-5 test 1 with HMAC-RIPEMD-160 used as the PRF */
-	derive_key_ripemd160 (FALSE, "password", 8, "\x12\x34\x56\x78", 4, 5, dk, 4);
+	derive_key_ripemd160 ("password", 8, "\x12\x34\x56\x78", 4, 5, dk, 4);
 	if (memcmp (dk, "\x7a\x3d\x7c\x03", 4) != 0)
 		return FALSE;

 	/* PKCS-5 test 2 with HMAC-RIPEMD-160 used as the PRF (derives a key longer than the underlying hash) */
-	derive_key_ripemd160 (FALSE, "password", 8, "\x12\x34\x56\x78", 4, 5, dk, 48);
+	derive_key_ripemd160 ("password", 8, "\x12\x34\x56\x78", 4, 5, dk, 48);
 	if (memcmp (dk, "\x7a\x3d\x7c\x03\xe7\x26\x6b\xf8\x3d\x78\xfb\x29\xd2\x64\x1f\x56\xea\xf0\xe5\xf5\xcc\xc4\x3a\x31\xa8\x84\x70\xbf\xbd\x6f\x8e\x78\x24\x5a\xc0\x0a\xf6\xfa\xf0\xf6\xe9\x00\x47\x5f\x73\xce\xe1\x43", 48) != 0)
 		return FALSE;

@@ -302,7 +302,7 @@ KeyReady:	;
 			switch (pkcs5_prf)
 			{
 			case RIPEMD160:
-				derive_key_ripemd160 (TRUE, keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
+				derive_key_ripemd160 (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
 					PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
 				break;

@@ -316,6 +316,11 @@ KeyReady:	;
 					PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
 				break;

+			case SHA256:
+				derive_key_sha256 (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
+					PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
+				break;
+
 			default:		
 				// Unknown/wrong ID
 				TC_THROW_FATAL_EXCEPTION;
@@ -546,14 +551,12 @@ int ReadVolumeHeader (BOOL bBoot, char *header, Password *password, PCRYPTO_INFO
 {
 #ifdef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
 	char dk[32 * 2];			// 2 * 256-bit key
-	char masterKey[32 * 2];
 #else
 	char dk[32 * 2 * 3];		// 6 * 256-bit key
-	char masterKey[32 * 2 * 3];
 #endif

 	PCRYPTO_INFO cryptoInfo;
-	int status;
+	int status = ERR_SUCCESS;

 	if (retHeaderCryptoInfo != NULL)
 		cryptoInfo = retHeaderCryptoInfo;
@@ -561,21 +564,51 @@ int ReadVolumeHeader (BOOL bBoot, char *header, Password *password, PCRYPTO_INFO
 		cryptoInfo = *retInfo = crypto_open ();

 	// PKCS5 PRF
-	derive_key_ripemd160 (TRUE, password->Text, (int) password->Length, header + HEADER_SALT_OFFSET,
-		PKCS5_SALT_SIZE, bBoot ? 16384 : 32767, dk, sizeof (dk));
+#ifdef TC_WINDOWS_BOOT_SHA2
+	derive_key_sha256 (password->Text, (int) password->Length, header + HEADER_SALT_OFFSET,
+		PKCS5_SALT_SIZE, bBoot, dk, sizeof (dk));
+#else
+	derive_key_ripemd160 (password->Text, (int) password->Length, header + HEADER_SALT_OFFSET,
+		PKCS5_SALT_SIZE, bBoot, dk, sizeof (dk));
+#endif

 	// Mode of operation
 	cryptoInfo->mode = FIRST_MODE_OF_OPERATION_ID;

+#ifdef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
+	cryptoInfo->ea = 1;
+#else
 	// Test all available encryption algorithms
 	for (cryptoInfo->ea = EAGetFirst (); cryptoInfo->ea != 0; cryptoInfo->ea = EAGetNext (cryptoInfo->ea))
+#endif
 	{
+#ifdef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
+	#if defined (TC_WINDOWS_BOOT_SERPENT)
+		serpent_set_key (dk, cryptoInfo->ks);
+	#elif defined (TC_WINDOWS_BOOT_TWOFISH)
+		twofish_set_key ((TwofishInstance *) cryptoInfo->ks, (const u4byte *) dk);
+	#else
+		status = EAInit (dk, cryptoInfo->ks);
+		if (status == ERR_CIPHER_INIT_FAILURE)
+			goto err;
+	#endif
+#else
 		status = EAInit (cryptoInfo->ea, dk, cryptoInfo->ks);
 		if (status == ERR_CIPHER_INIT_FAILURE)
 			goto err;
-
+#endif
 		// Secondary key schedule
+#ifdef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
+	#if defined (TC_WINDOWS_BOOT_SERPENT)
+		serpent_set_key (dk + 32, cryptoInfo->ks2);
+	#elif defined (TC_WINDOWS_BOOT_TWOFISH)
+		twofish_set_key ((TwofishInstance *)cryptoInfo->ks2, (const u4byte *) (dk + 32));
+	#else
+		EAInit (dk + 32, cryptoInfo->ks2);
+	#endif
+#else
 		EAInit (cryptoInfo->ea, dk + EAGetKeySize (cryptoInfo->ea), cryptoInfo->ks2);
+#endif

 		// Try to decrypt header 
 		DecryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, cryptoInfo);
@@ -586,7 +619,12 @@ int ReadVolumeHeader (BOOL bBoot, char *header, Password *password, PCRYPTO_INFO
 			|| GetHeaderField32 (header, TC_HEADER_OFFSET_KEY_AREA_CRC) != GetCrc32 (header + HEADER_MASTER_KEYDATA_OFFSET, MASTER_KEYDATA_SIZE))
 		{
 			EncryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, cryptoInfo);
+#ifdef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
+			status = ERR_PASSWORD_WRONG;
+			goto err;
+#else
 			continue;
+#endif
 		}

 		// Header decrypted
@@ -606,19 +644,47 @@ int ReadVolumeHeader (BOOL bBoot, char *header, Password *password, PCRYPTO_INFO
 		// Flags
 		cryptoInfo->HeaderFlags = GetHeaderField32 (header, TC_HEADER_OFFSET_FLAGS);

-		memcpy (masterKey, header + HEADER_MASTER_KEYDATA_OFFSET, sizeof (masterKey));
+#ifdef TC_WINDOWS_BOOT_SHA2
+		cryptoInfo->pkcs5 = SHA256;
+#else
+		cryptoInfo->pkcs5 = RIPEMD160;
+#endif
+
+		memcpy (dk, header + HEADER_MASTER_KEYDATA_OFFSET, sizeof (dk));
 		EncryptBuffer (header + HEADER_ENCRYPTED_DATA_OFFSET, HEADER_ENCRYPTED_DATA_SIZE, cryptoInfo);

 		if (retHeaderCryptoInfo)
 			goto ret;

 		// Init the encryption algorithm with the decrypted master key
-		status = EAInit (cryptoInfo->ea, masterKey, cryptoInfo->ks);
+#ifdef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
+	#if defined (TC_WINDOWS_BOOT_SERPENT)
+		serpent_set_key (dk, cryptoInfo->ks);
+	#elif defined (TC_WINDOWS_BOOT_TWOFISH)
+		twofish_set_key ((TwofishInstance *) cryptoInfo->ks, (const u4byte *) dk);
+	#else
+		status = EAInit (dk, cryptoInfo->ks);
 		if (status == ERR_CIPHER_INIT_FAILURE)
 			goto err;
+	#endif
+#else
+		status = EAInit (cryptoInfo->ea, dk, cryptoInfo->ks);
+		if (status == ERR_CIPHER_INIT_FAILURE)
+			goto err;
+#endif

 		// The secondary master key (if cascade, multiple concatenated)
-		EAInit (cryptoInfo->ea, masterKey + EAGetKeySize (cryptoInfo->ea), cryptoInfo->ks2);
+#ifdef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE
+	#if defined (TC_WINDOWS_BOOT_SERPENT)
+		serpent_set_key (dk + 32, cryptoInfo->ks2);
+	#elif defined (TC_WINDOWS_BOOT_TWOFISH)
+		twofish_set_key ((TwofishInstance *)cryptoInfo->ks2, (const u4byte *) (dk + 32));
+	#else
+		EAInit (dk + 32, cryptoInfo->ks2);
+	#endif
+#else
+		EAInit (cryptoInfo->ea, dk + EAGetKeySize (cryptoInfo->ea), cryptoInfo->ks2);
+#endif
 		goto ret;
 	}

@@ -633,7 +699,6 @@ err:

 ret:
 	burn (dk, sizeof(dk));
-	burn (masterKey, sizeof(masterKey));
 	return status;
 }

@@ -703,6 +768,9 @@ int CreateVolumeHeaderInMemory (BOOL bBoot, char *header, int ea, int mode, Pass
 	// User selected encryption algorithm
 	cryptoInfo->ea = ea;

+	// User selected PRF
+	cryptoInfo->pkcs5 = pkcs5_prf;
+
 	// Mode of operation
 	cryptoInfo->mode = mode;

@@ -718,8 +786,13 @@ int CreateVolumeHeaderInMemory (BOOL bBoot, char *header, int ea, int mode, Pass
 			PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
 		break;

+	case SHA256:
+		derive_key_sha256 (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
+			PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
+		break;
+
 	case RIPEMD160:
-		derive_key_ripemd160 (TRUE, keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
+		derive_key_ripemd160 (keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
 			PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
 		break;

@@ -157,12 +157,9 @@ int GetWipePassCount (WipeAlgorithmId algorithm)

 	case TC_WIPE_256:
 		return 256;
-
-	default:
-		TC_THROW_FATAL_EXCEPTION;
 	}

-	return 0;	// Prevent compiler warnings
+	return -1;	// Prevent compiler warnings
 }


@@ -183,8 +180,14 @@ BOOL WipeBuffer (WipeAlgorithmId algorithm, byte randChars[TC_WIPE_RAND_CHAR_COU
 	case TC_WIPE_35_GUTMANN:
 		return Wipe35Gutmann (pass, buffer, size);

+	/* we will never reach here because all calls to WipeBuffer are preceeded
+	 * by a call to GetWipePassCount that already checks the same algorithm
+	 * parameters and in case of unsupported value an error is returned before
+	 * calling WipeBuffer
+	 */
+   /*
 	default:
-		TC_THROW_FATAL_EXCEPTION;
+		TC_THROW_FATAL_EXCEPTION;*/
 	}

 	return FALSE;	// Prevent compiler warnings
@@ -213,7 +213,7 @@ namespace VeraCrypt

 				if (options->SectorSize < TC_MIN_VOLUME_SECTOR_SIZE
 					|| options->SectorSize > TC_MAX_VOLUME_SECTOR_SIZE
-#if !defined (TC_LINUX)
+#if !defined (TC_LINUX) && !defined (TC_MACOSX)
 					|| options->SectorSize != TC_SECTOR_SIZE_LEGACY
 #endif
 					|| options->SectorSize % ENCRYPTION_DATA_UNIT_SIZE != 0)
@@ -68,17 +68,18 @@ void RMD160Init (RMD160_CTX *ctx)
 void RMD160Update (RMD160_CTX *ctx, const unsigned char *input, unsigned __int32 lenArg)
 {
 #ifndef TC_WINDOWS_BOOT
-	uint64 len = lenArg, have, need;
+	uint64 len = lenArg;
 #else
-	uint32 len = lenArg, have, need;
+	uint32 len = lenArg;
 #endif
+	unsigned int have, need;

 	/* Check how many bytes we already have and how many more we need. */
-	have = ((ctx->count >> 3) & (RIPEMD160_BLOCK_LENGTH - 1));
+	have = (unsigned int) ((ctx->count) & (RIPEMD160_BLOCK_LENGTH - 1));
 	need = RIPEMD160_BLOCK_LENGTH - have;

 	/* Update bitcount */
-	ctx->count += len << 3;
+	ctx->count += len;

 	if (len >= need) {
 		if (have != 0) {
@@ -114,15 +115,16 @@ static void RMD160Pad(RMD160_CTX *ctx)
 	/* Convert count to 8 bytes in little endian order. */

 #ifndef TC_WINDOWS_BOOT
-	PUT_64BIT_LE(count, ctx->count);
+	uint64 bitcount = ctx->count << 3;
+	PUT_64BIT_LE(count, bitcount);
 #else
 	*(uint32 *) (count + 4) = 0;
-	*(uint32 *) (count + 0) = ctx->count;
+	*(uint32 *) (count + 0) = ctx->count << 3;
 #endif

 	/* Pad out to 56 mod 64. */
 	padlen = RIPEMD160_BLOCK_LENGTH -
-		(uint32)((ctx->count >> 3) & (RIPEMD160_BLOCK_LENGTH - 1));
+		(uint32)((ctx->count) & (RIPEMD160_BLOCK_LENGTH - 1));
 	if (padlen < 1 + 8)
 		padlen += RIPEMD160_BLOCK_LENGTH;
 	RMD160Update(ctx, PADDING, padlen - 8);            /* padlen - 8 <= 64 */
@@ -140,7 +142,9 @@ void RMD160Final(unsigned char *digest, RMD160_CTX *ctx)
 	if (digest) {
 		for (i = 0; i < 5; i++)
 			PUT_32BIT_LE(digest + i * 4, ctx->state[i]);
+#ifndef TC_WINDOWS_BOOT
 		burn (ctx, sizeof(*ctx));
+#endif
 	}
 }

@@ -630,19 +630,16 @@ static void KXf (const unsigned __int32 *k, unsigned int r, unsigned __int32 *a,

 #ifndef TC_MINIMIZE_CODE_SIZE

-void serpent_set_key(const unsigned __int8 userKey[], int keylen, unsigned __int8 *ks)
+void serpent_set_key(const unsigned __int8 userKey[],unsigned __int8 *ks)
 {
 	unsigned __int32 a,b,c,d,e;
 	unsigned __int32 *k = (unsigned __int32 *)ks;
 	unsigned __int32 t;
 	int i;

-	for (i = 0; i < keylen / (int)sizeof(__int32); i++)
+	for (i = 0; i < 8; i++)
 		k[i] = LE32(((unsigned __int32*)userKey)[i]);

-	if (keylen < 32)
-		k[keylen/4] |= (unsigned __int32)1 << ((keylen%4)*8);
-
 	k += 8;
 	t = k[-1];
 	for (i = 0; i < 132; ++i)
@@ -694,19 +691,16 @@ static void SKf (unsigned __int32 *k, unsigned int r, unsigned __int32 *a, unsig
 	k[r + 7] = *d;
 }

-void serpent_set_key(const unsigned __int8 userKey[], int keylen, unsigned __int8 *ks)
+void serpent_set_key(const unsigned __int8 userKey[], unsigned __int8 *ks)
 {
 	unsigned __int32 a,b,c,d,e;
 	unsigned __int32 *k = (unsigned __int32 *)ks;
 	unsigned __int32 t;
 	int i;

-	for (i = 0; i < keylen / (int)sizeof(__int32); i++)
+	for (i = 0; i < 8; i++)
 		k[i] = LE32(((unsigned __int32*)userKey)[i]);

-	if (keylen < 32)
-		k[keylen/4] |= (unsigned __int32)1 << ((keylen%4)*8);
-
 	k += 8;
 	t = k[-1];
 	for (i = 0; i < 132; ++i)
@@ -841,7 +835,7 @@ void serpent_encrypt(const unsigned __int8 *inBlock, unsigned __int8 *outBlock,

 #endif // TC_MINIMIZE_CODE_SIZE

-#if !defined (TC_MINIMIZE_CODE_SIZE) || defined (TC_WINDOWS_BOOT_SERPENT)
+#if !defined (TC_MINIMIZE_CODE_SIZE)

 void serpent_decrypt(const unsigned __int8 *inBlock, unsigned __int8 *outBlock, unsigned __int8 *ks)
 {
@@ -884,7 +878,7 @@ start:
 	out[3] = LE32(e);
 }

-#else // TC_MINIMIZE_CODE_SIZE && !TC_WINDOWS_BOOT_SERPENT
+#else // TC_MINIMIZE_CODE_SIZE

 static void ILTf (uint32 *a, uint32 *b, uint32 *c, uint32 *d)
 { 
@@ -940,4 +934,4 @@ start:
 	out[3] = LE32(e);
 }

-#endif // TC_MINIMIZE_CODE_SIZE && !TC_WINDOWS_BOOT_SERPENT
+#endif // TC_MINIMIZE_CODE_SIZE
@@ -8,7 +8,8 @@ extern "C"
 {
 #endif

-void serpent_set_key(const unsigned __int8 userKey[], int keylen, unsigned __int8 *ks);
+/* userKey is always 32-bytes long */
+void serpent_set_key(const unsigned __int8 userKey[], unsigned __int8 *ks);
 void serpent_encrypt(const unsigned __int8 *inBlock, unsigned __int8 *outBlock, unsigned __int8 *ks);
 void serpent_decrypt(const unsigned __int8 *inBlock,  unsigned __int8 *outBlock, unsigned __int8 *ks);

@@ -0,0 +1,246 @@
+/* LibTomCrypt, modular cryptographic library -- Tom St Denis
+ *
+ * LibTomCrypt is a library that provides various cryptographic
+ * algorithms in a highly modular and flexible manner.
+ *
+ * The library is free for all purposes without any express
+ * guarantee it works.
+ *
+ * Tom St Denis, tomstdenis@gmail.com, http://libtom.org
+ *
+ */
+
+/* Adapted for VeraCrypt */
+
+#include <memory.h>
+#include "Common/Tcdefs.h"
+#include "Common/Endian.h"
+#include "Sha2Small.h"
+
+#pragma optimize ("tl", on)
+
+typedef unsigned __int32 uint32;
+typedef unsigned __int8 byte;
+
+#include <stdlib.h>
+#pragma intrinsic(_lrotr)
+#define RORc(x,n) _lrotr(x,n)
+
+/******************************************************************************/
+
+/*
+	The K array
+ */
+
+static const uint32 K[64] = {
+	0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL,
+	0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL,
+	0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL,
+	0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
+	0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL,
+	0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL,
+	0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL,
+	0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
+	0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL,
+	0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL,
+	0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL,
+	0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
+	0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
+};
+
+/*
+	Various logical functions
+ */
+#define Ch(x,y,z)			(z ^ (x & (y ^ z)))
+#define Maj(x,y,z)		(((x | y) & z) | (x & y)) 
+#define S(x, n)			RORc((x),(n))
+#define R(x, n)			((x)>>(n))
+#define Sigma0(x)			(S(x, 2) ^ S(x, 13) ^ S(x, 22))
+#define Sigma1(x)			(S(x, 6) ^ S(x, 11) ^ S(x, 25))
+#define Gamma0(x)			(S(x, 7) ^ S(x, 18) ^ R(x, 3))
+#define Gamma1(x)			(S(x, 17) ^ S(x, 19) ^ R(x, 10))
+
+#define STORE32H(x, y, i) { \
+(y)[i] = (unsigned char)(((x)>>24)); \
+(y)[i+1] = (unsigned char)(((x)>>16)); \
+(y)[i+2] = (unsigned char)(((x)>>8)); \
+(y)[i+3] = (unsigned char)((x)); \
+}
+
+#define LOAD32H(x, y, i) { \
+x = ((unsigned long)((y)[i])<<24) | \
+((unsigned long)((y)[i+1])<<16) | \
+((unsigned long)((y)[i+2])<<8)  | \
+((unsigned long)((y)[i+3])); \
+}
+
+/*
+	compress 512-bits
+ */
+static void sha256_compress(sha256_ctx * ctx, unsigned char *buf)
+{
+
+	uint32 S[8], W[64], t0, t1;
+	uint32 t, w2, w15;
+	int i;
+
+/*
+	copy state into S
+ */
+	for (i = 0; i < 8; i++) {
+		S[i] = ctx->state[i];
+	}
+
+/*
+	copy the state into 512-bits into W[0..15]
+ */
+	for (i = 0; i < 16; i++) {
+		LOAD32H(W[i], buf , (4*i));
+	}
+
+/*
+	fill W[16..63]
+ */
+	for (i = 16; i < 64; i++) {
+		w2 = W[i - 2];
+		w15 = W[i - 15];
+		W[i] = Gamma1(w2) + W[i - 7] + Gamma0(w15) + W[i - 16];
+	}
+
+/*
+	Compress
+ */
+
+#define RND(a,b,c,d,e,f,g,h,i)							\
+	t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i];	\
+	t1 = Sigma0(a) + Maj(a, b, c);						\
+	d += t0;											\
+	h  = t0 + t1;
+
+	for (i = 0; i < 64; ++i) {
+		RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],i);
+		t = S[7]; S[7] = S[6]; S[6] = S[5]; S[5] = S[4]; 
+		S[4] = S[3]; S[3] = S[2]; S[2] = S[1]; S[1] = S[0]; S[0] = t;
+	}
+
+/*
+	feedback
+ */
+	for (i = 0; i < 8; i++) {
+		ctx->state[i] += S[i];
+	}
+
+}
+
+/*
+	init the sha256 state
+ */
+VOID_RETURN sha256_begin(sha256_ctx* ctx)
+{
+	ctx->curlen = 0;
+	ctx->state[0] = 0x6A09E667UL;
+	ctx->state[1] = 0xBB67AE85UL;
+	ctx->state[2] = 0x3C6EF372UL;
+	ctx->state[3] = 0xA54FF53AUL;
+	ctx->state[4] = 0x510E527FUL;
+	ctx->state[5] = 0x9B05688CUL;
+	ctx->state[6] = 0x1F83D9ABUL;
+	ctx->state[7] = 0x5BE0CD19UL;
+	ctx->highLength = 0;
+	ctx->lowLength = 0;
+}
+
+VOID_RETURN sha256_hash(unsigned char* data, unsigned int len, sha256_ctx* ctx)
+{
+	uint32 n;
+	while (len > 0) {
+		if (ctx->curlen == 0 && len >= 64) {			
+			sha256_compress(ctx, (unsigned char *)data);
+
+			n = ctx->lowLength + 512;
+			if (n < ctx->lowLength) {
+				ctx->highLength++;
+			}
+			ctx->lowLength = n;
+			data		+= 64;
+			len		-= 64;
+		} else {
+			n = min(len, 64 - ctx->curlen);
+			memcpy(ctx->buf + ctx->curlen, data, (size_t)n);
+			ctx->curlen	+= (unsigned int) n;
+			data			+= (unsigned int) n;
+			len			-= (unsigned int) n;
+
+			if (ctx->curlen == 64) {
+				sha256_compress (ctx, ctx->buf);
+
+				n = ctx->lowLength + 512;
+				if (n < ctx->lowLength) {
+					ctx->highLength++;
+				}
+				ctx->lowLength = n;		
+				ctx->curlen	= 0;
+			}
+		}
+	}
+	return;
+}
+
+VOID_RETURN sha256_end(unsigned char* hval, sha256_ctx* ctx)
+{
+	int i;
+	uint32	n;
+
+/*
+	increase the length of the message
+ */
+
+	n = ctx->lowLength + (ctx->curlen << 3);
+	if (n < ctx->lowLength) {
+		ctx->highLength++;
+	}
+	ctx->highLength += (ctx->curlen >> 29);
+	ctx->lowLength = n;
+
+/*
+	append the '1' bit
+ */
+	ctx->buf[ctx->curlen++] = (unsigned char)0x80;
+
+/*
+	if the length is currently above 56 bytes we append zeros then compress.
+	Then we can fall back to padding zeros and length encoding like normal.
+ */
+	if (ctx->curlen > 56) {
+		while (ctx->curlen < 64) {
+			ctx->buf[ctx->curlen++] = (unsigned char)0;
+		}
+		sha256_compress(ctx, ctx->buf);
+		ctx->curlen = 0;
+	}
+
+/*
+	pad upto 56 bytes of zeroes
+ */
+	while (ctx->curlen < 56) {
+		ctx->buf[ctx->curlen++] = (unsigned char)0;
+	}
+
+/*
+	store length
+ */
+
+	STORE32H(ctx->highLength, ctx->buf, 56);
+	STORE32H(ctx->lowLength, ctx->buf, 60);
+	
+	sha256_compress(ctx, ctx->buf);
+
+/*
+	copy output
+ */
+	for (i = 0; i < 8; i++) {
+		STORE32H(ctx->state[i], hval, (4*i));
+	}
+}
+
+/******************************************************************************/
@@ -0,0 +1,55 @@
+/* LibTomCrypt, modular cryptographic library -- Tom St Denis
+ *
+ * LibTomCrypt is a library that provides various cryptographic
+ * algorithms in a highly modular and flexible manner.
+ *
+ * The library is free for all purposes without any express
+ * guarantee it works.
+ *
+ * Tom St Denis, tomstdenis@gmail.com, http://libtom.org
+ *
+ */
+
+/* Adapted for VeraCrypt */
+
+#ifndef _SHA2_SMALL_H
+#define _SHA2_SMALL_H
+
+#include "Common/Tcdefs.h"
+#include "Common/Endian.h"
+
+#define SHA256_DIGEST_SIZE  32
+#define SHA256_BLOCK_SIZE   64
+
+#define VOID_RETURN	void
+#define INT_RETURN	int
+
+#if defined(__cplusplus)
+extern "C"
+{
+#endif
+
+typedef struct {
+
+	uint32		highLength;
+	uint32		lowLength;
+	uint32		state[8];
+	unsigned int curlen;
+	unsigned char buf[64];
+} sha256_ctx;
+
+/******************************************************************************/
+
+VOID_RETURN sha256_begin(sha256_ctx* ctx);
+VOID_RETURN sha256_hash(unsigned char* data, unsigned int len, sha256_ctx* ctx);
+VOID_RETURN sha256_end(unsigned char* hval, sha256_ctx* ctx);
+
+#if defined(__cplusplus)
+}
+#endif
+
+/******************************************************************************/
+
+#endif /* _h_PS_DIGEST */
+/******************************************************************************/
+
@@ -369,7 +369,7 @@ static u4byte mds_rem(u4byte p0, u4byte p1)

 /* initialise the key schedule from the user supplied key   */

-u4byte *twofish_set_key(TwofishInstance *instance, const u4byte in_key[], const u4byte key_len)
+u4byte *twofish_set_key(TwofishInstance *instance, const u4byte in_key[])
 {   u4byte  i, a, b, me_key[4], mo_key[4];
 	u4byte *l_key, *s_key;

@@ -390,7 +390,7 @@ u4byte *twofish_set_key(TwofishInstance *instance, const u4byte in_key[], const
    }
 #endif

-    instance->k_len = key_len / 64;   /* 2, 3 or 4 */
+    instance->k_len = 4;

    for(i = 0; i < instance->k_len; ++i)
    {
@@ -44,7 +44,8 @@ typedef struct

 #define TWOFISH_KS		sizeof(TwofishInstance)

-u4byte * twofish_set_key(TwofishInstance *instance, const u4byte in_key[], const u4byte key_len);
+/* in_key must be 32-bytes long */
+u4byte * twofish_set_key(TwofishInstance *instance, const u4byte in_key[]);
 void twofish_encrypt(TwofishInstance *instance, const u4byte in_blk[4], u4byte out_blk[]);
 void twofish_decrypt(TwofishInstance *instance, const u4byte in_blk[4], u4byte out_blk[4]);

@@ -97,28 +97,32 @@ NTSTATUS LoadBootArguments ()
 				TC_BUG_CHECK (STATUS_CRC_ERROR);
 			}

-			BootLoaderSegment = bootLoaderSegment;
+			// Sanity check: for valid boot argument, the password is less than 64 bytes long
+			if (bootArguments->BootPassword.Length <= MAX_PASSWORD)
+			{
+				BootLoaderSegment = bootLoaderSegment;

-			BootArgs = *bootArguments;
-			BootArgsValid = TRUE;
-			burn (bootArguments, sizeof (*bootArguments));
+				BootArgs = *bootArguments;
+				BootArgsValid = TRUE;
+				burn (bootArguments, sizeof (*bootArguments));

-			BootDriveSignatureValid = TRUE;
+				BootDriveSignatureValid = TRUE;

-			Dump ("BootLoaderVersion = %x\n", (int) BootArgs.BootLoaderVersion);
-			Dump ("HeaderSaltCrc32 = %x\n", (int) BootArgs.HeaderSaltCrc32);
-			Dump ("CryptoInfoOffset = %x\n", (int) BootArgs.CryptoInfoOffset);
-			Dump ("CryptoInfoLength = %d\n", (int) BootArgs.CryptoInfoLength);
-			Dump ("HiddenSystemPartitionStart = %I64u\n", BootArgs.HiddenSystemPartitionStart);
-			Dump ("DecoySystemPartitionStart = %I64u\n", BootArgs.DecoySystemPartitionStart);
-			Dump ("Flags = %x\n", BootArgs.Flags);
-			Dump ("BootDriveSignature = %x\n", BootArgs.BootDriveSignature);
-			Dump ("BootArgumentsCrc32 = %x\n", BootArgs.BootArgumentsCrc32);
+				Dump ("BootLoaderVersion = %x\n", (int) BootArgs.BootLoaderVersion);
+				Dump ("HeaderSaltCrc32 = %x\n", (int) BootArgs.HeaderSaltCrc32);
+				Dump ("CryptoInfoOffset = %x\n", (int) BootArgs.CryptoInfoOffset);
+				Dump ("CryptoInfoLength = %d\n", (int) BootArgs.CryptoInfoLength);
+				Dump ("HiddenSystemPartitionStart = %I64u\n", BootArgs.HiddenSystemPartitionStart);
+				Dump ("DecoySystemPartitionStart = %I64u\n", BootArgs.DecoySystemPartitionStart);
+				Dump ("Flags = %x\n", BootArgs.Flags);
+				Dump ("BootDriveSignature = %x\n", BootArgs.BootDriveSignature);
+				Dump ("BootArgumentsCrc32 = %x\n", BootArgs.BootArgumentsCrc32);

-			if (CacheBootPassword && BootArgs.BootPassword.Length > 0)
-				AddPasswordToCache (&BootArgs.BootPassword);
+				if (CacheBootPassword && BootArgs.BootPassword.Length > 0)
+					AddPasswordToCache (&BootArgs.BootPassword);

-			status = STATUS_SUCCESS;
+				status = STATUS_SUCCESS;
+			}
 		}

 		MmUnmapIoSpace (mappedBootArgs, sizeof (BootArguments));
@@ -323,7 +327,7 @@ static NTSTATUS MountDrive (DriveFilterExtension *Extension, Password *password,
 			if (mappedCryptoInfo)
 			{
 				Dump ("Wiping memory %x %d\n", cryptoInfoAddress.LowPart, BootArgs.CryptoInfoLength);
-				memset (mappedCryptoInfo, 0, BootArgs.CryptoInfoLength);
+				burn (mappedCryptoInfo, BootArgs.CryptoInfoLength);
 				MmUnmapIoSpace (mappedCryptoInfo, BootArgs.CryptoInfoLength);
 			}
 		}
@@ -1320,7 +1324,14 @@ static VOID SetupThreadProc (PVOID threadArg)
 			if (SetupRequest.WipeAlgorithm != TC_WIPE_NONE)
 			{
 				byte wipePass;
-				for (wipePass = 1; wipePass <= GetWipePassCount (SetupRequest.WipeAlgorithm); ++wipePass)
+				int wipePassCount = GetWipePassCount (SetupRequest.WipeAlgorithm);
+				if (wipePassCount <= 0)
+				{
+					SetupResult = STATUS_INVALID_PARAMETER;
+					goto err;
+				}
+
+				for (wipePass = 1; wipePass <= wipePassCount; ++wipePass)
 				{
 					if (!WipeBuffer (SetupRequest.WipeAlgorithm, wipeRandChars, wipePass, wipeBuffer, setupBlockSize))
 					{
@@ -1614,6 +1625,7 @@ void GetBootEncryptionAlgorithmName (PIRP irp, PIO_STACK_LOCATION irpSp)
 		{
 			GetBootEncryptionAlgorithmNameRequest *request = (GetBootEncryptionAlgorithmNameRequest *) irp->AssociatedIrp.SystemBuffer;
 			EAGetName (request->BootEncryptionAlgorithmName, BootDriveFilterExtension->Queue.CryptoInfo->ea);
+			HashGetName2 (request->BootPrfAlgorithmName, BootDriveFilterExtension->Queue.CryptoInfo->pkcs5);

 			irp->IoStatus.Information = sizeof (GetBootEncryptionAlgorithmNameRequest);
 			irp->IoStatus.Status = STATUS_SUCCESS;
@@ -1692,7 +1704,7 @@ static VOID DecoySystemWipeThreadProc (PVOID threadArg)
 	byte *wipeBuffer = NULL;
 	byte *wipeRandBuffer = NULL;
 	byte wipeRandChars[TC_WIPE_RAND_CHAR_COUNT];
-	int wipePass;
+	int wipePass, wipePassCount;
 	int ea = Extension->Queue.CryptoInfo->ea;

 	KIRQL irql;
@@ -1755,7 +1767,14 @@ static VOID DecoySystemWipeThreadProc (PVOID threadArg)
 		if (offset.QuadPart > Extension->ConfiguredEncryptedAreaEnd)
 			break;

-		for (wipePass = 1; wipePass <= GetWipePassCount (WipeDecoyRequest.WipeAlgorithm); ++wipePass)
+		wipePassCount = GetWipePassCount (WipeDecoyRequest.WipeAlgorithm);
+		if (wipePassCount <= 0)
+		{
+			DecoySystemWipeResult = STATUS_INVALID_PARAMETER;
+			goto err;
+		}
+
+		for (wipePass = 1; wipePass <= wipePassCount; ++wipePass)
 		{
 			if (!WipeBuffer (WipeDecoyRequest.WipeAlgorithm, wipeRandChars, wipePass, wipeBuffer, wipeBlockSize))
 			{
@@ -27,8 +27,8 @@ LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
 //

 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,0,4,0
- PRODUCTVERSION 1,0,4,0
+ FILEVERSION 1,0,5,0
+ PRODUCTVERSION 1,0,5,0
 FILEFLAGSMASK 0x17L
 #ifdef _DEBUG
 FILEFLAGS 0x1L
@@ -45,11 +45,11 @@ BEGIN
        BEGIN
            VALUE "CompanyName", "IDRIX"
            VALUE "FileDescription", "VeraCrypt Driver"
-            VALUE "FileVersion", "1.13"
+            VALUE "FileVersion", "1.14"
            VALUE "LegalTrademarks", "VeraCrypt"
            VALUE "OriginalFilename", "veracrypt.sys"
            VALUE "ProductName", "VeraCrypt"
-            VALUE "ProductVersion", "1.0d"
+            VALUE "ProductVersion", "1.0e"
        END
    END
    BLOCK "VarFileInfo"
@@ -13,6 +13,7 @@
 #include "EncryptedIoQueue.h"
 #include "EncryptionThreadPool.h"
 #include "Volumes.h"
+#include <IntSafe.h>


 static void AcquireBufferPoolMutex (EncryptedIoQueue *queue)
@@ -492,6 +493,8 @@ static VOID MainThreadProc (PVOID threadArg)
 	EncryptedIoRequest *request;
 	uint64 intersectStart;
 	uint32 intersectLength;
+	ULONGLONG addResult;
+	HRESULT hResult;

 	if (IsEncryptionThreadPoolRunning())
 		KeSetPriorityThread (KeGetCurrentThread(), LOW_REALTIME_PRIORITY);
@@ -561,8 +564,15 @@ static VOID MainThreadProc (PVOID threadArg)
 				&& (item->OriginalOffset.QuadPart & (ENCRYPTION_DATA_UNIT_SIZE - 1)) != 0)
 			{
 				byte *buffer;
-				ULONG alignedLength = item->OriginalLength + ENCRYPTION_DATA_UNIT_SIZE;
+				ULONG alignedLength;
 				LARGE_INTEGER alignedOffset;
+				hResult = ULongAdd(item->OriginalLength, ENCRYPTION_DATA_UNIT_SIZE, &alignedLength);
+				if (hResult != S_OK)
+				{
+					CompleteOriginalIrp (item, STATUS_INVALID_PARAMETER, 0);
+					continue;
+				}
+
 				alignedOffset.QuadPart = item->OriginalOffset.QuadPart & ~((LONGLONG) ENCRYPTION_DATA_UNIT_SIZE - 1);

 				buffer = TCalloc (alignedLength);
@@ -608,7 +618,12 @@ static VOID MainThreadProc (PVOID threadArg)
 			if (item->OriginalLength == 0
 				|| (item->OriginalLength & (ENCRYPTION_DATA_UNIT_SIZE - 1)) != 0
 				|| (item->OriginalOffset.QuadPart & (ENCRYPTION_DATA_UNIT_SIZE - 1)) != 0
-				|| (!queue->IsFilterDevice && item->OriginalOffset.QuadPart + item->OriginalLength > queue->VirtualDeviceLength))
+				|| (	!queue->IsFilterDevice && 
+						(	(S_OK != ULongLongAdd(item->OriginalOffset.QuadPart, item->OriginalLength, &addResult))
+							||	(addResult > (ULONGLONG) queue->VirtualDeviceLength)
+						)
+					)
+				)
 			{
 				CompleteOriginalIrp (item, STATUS_INVALID_PARAMETER, 0);
 				continue;
@@ -622,9 +637,17 @@ static VOID MainThreadProc (PVOID threadArg)
 			{
 				// Adjust the offset for host file or device
 				if (queue->CryptoInfo->hiddenVolume)
-					item->OriginalOffset.QuadPart += queue->CryptoInfo->hiddenVolumeOffset;
+					hResult = ULongLongAdd(item->OriginalOffset.QuadPart, queue->CryptoInfo->hiddenVolumeOffset, &addResult);
 				else
-					item->OriginalOffset.QuadPart += queue->CryptoInfo->volDataAreaOffset; 
+					hResult = ULongLongAdd(item->OriginalOffset.QuadPart, queue->CryptoInfo->volDataAreaOffset, &addResult); 
+
+				if (hResult != S_OK)
+				{
+					CompleteOriginalIrp (item, STATUS_INVALID_PARAMETER, 0);
+					continue;
+				}
+				else
+					item->OriginalOffset.QuadPart = addResult;

 				// Hidden volume protection
 				if (item->Write && queue->CryptoInfo->bProtectHiddenVolume)
@@ -34,6 +34,7 @@
 #include <ntddvol.h>

 #include <Ntstrsafe.h>
+#include <Intsafe.h>

 /* Init section, which is thrown away as soon as DriverEntry returns */
 #pragma alloc_text(INIT,DriverEntry)
@@ -704,10 +705,20 @@ NTSTATUS ProcessVolumeDeviceControlIrp (PDEVICE_OBJECT DeviceObject, PEXTENSION
 	case IOCTL_DISK_VERIFY:
 		if (ValidateIOBufferSize (Irp, sizeof (VERIFY_INFORMATION), ValidateInput))
 		{
+			HRESULT hResult;
+			ULONGLONG ullStartingOffset, ullNewOffset, ullEndOffset; 
 			PVERIFY_INFORMATION pVerifyInformation;
 			pVerifyInformation = (PVERIFY_INFORMATION) Irp->AssociatedIrp.SystemBuffer;

-			if (pVerifyInformation->StartingOffset.QuadPart + pVerifyInformation->Length > Extension->DiskLength)
+			ullStartingOffset = (ULONGLONG) pVerifyInformation->StartingOffset.QuadPart;
+			hResult = ULongLongAdd(ullStartingOffset, 
+				(ULONGLONG) Extension->cryptoInfo->hiddenVolume ? Extension->cryptoInfo->hiddenVolumeOffset : Extension->cryptoInfo->volDataAreaOffset, 
+				&ullNewOffset);
+			if (hResult != S_OK)
+				Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+			else if (S_OK != ULongLongAdd(ullNewOffset, (ULONGLONG) pVerifyInformation->Length, &ullEndOffset))
+				Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
+			else if (ullEndOffset > (ULONGLONG) Extension->DiskLength)
 				Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
 			else
 			{
@@ -721,7 +732,7 @@ NTSTATUS ProcessVolumeDeviceControlIrp (PDEVICE_OBJECT DeviceObject, PEXTENSION
 				else
 				{
 					LARGE_INTEGER offset = pVerifyInformation->StartingOffset;
-					offset.QuadPart += Extension->cryptoInfo->hiddenVolume ? Extension->cryptoInfo->hiddenVolumeOffset : Extension->cryptoInfo->volDataAreaOffset;
+					offset.QuadPart = ullNewOffset;

 					Irp->IoStatus.Status = ZwReadFile (Extension->hDeviceFile, NULL, NULL, NULL, &ioStatus, buffer, pVerifyInformation->Length, &offset, NULL);
 					TCfree (buffer);
@@ -1504,7 +1515,9 @@ NTSTATUS ProcessMainDeviceControlIrp (PDEVICE_OBJECT DeviceObject, PEXTENSION Ex
 		break;

 	case TC_IOCTL_GET_SYSTEM_DRIVE_DUMP_CONFIG:
-		if (ValidateIOBufferSize (Irp, sizeof (GetSystemDriveDumpConfigRequest), ValidateOutput))
+		if (	(ValidateIOBufferSize (Irp, sizeof (GetSystemDriveDumpConfigRequest), ValidateOutput))
+			&&	(Irp->RequestorMode == KernelMode)
+			)
 		{
 			GetSystemDriveDumpConfigRequest *request = (GetSystemDriveDumpConfigRequest *) Irp->AssociatedIrp.SystemBuffer;

@@ -1732,6 +1745,22 @@ void TCSleep (int milliSeconds)
 	TCfree (timer);
 }

+BOOL IsDeviceName(wchar_t wszVolume[TC_MAX_PATH])
+{
+	if	(	(wszVolume[0] == '\\')
+		&&	(wszVolume[1] == 'D' || wszVolume[1] == 'd')
+		&&	(wszVolume[2] == 'E' || wszVolume[2] == 'e')
+		&&	(wszVolume[3] == 'V' || wszVolume[3] == 'v')
+		&&	(wszVolume[4] == 'I' || wszVolume[4] == 'i')
+		&&	(wszVolume[5] == 'C' || wszVolume[5] == 'c')
+		&&	(wszVolume[6] == 'E' || wszVolume[6] == 'e')
+		)
+	{
+		return TRUE;
+	}
+	else
+		return FALSE;
+}

 /* VolumeThreadProc does all the work of processing IRP's, and dispatching them
   to either the ReadWrite function or the DeviceControl function */
@@ -1747,7 +1776,7 @@ VOID VolumeThreadProc (PVOID Context)

 	Dump ("Mount THREAD OPENING VOLUME BEGIN\n");

-	if (memcmp (pThreadBlock->mount->wszVolume, WIDE ("\\Device"), 14) != 0)
+	if ( !IsDeviceName (pThreadBlock->mount->wszVolume))
 	{
 		RtlStringCbCopyW (pThreadBlock->wszMountVolume, sizeof(pThreadBlock->wszMountVolume),WIDE ("\\??\\"));
 		RtlStringCbCatW (pThreadBlock->wszMountVolume, sizeof(pThreadBlock->wszMountVolume),pThreadBlock->mount->wszVolume);
@@ -28,8 +28,8 @@ LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
 //

 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,0,4,0
- PRODUCTVERSION 1,0,4,0
+ FILEVERSION 1,0,5,0
+ PRODUCTVERSION 1,0,5,0
 FILEFLAGSMASK 0x17L
 #ifdef _DEBUG
 FILEFLAGS 0x1L
@@ -46,11 +46,11 @@ BEGIN
        BEGIN
            VALUE "CompanyName", "IDRIX"
            VALUE "FileDescription", "VeraCrypt Format"
-            VALUE "FileVersion", "1.0d"
+            VALUE "FileVersion", "1.0e"
            VALUE "LegalTrademarks", "VeraCrypt"
            VALUE "OriginalFilename", "VeraCrypt Format.exe"
            VALUE "ProductName", "VeraCrypt"
-            VALUE "ProductVersion", "1.0d"
+            VALUE "ProductVersion", "1.0e"
        END
    END
    BLOCK "VarFileInfo"
@@ -861,10 +861,18 @@ inplace_enc_read:
 		if (wipeAlgorithm != TC_WIPE_NONE)
 		{
 			byte wipePass;
+			int wipePassCount = GetWipePassCount (wipeAlgorithm);
+
+			if (wipePassCount <= 0)
+			{
+				SetLastError (ERROR_INVALID_PARAMETER);
+				nStatus = ERR_PARAMETER_INCORRECT;
+				goto closing_seq;
+			}

 			offset.QuadPart = masterCryptoInfo->EncryptedAreaStart.Value - workChunkSize;

-			for (wipePass = 1; wipePass <= GetWipePassCount (wipeAlgorithm); ++wipePass)
+			for (wipePass = 1; wipePass <= wipePassCount; ++wipePass)
 			{
 				if (!WipeBuffer (wipeAlgorithm, wipeRandChars, wipePass, wipeBuffer, workChunkSize))
 				{
@@ -377,7 +377,8 @@ static void localcleanup (void)

 static BOOL CALLBACK BroadcastSysEncCfgUpdateCallb (HWND hwnd, LPARAM lParam)
 {
-	if (GetWindowLongPtr (hwnd, GWLP_USERDATA) == (LONG_PTR) 'VERA')
+	LONG_PTR userDataVal = GetWindowLongPtr (hwnd, GWLP_USERDATA);
+	if ((userDataVal == (LONG_PTR) 'VERA') || (userDataVal == (LONG_PTR) 'TRUE')) // Prior to 1.0e, 'TRUE' was used for VeraCrypt dialogs
 	{
 		char name[1024] = { 0 };
 		GetWindowText (hwnd, name, sizeof (name) - 1);
@@ -3734,16 +3735,25 @@ BOOL CALLBACK PageDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 				if (SysEncInEffect ())
 				{
 					hash_algo = DEFAULT_HASH_ALGORITHM_BOOT;
-					RandSetHashFunction (DEFAULT_HASH_ALGORITHM_BOOT);
+					RandSetHashFunction (hash_algo);
+
+					for (hid = FIRST_PRF_ID; hid <= LAST_PRF_ID; hid++)
+					{
+						// For now, we keep RIPEMD160 for system encryption
+						if (((hid == RIPEMD160) || !HashIsDeprecated (hid)) && HashForSystemEncryption (hid))
+							AddComboPair (GetDlgItem (hwndDlg, IDC_COMBO_BOX_HASH_ALGO), HashGetName(hid), hid);
+					}					
 				}
 				else
-					hash_algo = RandGetHashFunction();
-
-				for (hid = FIRST_PRF_ID; hid <= LAST_PRF_ID; hid++)
 				{
-					if (!HashIsDeprecated (hid))
-						AddComboPair (GetDlgItem (hwndDlg, IDC_COMBO_BOX_HASH_ALGO), HashGetName(hid), hid);
+					hash_algo = RandGetHashFunction();
+					for (hid = FIRST_PRF_ID; hid <= LAST_PRF_ID; hid++)
+					{
+						if (!HashIsDeprecated (hid))
+							AddComboPair (GetDlgItem (hwndDlg, IDC_COMBO_BOX_HASH_ALGO), HashGetName(hid), hid);
+					}
 				}
+
 				SelectAlgo (GetDlgItem (hwndDlg, IDC_COMBO_BOX_HASH_ALGO), &hash_algo);

 				ToHyperlink (hwndDlg, IDC_LINK_HASH_INFO);
@@ -5226,15 +5236,17 @@ BOOL CALLBACK PageDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 				break;

 			case IDC_COMBO_BOX_HASH_ALGO:
-				if (SysEncInEffect ()
-					&& SendMessage (GetDlgItem (hwndDlg, IDC_COMBO_BOX_HASH_ALGO), CB_GETITEMDATA, 
-					SendMessage (GetDlgItem (hwndDlg, IDC_COMBO_BOX_HASH_ALGO), CB_GETCURSEL, 0, 0), 0) 
-					!= DEFAULT_HASH_ALGORITHM_BOOT)
+				if (SysEncInEffect ())
 				{
-					hash_algo = DEFAULT_HASH_ALGORITHM_BOOT;
-					RandSetHashFunction (DEFAULT_HASH_ALGORITHM_BOOT);
-					Info ("ALGO_NOT_SUPPORTED_FOR_SYS_ENCRYPTION");
-					SelectAlgo (GetDlgItem (hwndDlg, IDC_COMBO_BOX_HASH_ALGO), &hash_algo);
+					HWND hHashAlgoItem = GetDlgItem (hwndDlg, IDC_COMBO_BOX_HASH_ALGO);
+					LRESULT selectedAlgo = SendMessage (hHashAlgoItem, CB_GETITEMDATA, SendMessage (hHashAlgoItem, CB_GETCURSEL, 0, 0), 0);
+					if (!HashForSystemEncryption(selectedAlgo))
+					{
+						hash_algo = DEFAULT_HASH_ALGORITHM_BOOT;
+						RandSetHashFunction (DEFAULT_HASH_ALGORITHM_BOOT);
+						Info ("ALGO_NOT_SUPPORTED_FOR_SYS_ENCRYPTION");
+						SelectAlgo (GetDlgItem (hwndDlg, IDC_COMBO_BOX_HASH_ALGO), &hash_algo);
+					}
 				}
 				break;
 			}
@@ -36,7 +36,6 @@ namespace VeraCrypt

 	FilePath Application::GetConfigFilePath (const wxString &configFileName, bool createConfigDir)
 	{
-		wxStandardPaths& stdPaths = wxStandardPaths::Get();
 		DirectoryPath configDir;
 		
 		if (!Core->IsInPortableMode())
@@ -46,6 +45,7 @@ namespace VeraCrypt
 			configPath.Normalize();
 			configDir = wstring (configPath.GetFullPath());
 #else
+			wxStandardPaths& stdPaths = wxStandardPaths::Get();
 			configDir = wstring (stdPaths.GetUserDataDir());
 #endif
 		}
@@ -392,6 +392,7 @@ MainFrameBase::MainFrameBase( wxWindow* parent, wxWindowID id, const wxString& t
 	
 	this->SetSizer( bSizer1 );
 	this->Layout();
+	bSizer1->Fit( this );
 	
 	this->Centre( wxBOTH );
 	
@@ -1743,7 +1744,9 @@ PreferencesDialogBase::PreferencesDialogBase( wxWindow* parent, wxWindowID id, c
 	DismountOnInactivityCheckBox = new wxCheckBox( SecurityPage, wxID_ANY, _("Auto-dismount volume after no data has been read/written to it for"), wxDefaultPosition, wxDefaultSize, 0 );
 	bSizer34->Add( DismountOnInactivityCheckBox, 0, wxTOP|wxBOTTOM|wxLEFT|wxALIGN_CENTER_VERTICAL, 5 );
 	
-	DismountOnInactivitySpinCtrl = new wxSpinCtrl( SecurityPage, wxID_ANY, wxT("1"), wxDefaultPosition, wxSize( 60,-1 ), wxSP_ARROW_KEYS, 1, 9999, 1 );
+	DismountOnInactivitySpinCtrl = new wxSpinCtrl( SecurityPage, wxID_ANY, wxT("1"), wxDefaultPosition, wxSize( -1,-1 ), wxSP_ARROW_KEYS, 1, 9999, 1 );
+	DismountOnInactivitySpinCtrl->SetMinSize( wxSize( 60,-1 ) );
+	
 	bSizer34->Add( DismountOnInactivitySpinCtrl, 0, wxALIGN_CENTER_VERTICAL|wxALL, 5 );
 	
 	wxStaticText* m_staticText5;
@@ -2542,6 +2545,8 @@ InfoWizardPageBase::~InfoWizardPageBase()

 KeyfilesPanelBase::KeyfilesPanelBase( wxWindow* parent, wxWindowID id, const wxPoint& pos, const wxSize& size, long style ) : wxPanel( parent, id, pos, size, style )
 {
+	this->SetMinSize( wxSize( 500,300 ) );
+	
 	wxBoxSizer* bSizer19;
 	bSizer19 = new wxBoxSizer( wxVERTICAL );
 	
@@ -2584,6 +2589,7 @@ KeyfilesPanelBase::KeyfilesPanelBase( wxWindow* parent, wxWindowID id, const wxP
 	
 	this->SetSizer( bSizer19 );
 	this->Layout();
+	bSizer19->Fit( this );
 	
 	// Connect Events
 	KeyfilesListCtrl->Connect( wxEVT_COMMAND_LIST_ITEM_DESELECTED, wxListEventHandler( KeyfilesPanelBase::OnListItemDeselected ), NULL, this );
@@ -2657,6 +2663,8 @@ ProgressWizardPageBase::~ProgressWizardPageBase()

 SelectDirectoryWizardPageBase::SelectDirectoryWizardPageBase( wxWindow* parent, wxWindowID id, const wxPoint& pos, const wxSize& size, long style ) : WizardPage( parent, id, pos, size, style )
 {
+	this->SetMinSize( wxSize( 200,65 ) );
+	
 	wxBoxSizer* bSizer68;
 	bSizer68 = new wxBoxSizer( wxVERTICAL );
 	
@@ -2686,6 +2694,7 @@ SelectDirectoryWizardPageBase::SelectDirectoryWizardPageBase( wxWindow* parent,
 	
 	this->SetSizer( bSizer68 );
 	this->Layout();
+	bSizer68->Fit( this );
 	
 	// Connect Events
 	DirectoryTextCtrl->Connect( wxEVT_COMMAND_TEXT_UPDATED, wxCommandEventHandler( SelectDirectoryWizardPageBase::OnDirectoryTextChanged ), NULL, this );
@@ -147,7 +147,7 @@ namespace VeraCrypt
 		
 		public:
 			
-			MainFrameBase( wxWindow* parent, wxWindowID id = wxID_ANY, const wxString& title = _("VeraCrypt"), const wxPoint& pos = wxDefaultPosition, const wxSize& size = wxSize( -1,496 ), long style = wxCAPTION|wxCLOSE_BOX|wxMINIMIZE_BOX|wxSYSTEM_MENU|wxTAB_TRAVERSAL );
+			MainFrameBase( wxWindow* parent, wxWindowID id = wxID_ANY, const wxString& title = _("VeraCrypt"), const wxPoint& pos = wxDefaultPosition, const wxSize& size = wxSize( -1,-1 ), long style = wxCAPTION|wxCLOSE_BOX|wxMINIMIZE_BOX|wxSYSTEM_MENU|wxTAB_TRAVERSAL );
 			
 			~MainFrameBase();
 		
@@ -766,7 +766,7 @@ namespace VeraCrypt
 		
 		public:
 			
-			KeyfilesPanelBase( wxWindow* parent, wxWindowID id = wxID_ANY, const wxPoint& pos = wxDefaultPosition, const wxSize& size = wxSize( 500,300 ), long style = wxTAB_TRAVERSAL ); 
+			KeyfilesPanelBase( wxWindow* parent, wxWindowID id = wxID_ANY, const wxPoint& pos = wxDefaultPosition, const wxSize& size = wxSize( -1,-1 ), long style = wxTAB_TRAVERSAL ); 
 			~KeyfilesPanelBase();
 		
 	};
@@ -814,7 +814,7 @@ namespace VeraCrypt
 		
 		public:
 			
-			SelectDirectoryWizardPageBase( wxWindow* parent, wxWindowID id = wxID_ANY, const wxPoint& pos = wxDefaultPosition, const wxSize& size = wxSize( 200,65 ), long style = wxTAB_TRAVERSAL ); 
+			SelectDirectoryWizardPageBase( wxWindow* parent, wxWindowID id = wxID_ANY, const wxPoint& pos = wxDefaultPosition, const wxSize& size = wxSize( -1,-1 ), long style = wxTAB_TRAVERSAL ); 
 			~SelectDirectoryWizardPageBase();
 		
 	};
@@ -154,7 +154,7 @@ namespace VeraCrypt
 		Gui->SetListCtrlColumnWidths (HotkeyListCtrl, colPermilles);

 		RestoreValidatorBell = !wxTextValidator::IsSilent();
-		wxTextValidator::SetBellOnError (true);
+		wxTextValidator::SuppressBellOnError (true);
 		HotkeyTextCtrl->SetValidator (wxTextValidator (wxFILTER_INCLUDE_CHAR_LIST));

 		UpdateHotkeyButtons();
@@ -203,8 +203,10 @@ namespace VeraCrypt

 	PreferencesDialog::~PreferencesDialog ()
 	{
+#ifdef TC_WINDOWS
 		if (RestoreValidatorBell)
-			wxTextValidator::SetBellOnError (false);
+			wxTextValidator::SuppressBellOnError (false);
+#endif
 	}

 	void PreferencesDialog::SelectPage (wxPanel *page)
@@ -44,7 +44,7 @@
            <property name="minimum_size">-1,496</property>
            <property name="name">MainFrameBase</property>
            <property name="pos"></property>
-            <property name="size">-1,496</property>
+            <property name="size">-1,-1</property>
            <property name="style">wxCAPTION|wxCLOSE_BOX|wxMINIMIZE_BOX|wxSYSTEM_MENU</property>
            <property name="subclass"></property>
            <property name="title">VeraCrypt</property>
@@ -12833,7 +12833,7 @@
                                                                            <property name="min">1</property>
                                                                            <property name="min_size"></property>
                                                                            <property name="minimize_button">0</property>
-                                                                            <property name="minimum_size"></property>
+                                                                            <property name="minimum_size">60,-1</property>
                                                                            <property name="moveable">1</property>
                                                                            <property name="name">DismountOnInactivitySpinCtrl</property>
                                                                            <property name="pane_border">1</property>
@@ -12844,7 +12844,7 @@
                                                                            <property name="pos"></property>
                                                                            <property name="resize">Resizable</property>
                                                                            <property name="show">1</property>
-                                                                            <property name="size">60,-1</property>
+                                                                            <property name="size">-1,-1</property>
                                                                            <property name="style">wxSP_ARROW_KEYS</property>
                                                                            <property name="subclass"></property>
                                                                            <property name="toolbar_pane">0</property>
@@ -19939,10 +19939,10 @@
            <property name="hidden">0</property>
            <property name="id">wxID_ANY</property>
            <property name="maximum_size"></property>
-            <property name="minimum_size"></property>
+            <property name="minimum_size">500,300</property>
            <property name="name">KeyfilesPanelBase</property>
            <property name="pos"></property>
-            <property name="size">500,300</property>
+            <property name="size">-1,-1</property>
            <property name="subclass"></property>
            <property name="tooltip"></property>
            <property name="window_extra_style"></property>
@@ -20915,10 +20915,10 @@
            <property name="hidden">0</property>
            <property name="id">wxID_ANY</property>
            <property name="maximum_size"></property>
-            <property name="minimum_size"></property>
+            <property name="minimum_size">200,65</property>
            <property name="name">SelectDirectoryWizardPageBase</property>
            <property name="pos"></property>
-            <property name="size">200,65</property>
+            <property name="size">-1,-1</property>
            <property name="subclass">WizardPage; WizardPage.h</property>
            <property name="tooltip"></property>
            <property name="window_extra_style"></property>
@@ -422,6 +422,7 @@ namespace VeraCrypt
 				case VolumeCreationOptions::FilesystemType::Ext4:		fsFormatter = "mkfs.ext4"; break;
 				case VolumeCreationOptions::FilesystemType::MacOsExt:	fsFormatter = "newfs_hfs"; break;
 				case VolumeCreationOptions::FilesystemType::UFS:		fsFormatter = "newfs" ; break;
+				case VolumeCreationOptions::FilesystemType::NTFS:		fsFormatter = "mkfs.ntfs" ; break;
 				default: break;
 				}

@@ -30,6 +30,7 @@ namespace VeraCrypt
 		FilesystemTypeChoice->Append (L"Linux Ext2",		(void *) VolumeCreationOptions::FilesystemType::Ext2);
 		FilesystemTypeChoice->Append (L"Linux Ext3",		(void *) VolumeCreationOptions::FilesystemType::Ext3);
 		FilesystemTypeChoice->Append (L"Linux Ext4",		(void *) VolumeCreationOptions::FilesystemType::Ext4);
+		FilesystemTypeChoice->Append (L"NTFS",				(void *) VolumeCreationOptions::FilesystemType::NTFS);
 #elif defined (TC_MACOSX)
 		FilesystemTypeChoice->Append (L"Mac OS Extended",	(void *) VolumeCreationOptions::FilesystemType::MacOsExt);
 #elif defined (TC_FREEBSD) || defined (TC_SOLARIS)
@@ -996,13 +996,8 @@ namespace VeraCrypt
 		{
 			try
 			{
-#ifdef TC_MACOSX
 				if (wxExecute (fileType->GetOpenCommand (document.GetFullPath())) != 0)
 					return;
-#else
-				if (wxExecute (fileType->GetOpenCommand (L"\"" + document.GetFullPath() + L"\"")) != 0)
-					return;
-#endif
 			}
 			catch (TimeOut&) { }
 		}
@@ -698,6 +698,7 @@ namespace VeraCrypt
 				ShowInfo (L" 3) Linux Ext2"); filesystems.push_back (VolumeCreationOptions::FilesystemType::Ext2);
 				ShowInfo (L" 4) Linux Ext3"); filesystems.push_back (VolumeCreationOptions::FilesystemType::Ext3);
 				ShowInfo (L" 5) Linux Ext4"); filesystems.push_back (VolumeCreationOptions::FilesystemType::Ext4);
+				ShowInfo (L" 6) NTFS");       filesystems.push_back (VolumeCreationOptions::FilesystemType::NTFS);
 #elif defined (TC_MACOSX)
 				ShowInfo (L" 3) Mac OS Extended"); filesystems.push_back (VolumeCreationOptions::FilesystemType::MacOsExt);
 #elif defined (TC_FREEBSD) || defined (TC_SOLARIS)
@@ -763,8 +764,8 @@ namespace VeraCrypt

 				ShowString (wxString::Format (L"\rDone: %7.3f%%  Speed: %9s  Left: %s         ",
 					100.0 - double (options->Size - progress.SizeDone) / (double (options->Size) / 100.0),
-					speed > 0 ? SpeedToString (speed).c_str() : L" ",
-					speed > 0 ? TimeSpanToString ((options->Size - progress.SizeDone) / speed).c_str() : L""));
+					speed > 0 ? (const wchar_t*) SpeedToString (speed).c_str() : L" ",
+					speed > 0 ? (const wchar_t*) TimeSpanToString ((options->Size - progress.SizeDone) / speed).c_str() : L""));
 			}

 			Thread::Sleep (100);
@@ -786,6 +787,7 @@ namespace VeraCrypt
 			case VolumeCreationOptions::FilesystemType::Ext4:		fsFormatter = "mkfs.ext4"; break;
 			case VolumeCreationOptions::FilesystemType::MacOsExt:	fsFormatter = "newfs_hfs"; break;
 			case VolumeCreationOptions::FilesystemType::UFS:		fsFormatter = "newfs" ; break;
+			case VolumeCreationOptions::FilesystemType::NTFS:		fsFormatter = "mkfs.ntfs"; break;
 			default: throw ParameterIncorrect (SRC_POS);
 			}

@@ -952,7 +952,7 @@ static void LaunchVolCreationWizard (HWND hwndDlg, const char *arg)
 		ZeroMemory (&si, sizeof (si));

 		*tmp = 0;
-		StringCbCopyA (t, sizeof(t), "\\VeraCrypt Format.exe\"");
+		StringCbCatA (t, sizeof(t), "\\VeraCrypt Format.exe\"");

 		if (!FileExists(t))
 			Error ("VOL_CREATION_WIZARD_NOT_FOUND");	// Display a user-friendly error message and advise what to do
@@ -1712,7 +1712,7 @@ BOOL CALLBACK PasswordChangeDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPAR
 					int new_hash_algo_id = SendMessage (GetDlgItem (hwndDlg, IDC_PKCS5_PRF_ID), CB_GETITEMDATA, 
 						SendMessage (GetDlgItem (hwndDlg, IDC_PKCS5_PRF_ID), CB_GETCURSEL, 0, 0), 0);

-					if (new_hash_algo_id != 0 && new_hash_algo_id != DEFAULT_HASH_ALGORITHM_BOOT)
+					if (new_hash_algo_id != 0 && !HashForSystemEncryption(new_hash_algo_id))
 					{
 						int new_hash_algo_id = DEFAULT_HASH_ALGORITHM_BOOT;
 						Info ("ALGO_NOT_SUPPORTED_FOR_SYS_ENCRYPTION");
@@ -4404,7 +4404,7 @@ static void Benchmark (HWND hwndDlg)
 }


-static BOOL CheckMountList ()
+static BOOL CheckMountList (BOOL bForceTaskBarUpdate)
 {
 	MOUNT_LIST_STRUCT current;
 	static BootEncryptionStatus newBootEncStatus;
@@ -4413,7 +4413,7 @@ static BOOL CheckMountList ()

 	GetMountList (&current);

-	if ((current.ulMountedDrives != lastUlMountedDrives || bUseDifferentTrayIconIfVolMounted != lastbUseDifferentTrayIconIfVolMounted)
+	if ((bForceTaskBarUpdate || current.ulMountedDrives != lastUlMountedDrives || bUseDifferentTrayIconIfVolMounted != lastbUseDifferentTrayIconIfVolMounted)
 		&& TaskBarIconMutex != NULL)
 	{
 		lastUlMountedDrives = current.ulMountedDrives;
@@ -4422,6 +4422,11 @@ static BOOL CheckMountList ()
 		TaskBarIconChange (MainDlg, current.ulMountedDrives != 0 && bUseDifferentTrayIconIfVolMounted ? IDI_TRUECRYPT_MOUNTED_ICON : IDI_TRUECRYPT_ICON);
 	}

+	if (bForceTaskBarUpdate)
+	{
+		return TRUE;
+	}
+
 	if (LastKnownLogicalDrives != GetLogicalDrives()
 		|| memcmp (&LastKnownMountList, &current, sizeof (current)) != 0)
 	{
@@ -4910,7 +4915,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 			Silent = FALSE;

 			GetMountList (&LastKnownMountList);
-			SetTimer (hwndDlg, TIMER_ID_MAIN, TIMER_INTERVAL_MAIN, NULL);
+			SetTimer (hwndDlg, TIMER_ID_MAIN, TIMER_INTERVAL_MAIN, NULL);			

 			taskBarCreatedMsg = RegisterWindowMessage ("TaskbarCreated");

@@ -5065,7 +5070,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 	case WM_TIMER:
 		{
 			// Check mount list and update GUI if needed
-			CheckMountList ();
+			CheckMountList (FALSE);

 			// Cache status
 			if (IsPasswordCacheEmpty() == IsWindowEnabled (GetDlgItem (hwndDlg, IDC_WIPE_CACHE)))
@@ -5340,7 +5345,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 					}
 					else if (sel >= TRAYICON_MENU_DRIVE_OFFSET + 26 && sel < TRAYICON_MENU_DRIVE_OFFSET + 26*2)
 					{
-						if (CheckMountList ())
+						if (CheckMountList (FALSE))
 						{
 							if (Dismount (hwndDlg, sel - TRAYICON_MENU_DRIVE_OFFSET - 26))
 							{
@@ -5524,7 +5529,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 							KeyFilesApply (&mountOptions.ProtectedHidVolPassword, hidVolProtKeyFilesParam.FirstKeyFile);
 					}

-					if (CheckMountList ())
+					if (CheckMountList (FALSE))
 						Mount (hwndDlg, 0, 0);
 				}
 				return 1;
@@ -5620,7 +5625,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 						break;

 					case IDM_UNMOUNT_VOLUME:
-						if (CheckMountList ())
+						if (CheckMountList (FALSE))
 							Dismount (hwndDlg, 0);
 						break;

@@ -5651,7 +5656,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 							mountOptions = defaultMountOptions;
 							bPrebootPasswordDlgMode = FALSE;

-							if (CheckMountList ())
+							if (CheckMountList (FALSE))
 								Mount (hwndDlg, 0, 0);
 						}
 						break;
@@ -5708,7 +5713,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 				return 1;
 			}

-			if (CheckMountList ())
+			if (CheckMountList (FALSE))
 				Dismount (hwndDlg, 0);
 			return 1;
 		}
@@ -5794,7 +5799,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 				mountOptions.PartitionInInactiveSysEncScope = TRUE;
 				bPrebootPasswordDlgMode = TRUE;

-				if (CheckMountList ())
+				if (CheckMountList (FALSE))
 					Mount (hwndDlg, 0, 0);

 				bPrebootPasswordDlgMode = FALSE;
@@ -6509,6 +6514,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 		{
 			TaskBarIconRemove (hwndDlg);
 			TaskBarIconAdd (hwndDlg);
+			CheckMountList(TRUE);
 			return 1;
 		}
 	}
@@ -8529,7 +8535,7 @@ void MountSelectedVolume (HWND hwndDlg, BOOL mountWithOptions)
 				KeyFilesApply (&mountOptions.ProtectedHidVolPassword, hidVolProtKeyFilesParam.FirstKeyFile);
 		}

-		if (CheckMountList ())
+		if (CheckMountList (FALSE))
 			Mount (hwndDlg, 0, 0);
 	}
 	else
@@ -85,7 +85,7 @@ static BOOL Dismount (HWND hwndDlg, int nDosDriveNo);
 static BOOL DismountAll (HWND hwndDlg, BOOL forceUnmount, BOOL interact, int dismountMaxRetries, int dismountAutoRetryDelay);
 static void KeyfileDefaultsDlg (HWND hwndDlg);
 static void HandleHotKey (HWND hwndDlg, WPARAM wParam);
-static BOOL CheckMountList ();
+static BOOL CheckMountList (BOOL bForceTaskBarUpdate);
 int GetCipherBlockSizeByDriveNo (int nDosDriveNo);
 int GetModeOfOperationByDriveNo (int nDosDriveNo);
 void ChangeMainWindowVisibility ();
@@ -423,8 +423,8 @@ END
 //

 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,0,4,0
- PRODUCTVERSION 1,0,4,0
+ FILEVERSION 1,0,5,0
+ PRODUCTVERSION 1,0,5,0
 FILEFLAGSMASK 0x17L
 #ifdef _DEBUG
 FILEFLAGS 0x1L
@@ -441,11 +441,11 @@ BEGIN
        BEGIN
            VALUE "CompanyName", "IDRIX"
            VALUE "FileDescription", "VeraCrypt"
-            VALUE "FileVersion", "1.0d"
+            VALUE "FileVersion", "1.0e"
            VALUE "LegalTrademarks", "VeraCrypt"
            VALUE "OriginalFilename", "VeraCrypt.exe"
            VALUE "ProductName", "VeraCrypt"
-            VALUE "ProductVersion", "1.0d"
+            VALUE "ProductVersion", "1.0e"
        END
    END
    BLOCK "VarFileInfo"
@@ -25,6 +25,7 @@ I. Windows
 II. Linux and Mac OS X
 	Requirements for Building VeraCrypt for Linux and Mac OS X
 	Instructions for Building VeraCrypt for Linux and Mac OS X
+	Mac OS X specifics
 	
 III. FreeBSD and OpenSolaris

@@ -122,14 +123,14 @@ Requirements for Building VeraCrypt for Linux and Mac OS X:
 - Apple Xcode (Mac OS X only)
 - NASM assembler 2.08 or compatible (x86/x64 architecture only)
 - pkg-config
- wxWidgets 2.8 shared library and header files installed or
-  wxWidgets 2.8 library source code (available at http://www.wxwidgets.org)
+- wxWidgets 3.0 shared library and header files installed or
+  wxWidgets 3.0 library source code (available at http://www.wxwidgets.org)
 - FUSE library and header files (available at http://fuse.sourceforge.net
-  and http://code.google.com/p/macfuse)
+  and https://osxfuse.github.io/)
 - RSA Security Inc. PKCS #11 Cryptographic Token Interface (Cryptoki) 2.20
-  header files (available at ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20)
-  located in a standard include path or in a directory defined by the
-  environment variable 'PKCS11_INC'.
+  header files (available at ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20).
+  They are already included in the source tree under the directory PKCS11 but 
+  it is possible to override it using the environment variable 'PKCS11_INC'. 


 Instructions for Building VeraCrypt for Linux and Mac OS X:
@@ -141,7 +142,7 @@ Instructions for Building VeraCrypt for Linux and Mac OS X:
   command to configure the wxWidgets static library for VeraCrypt and to
   build it: 

-   $ make WX_ROOT=/usr/src/wxWidgets wxbuild
+   $ make WXSTATIC=1 WX_ROOT=/usr/src/wxWidgets wxbuild

   The variable WX_ROOT must point to the location of the source code of the
   wxWidgets library. Output files will be placed in the './wxrelease/'
@@ -162,16 +163,36 @@ By default, a universal executable supporting both graphical and text user
 interface is built. To build a console-only executable, which requires no GUI
 library, use the 'NOGUI' parameter:

-   $ make NOGUI=1 WX_ROOT=/usr/src/wxWidgets wxbuild
+   $ make NOGUI=1 WXSTATIC=1 WX_ROOT=/usr/src/wxWidgets wxbuild
   $ make NOGUI=1 WXSTATIC=1
+   
+
+Mac OS X specifics:
+-----------------------------------------------------------
+   
+Under MacOSX, the SDK for OSX 10.7 is used by default. To use another version
+of the SDK (e.i. 10.6), you can export the environment variable VC_OSX_TARGET :
+	
+	$ export VC_OSX_TARGET=10.6
+
+
+Before building under MacOSX, pkg-config must be installed if not yet available.
+Get it from http://pkgconfig.freedesktop.org/releases/pkg-config-0.28.tar.gz and
+compile using the following commands : 
+
+	$ ./configure --with-internal-glib
+	$ make
+	$ sudo make install
+
+After making sure pkg-config is available, download and install OSXFuse from
+https://osxfuse.github.io/ (MacFUSE compatibility layer must selected)



 III. FreeBSD and OpenSolaris
 ============================

-Support status for FreeBSD: http://www.truecrypt.org/misc/freebsd
-Support status for OpenSolaris: http://www.truecrypt.org/misc/opensolaris
+FreeBSD and OpenSolaris are not yet supported.



@@ -493,7 +493,7 @@
 				<key>OVERWRITE_PERMISSIONS</key>
 				<false/>
 				<key>VERSION</key>
-				<string>1.0d</string>
+				<string>1.0e</string>
 			</dict>
 			<key>UUID</key>
 			<string>B14381D9-EC5F-43E4-B971-82AB3D132A64</string>
@@ -513,7 +513,7 @@
 			ZW50LVN0eWxlLVR5cGUiIGNvbnRlbnQ9InRleHQvY3NzIj4KPHRp
 			dGxlPjwvdGl0bGU+CjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29u
 			dGVudD0iQ29jb2EgSFRNTCBXcml0ZXIiPgo8bWV0YSBuYW1lPSJD
-			b2NvYVZlcnNpb24iIGNvbnRlbnQ9IjEyNjUuMjEiPgo8c3R5bGUg
+			b2NvYVZlcnNpb24iIGNvbnRlbnQ9IjExMzguNTEiPgo8c3R5bGUg
 			dHlwZT0idGV4dC9jc3MiPgo8L3N0eWxlPgo8L2hlYWQ+Cjxib2R5
 			Pgo8L2JvZHk+CjwvaHRtbD4K
 			</data>
@@ -1049,7 +1049,7 @@ Merci de ré-installer OSXFUSE et de cocher l'option de compatibilité MacFUSE d
 				</dict>
 			</array>
 			<key>NAME</key>
-			<string>VeraCrypt 1.0d</string>
+			<string>VeraCrypt 1.0e</string>
 		</dict>
 	</dict>
 	<key>SHARED_GLOBAL_DATA</key>
@@ -60,6 +60,7 @@ BOOL bDowngrade = FALSE;
 BOOL SystemEncryptionUpdate = FALSE;
 BOOL PortableMode = FALSE;
 BOOL bRepairMode = FALSE;
+BOOL bReinstallMode = FALSE;
 BOOL bChangeMode = FALSE;
 BOOL bDevm = FALSE;
 BOOL bPossiblyFirstTimeInstall = FALSE;
@@ -245,8 +246,9 @@ void DetermineUpgradeDowngradeStatus (BOOL bCloseDriverHandle, LONG *driverVersi
 			bResult = DeviceIoControl (hDriver, TC_IOCTL_LEGACY_GET_DRIVER_VERSION, NULL, 0, &driverVersion, sizeof (driverVersion), &dwResult, NULL);


-		bUpgrade = (bResult && driverVersion < VERSION_NUM);
+		bUpgrade = (bResult && driverVersion <= VERSION_NUM);
 		bDowngrade = (bResult && driverVersion > VERSION_NUM);
+		bReinstallMode = (bResult && driverVersion == VERSION_NUM);

 		PortableMode = DeviceIoControl (hDriver, TC_IOCTL_GET_PORTABLE_MODE_STATUS, NULL, 0, NULL, 0, &dwResult, NULL);

@@ -1073,7 +1075,8 @@ BOOL UpgradeBootLoader (HWND hwndDlg)
 	try
 	{
 		BootEncryption bootEnc (hwndDlg);
-		if (bootEnc.GetInstalledBootLoaderVersion() < VERSION_NUM)
+		uint64 bootLoaderVersion = bootEnc.GetInstalledBootLoaderVersion();
+		if ((bootLoaderVersion < VERSION_NUM) || (bReinstallMode && (bootLoaderVersion == VERSION_NUM)))
 		{
 			StatusMessage (hwndDlg, "INSTALLER_UPDATING_BOOT_LOADER");

@@ -26,7 +26,44 @@ static char *szFiles[]=
 	"Averacrypt.sys",
 	"Averacrypt-x64.sys",
 	"Dveracrypt.sys",
-	"AVeraCrypt Setup.exe"
+	"AVeraCrypt Setup.exe",
+	"ALanguage.ar.xml",
+	"ALanguage.be.xml",
+	"ALanguage.bg.xml",
+	"ALanguage.ca.xml",
+	"ALanguage.cs.xml",
+	"ALanguage.da.xml",
+	"ALanguage.de.xml",
+	"ALanguage.el.xml",
+	"ALanguage.es.xml",
+	"ALanguage.et.xml",
+	"ALanguage.eu.xml",
+	"ALanguage.fa.xml",
+	"ALanguage.fi.xml",
+	"ALanguage.fr.xml",
+	"ALanguage.hu.xml",
+	"ALanguage.id.xml",
+	"ALanguage.it.xml",
+	"ALanguage.ja.xml",
+	"ALanguage.ka.xml",
+	"ALanguage.ko.xml",
+	"ALanguage.lv.xml",
+	"ALanguage.my.xml",
+	"ALanguage.nl.xml",
+	"ALanguage.nn.xml",
+	"ALanguage.pl.xml",
+	"ALanguage.pt-br.xml",
+	"ALanguage.ru.xml",
+	"ALanguage.sk.xml",
+	"ALanguage.sl.xml",
+	"ALanguage.sv.xml",
+	"ALanguage.tr.xml",
+	"ALanguage.uk.xml",
+	"ALanguage.uz.xml",
+	"ALanguage.vi.xml",
+	"ALanguage.zh-cn.xml",
+	"ALanguage.zh-hk.xml",
+	"ALanguage.zh-tw.xml"
 };

 // Specifies what files are included in self-extracting packages (no other files will be packaged or extracted).
@@ -37,7 +74,44 @@ static char *szCompressedFiles[]=
 	"VeraCrypt.exe",
 	"VeraCrypt Format.exe",
 	"veracrypt.sys",
-	"veracrypt-x64.sys"
+	"veracrypt-x64.sys",
+	"Language.ar.xml",
+	"Language.be.xml",
+	"Language.bg.xml",
+	"Language.ca.xml",
+	"Language.cs.xml",
+	"Language.da.xml",
+	"Language.de.xml",
+	"Language.el.xml",
+	"Language.es.xml",
+	"Language.et.xml",
+	"Language.eu.xml",
+	"Language.fa.xml",
+	"Language.fi.xml",
+	"Language.fr.xml",
+	"Language.hu.xml",
+	"Language.id.xml",
+	"Language.it.xml",
+	"Language.ja.xml",
+	"Language.ka.xml",
+	"Language.ko.xml",
+	"Language.lv.xml",
+	"Language.my.xml",
+	"Language.nl.xml",
+	"Language.nn.xml",
+	"Language.pl.xml",
+	"Language.pt-br.xml",
+	"Language.ru.xml",
+	"Language.sk.xml",
+	"Language.sl.xml",
+	"Language.sv.xml",
+	"Language.tr.xml",
+	"Language.uk.xml",
+	"Language.uz.xml",
+	"Language.vi.xml",
+	"Language.zh-cn.xml",
+	"Language.zh-hk.xml",
+	"Language.zh-tw.xml"
 };

 #define FILENAME_64BIT_DRIVER	"veracrypt-x64.sys"
@@ -80,6 +154,7 @@ extern BOOL Rollback;
 extern BOOL bUpgrade;
 extern BOOL bPossiblyFirstTimeInstall;
 extern BOOL bRepairMode;
+extern BOOL bReinstallMode;
 extern BOOL bSystemRestore;
 extern BOOL bDisableSwapFiles;
 extern BOOL bForAllUsers;
@@ -28,8 +28,8 @@ LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
 //

 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,0,4,0
- PRODUCTVERSION 1,0,4,0
+ FILEVERSION 1,0,5,0
+ PRODUCTVERSION 1,0,5,0
 FILEFLAGSMASK 0x17L
 #ifdef _DEBUG
 FILEFLAGS 0x1L
@@ -46,11 +46,11 @@ BEGIN
        BEGIN
            VALUE "CompanyName", "IDRIX"
            VALUE "FileDescription", "VeraCrypt Setup"
-            VALUE "FileVersion", "1.0d"
+            VALUE "FileVersion", "1.0e"
            VALUE "LegalTrademarks", "VeraCrypt"
            VALUE "OriginalFilename", "VeraCrypt Setup.exe"
            VALUE "ProductName", "VeraCrypt"
-            VALUE "ProductVersion", "1.0d"
+            VALUE "ProductVersion", "1.0e"
        END
    END
    BLOCK "VarFileInfo"
@@ -271,7 +271,7 @@ BOOL CALLBACK PageDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa

 				DetermineUpgradeDowngradeStatus (TRUE, &driverVersion);

-				if (bRepairMode)
+				if (bRepairMode || bReinstallMode)
 				{
 					SetWindowTextW (GetDlgItem (hwndDlg, IDC_WIZARD_MODE_INSTALL), GetString ("REPAIR_REINSTALL"));
 					bExtractOnly = FALSE;
@@ -1,17 +1,21 @@
 PATH=%PATH%;%DDK%\bin\x86

-signtool sign /v /a /ac thawte_Primary_MS_Cross_Cert.cer /t http://timestamp.verisign.com/scripts/timestamp.dll "..\Release\Setup Files\veracrypt.sys"
-signtool sign /v /a /ac thawte_Primary_MS_Cross_Cert.cer /t http://timestamp.verisign.com/scripts/timestamp.dll "..\Release\Setup Files\veracrypt-x64.sys"
+signtool sign /v /a /n IDRIX /ac thawte_Primary_MS_Cross_Cert.cer /t http://timestamp.verisign.com/scripts/timestamp.dll "..\Release\Setup Files\veracrypt.sys"
+signtool sign /v /a /n IDRIX /ac thawte_Primary_MS_Cross_Cert.cer /t http://timestamp.verisign.com/scripts/timestamp.dll "..\Release\Setup Files\veracrypt-x64.sys"

-signtool sign /v /a /ac Thawt_CodeSigning_CA.crt /t http://timestamp.verisign.com/scripts/timestamp.dll "..\Release\Setup Files\VeraCrypt.exe"
-signtool sign /v /a /ac Thawt_CodeSigning_CA.crt /t http://timestamp.verisign.com/scripts/timestamp.dll "..\Release\Setup Files\VeraCrypt Format.exe"
+signtool sign /v /a /n IDRIX /ac Thawt_CodeSigning_CA.crt /t http://timestamp.verisign.com/scripts/timestamp.dll "..\Release\Setup Files\VeraCrypt.exe"
+signtool sign /v /a /n IDRIX /ac Thawt_CodeSigning_CA.crt /t http://timestamp.verisign.com/scripts/timestamp.dll "..\Release\Setup Files\VeraCrypt Format.exe"

 cd "..\Release\Setup Files\"

+copy /V /Y ..\..\..\Translations\*.xml .
+
 "VeraCrypt Setup.exe" /p

+del *.xml
+
 cd "..\..\Signing"

-signtool sign /v /a /ac Thawt_CodeSigning_CA.crt /t http://timestamp.verisign.com/scripts/timestamp.dll "..\Release\Setup Files\VeraCrypt Setup 1.0d.exe"
+signtool sign /v /a /n IDRIX /ac Thawt_CodeSigning_CA.crt /t http://timestamp.verisign.com/scripts/timestamp.dll "..\Release\Setup Files\VeraCrypt Setup 1.0e.exe"

 pause
@@ -211,7 +211,7 @@ namespace VeraCrypt

 	void CipherSerpent::SetCipherKey (const byte *key)
 	{
-		serpent_set_key (key, static_cast<int> (GetKeySize ()), ScheduledKey);
+		serpent_set_key (key, ScheduledKey);
 	}


@@ -233,7 +233,7 @@ namespace VeraCrypt

 	void CipherTwofish::SetCipherKey (const byte *key)
 	{
-		twofish_set_key ((TwofishInstance *) ScheduledKey.Ptr(), (unsigned int *) key, static_cast<int> (GetKeySize ()) * 8);
+		twofish_set_key ((TwofishInstance *) ScheduledKey.Ptr(), (unsigned int *) key);
 	}


@@ -792,17 +792,17 @@ namespace VeraCrypt
 		Buffer derivedKey (4);

 		Pkcs5HmacRipemd160 pkcs5HmacRipemd160;
-		pkcs5HmacRipemd160.DeriveKey (derivedKey, password, salt, 5, FALSE);
+		pkcs5HmacRipemd160.DeriveKey (derivedKey, password, salt, 5);
 		if (memcmp (derivedKey.Ptr(), "\x7a\x3d\x7c\x03", 4) != 0)
 			throw TestFailed (SRC_POS);

 		Pkcs5HmacSha512 pkcs5HmacSha512;
-		pkcs5HmacSha512.DeriveKey (derivedKey, password, salt, 5, FALSE);
+		pkcs5HmacSha512.DeriveKey (derivedKey, password, salt, 5);
 		if (memcmp (derivedKey.Ptr(), "\x13\x64\xae\xf8", 4) != 0)
 			throw TestFailed (SRC_POS);

 		Pkcs5HmacWhirlpool pkcs5HmacWhirlpool;
-		pkcs5HmacWhirlpool.DeriveKey (derivedKey, password, salt, 5, FALSE);
+		pkcs5HmacWhirlpool.DeriveKey (derivedKey, password, salt, 5);
 		if (memcmp (derivedKey.Ptr(), "\x50\x7c\x36\x6f", 4) != 0)
 			throw TestFailed (SRC_POS);
 	}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Mounir IDRASSI	de93034485	MacOSX: add shell script to perform build under MacOSX	2014-11-08 23:24:57 +01:00
Mounir IDRASSI	f1a596109b	Linux/MacOSX: solve compilation warning by explicitly converting wxCStrData to (const wchar_t*)	2014-11-08 23:24:54 +01:00
Mounir IDRASSI	2c6e9fc15c	Replace deprecated wxTextValidator::SetBellOnError whose logic whose inverted by the new wxTextValidator::SuppressBellOnError. Since its used in constructor only for TC_WINDOWS, we do the same in the destructor.	2014-11-08 23:24:51 +01:00
Mounir IDRASSI	ce7fab744b	MacOSX: fix warning by displacing declaration of variable used only under Linux	2014-11-08 23:24:49 +01:00
Mounir IDRASSI	65e4b3a91b	Remove unused functions from GfMul.c	2014-11-08 23:24:46 +01:00
Mounir IDRASSI	2cdfbd2703	Linux/MacOSX: Remove static size values from GUI in order to let wxWidgets calculate the best size (the "Fit" method ensure this). Fix truncation of text is some dialogs.	2014-11-08 23:24:44 +01:00
Mounir IDRASSI	81b9e28993	Linux: Add shell script to perform VeraCrypt full build	2014-11-08 23:24:41 +01:00
Mounir IDRASSI	d7498fae01	Linux/MacOSX: add newline at the end of Pkcs5.c to remove gcc warning	2014-11-08 23:24:38 +01:00
Mounir IDRASSI	3c471383d9	Linux/MacOSX: adapt code to the changes in PRF functions prototypes	2014-11-08 23:24:36 +01:00
Mounir IDRASSI	0a09314336	Correct typo in language XML file.	2014-11-08 23:24:33 +01:00
Mounir IDRASSI	b0bb124772	Bootloader: reduce the size of Serpent implementation when used as the single cipher. We need this because to save space for the new features to come.	2014-11-08 23:24:30 +01:00
Mounir IDRASSI	f7d8e565b4	Windows Driver Sanity check: check that the password length passed from the bootloader is less than or equal to 64 before using it.	2014-11-08 23:24:27 +01:00
Mounir IDRASSI	3f2e20e339	Simplify code handling iterations count: in boot mode, we'll set the correct iterations count inside derive_u_sha256 and derive_u_ripemd160 depending in the value of the iterations parameter. On normal mode, we use normal values of iterations count. Removes the special test parameter from RIPEMD160 functions.	2014-11-08 23:24:25 +01:00
Mounir IDRASSI	714a2ce0ae	Bootloader: in function ReadVolumeHeader, arrays dk and masterKey have the same size and they are never needed at the same time. So, we can minimize stack memory usage by using only one array instead of two. At the end of the function, the array is erased securely.	2014-11-08 23:24:22 +01:00
Mounir IDRASSI	c1378f781a	Bootloader: optimize code size in single cipher mode by manually inlining EAInit, EAGetFirst and EAGetKeySize, and by removing the loop in ReadVolumeHeader that tests for encryption algorithms.	2014-11-08 23:24:19 +01:00
Mounir IDRASSI	c61f8c70de	Bootloader code optimization: remove code in HMAC implementation in case of boot compilation that is never called since passwords are always less than 64-byte length. We leave it in Windows compilation because it is used to check the implementation against test vectors.	2014-11-08 23:24:17 +01:00
Mounir IDRASSI	e1a0826ef5	Linux: remove workaround for wxFileType::GetOpenCommand bug in handling path with spaces because it was fixed in wxWidgets 3.0 and this workaround causes problems.	2014-11-08 23:24:14 +01:00
Mounir IDRASSI	9c1ddff7e3	Linux: Support NTFS formatting of volume. We use mkfs.ntfs so it needs to be installed on the system.	2014-11-08 23:24:11 +01:00
Mounir IDRASSI	ea03100d9e	Linux/MacOSX : fix encryption/decryption issues with hard drives that have a sector size bigger than 512. Now, we use the sector size as the minimum unit for data fragment encryption/decryption.	2014-11-08 23:24:09 +01:00
Mounir IDRASSI	067394d110	MacOSX : Support hard drives with a large sector size ( > 512).	2014-11-08 23:24:06 +01:00
Mounir IDRASSI	f05f6a00a6	Integrate SHA-256 support into Linux/MacOSX code. Set PRF priority to SHA-512 -> Whirlpool -> SHA-256 -> RIPEMD-160 .	2014-11-08 23:24:03 +01:00
Mounir IDRASSI	905a3ff4a5	Small code size optimization for RIPEMD-160 when compiled for boot encryption.	2014-11-08 23:24:01 +01:00
Mounir IDRASSI	922a09b634	Use HashForSystemEncryption to check if the algorithm is supported for system partition encryption because we have now two supported algorithms.	2014-11-08 23:23:58 +01:00
Mounir IDRASSI	f043e6cbf0	Display only allowed hashes when encrypting the system partition (now, SHA-256 and RIPEMD-160).	2014-11-08 23:23:56 +01:00
Mounir IDRASSI	68f16dae24	Implement support for creating and booting encrypted partition using SHA-256. Support SHA-256 for normal volumes as well.	2014-11-08 23:23:53 +01:00
Mounir IDRASSI	f38cf0b694	Add support for SHA-256 in key derivation for bootloader encryption. Create separate bootloader images for SHA-256 and RIPEMD-160. Set SHA-256 as the default PRF for boot encryption and SHA-512 as default PRF for all other cases. Depricate RIPEMD-160.	2014-11-08 23:23:50 +01:00
Mounir IDRASSI	bd7d151abf	Add SHA-256 source specific for upcoming bootloader build because of its small size. It was derived from the libtomcrypt public domain source.	2014-11-08 23:23:48 +01:00
Mounir IDRASSI	2fe23a3fa3	Correctly support reinstalling the same version. Overwrite the bootloader if the same version detected.	2014-11-08 23:23:45 +01:00
Mounir IDRASSI	effb5c7c1e	Windows vulnerability fix : finally make bootloader decompressor more robust and secure by adding multiple checks and validation code. This solves the issue found by the Open Crypt Audit project. Note that we had to switch to the slow implementation of the function decode in order to keep the size of the decompressor code under 2K.	2014-11-08 23:23:42 +01:00
Mounir IDRASSI	50ca9fe46f	Optimization to reduce code size of derive_u_ripemd160. Useful for boatloader.	2014-11-08 23:23:40 +01:00
Mounir IDRASSI	0178a6d33f	Optimize code space and solve the Serpent issue (https://sourceforge.net/p/veracrypt/discussion/technical/thread/fb09633a/#6406 ) by removing key length parameter from serpent_set_key and twofish_set_key	2014-11-08 23:23:37 +01:00
Mounir IDRASSI	411e8599f3	Call RegCloseKey only if handle is valid.	2014-11-08 23:23:34 +01:00
Mounir IDRASSI	b80ee2b7b9	Windows : display the correct tray icon when explorer is restarted (i.e. after an explorer crash).	2014-11-08 23:23:31 +01:00
Mounir IDRASSI	8a028aca45	Use absolute path in ShellExecute call that was missed when the security fix for Microsoft Security Advisory 2269637 was implemented.	2014-11-08 23:23:28 +01:00
Mounir IDRASSI	fb12b635ed	Update Readme.txt to include more accurate build instructions for Linux and MacOSX	2014-11-08 23:23:25 +01:00
Mounir IDRASSI	d761e95133	MacOSX : increment MacOSX installer version to 1.0e	2014-11-08 23:23:22 +01:00
Mounir IDRASSI	f7d783dda8	Adapt certain functions in the case of Windows bootloader in order to make its size as small as possible.	2014-11-08 23:23:19 +01:00
Mounir IDRASSI	ccbc2cff0b	Increment version to 1.0e for the next release	2014-11-08 23:23:17 +01:00
Mounir IDRASSI	809394d383	Include language xml files in the setup	2014-11-08 23:23:13 +01:00
Mounir IDRASSI	7c501359b3	Windows vulnerability fix: correct some integer overflow issues using the IntSafe library. Detected by the Open Crypto Audit project	2014-11-08 23:23:10 +01:00
Mounir IDRASSI	f82e16f0a1	Windows vulnerability fix: correct checking device name to avoid possible bypass attack detected by the Open Crypto Audit project	2014-11-08 23:23:08 +01:00
Mounir IDRASSI	4fa4d6d227	Windows vulnerability fix: correct possible BSOD attack targeted towards GetWipePassCount() / WipeBuffer() found by the Open Crypto Audit Project.	2014-11-08 23:23:05 +01:00
Mounir IDRASSI	e0efb36f33	Revert previous modification on boad-loader decompressor because it increased its size and it became impossible to include it with the SERPENT version of bootloader. The decompressor and the compressed bootloader are copied twice (original and backup) in the 63 first sectors of the hard drive (32K), thus the size limitation. This reverts commit 154235d589222e3c31cda05aa53e73ab69a89a6e.	2014-11-08 23:23:02 +01:00
Mounir IDRASSI	ef4355acf8	Windows vulnerability fix : make boot-loader decompressor more robust and secure by adding multiple checks and validation code. Note that we had to switch to the slow implementation of the function decode in order to keep the size of the decompressor code under 2K.	2014-11-08 23:22:59 +01:00
Mounir IDRASSI	5fcb262539	Windows vulnerability fix : clear sensitive data in Windows kernel driver by using burjn instead of memset	2014-11-08 23:22:57 +01:00
Mounir IDRASSI	d6aa653648	Windows vulnerability fix : avoid kernel pointer disclosure through a call to TC_IOCTL_GET_SYSTEM_DRIVE_DUMP_CONFIG but restricting this call to Kernel Mode.	2014-11-08 23:22:54 +01:00
Mounir IDRASSI	6de2c143b9	Windows : Specify "IDRIX" in signtool for the subject of the code signing certificate.	2014-11-08 23:22:51 +01:00
Mounir IDRASSI	9083f95db0	Remove driver version test that is non application to VeraCrypt and that was wrongly inherited from TrueCrypt.	2014-11-08 23:22:49 +01:00
Mounir IDRASSI	03cf7cc566	Correctly handle dialogs from previous versions that used 'TRUE' instead of 'VERA' as a value for GWLP_USERDATA.	2014-11-08 23:22:46 +01:00
Mounir IDRASSI	f158df394e	Windows : correct bug in construction of Format.exe path that prevented the new volume wizard to launch.	2014-11-08 23:22:43 +01:00