' ########################################################################################
' Microsoft Windows
' File: winsafer.inc
' Contents: This file implements the publicly exported functions, data types, data
' structures, and definitions usable by programs that directly interact with the Windows
' SAFER APIs.
' Copyright (c) 2011 Jos? Roca
' Portions Copyright (c) Microsoft Corporation.
' All Rights Reserved.
' THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
' EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
' MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
' ########################################################################################
#IF NOT %DEF(PBX_winsafer_PBI)
#DEFINE PBX_winsafer_PBI
%EQUATE `WINSAFER_INC = 1
#INCLUDE ONCE "Legacy/UI/Guiddef.inc"
#INCLUDE ONCE "Legacy/Platform/WinCrypt.inc"
'//
'// Opaque datatype for representing handles to Safer objects.
'//
'DECLARE_HANDLE(SAFER_LEVEL_HANDLE);
'//
'// Constants to represent scope with SaferCreateLevel and others.
'//
%EQUATE `SAFER_SCOPEID_MACHINE = 1
%EQUATE `SAFER_SCOPEID_USER = 2
'//
'// Pre-defined levels that can be used with SaferCreateLevel
'//
%EQUATE `SAFER_LEVELID_FULLYTRUSTED = &H40000
%EQUATE `SAFER_LEVELID_NORMALUSER = &H20000
%EQUATE `SAFER_LEVELID_CONSTRAINED = &H10000
%EQUATE `SAFER_LEVELID_UNTRUSTED = &H01000
%EQUATE `SAFER_LEVELID_DISALLOWED = &H00000
'//
'// Flags to use when creating/opening a Level with SaferCreateLevel
'//
%EQUATE `SAFER_LEVEL_OPEN = 1
'//
'// Maximum string size.
'//
%EQUATE `SAFER_MAX_FRIENDLYNAME_SIZE = 256
%EQUATE `SAFER_MAX_DESCRIPTION_SIZE = 256
%EQUATE `SAFER_MAX_HASH_SIZE = 64
'//
'// Flags to use with SaferComputeTokenFromLevel.
'//
%EQUATE `SAFER_TOKEN_NULL_IF_EQUAL = &H00000001
%EQUATE `SAFER_TOKEN_COMPARE_ONLY = &H00000002
%EQUATE `SAFER_TOKEN_MAKE_INERT = &H00000004
%EQUATE `SAFER_TOKEN_WANT_FLAGS = &H00000008
'//
'// Flags for specifying what criteria within SAFER_CODE_PROPERTIES to evaluate
'// when finding code identity with SaferIdentifyLevel.
'//
%EQUATE `SAFER_CRITERIA_IMAGEPATH = &H00001
%EQUATE `SAFER_CRITERIA_NOSIGNEDHASH = &H00002
%EQUATE `SAFER_CRITERIA_IMAGEHASH = &H00004
%EQUATE `SAFER_CRITERIA_AUTHENTICODE = &H00008
%EQUATE `SAFER_CRITERIA_URLZONE = &H00010
%EQUATE `SAFER_CRITERIA_IMAGEPATH_NT = &H01000
'//
'// Code image information structure passed to SaferIdentifyLevel.
'//
'#include <pshpack8.h>
' // Size = 112 bytes
TYPE SAFER_CODE_PROPERTIES ' Must be 8 byte aligned
 cbSize AS DWORD
 dwCheckFlags AS DWORD
 ImagePath AS WSTRINGZ PTR
 hImageFileHandle AS DWORD
 UrlZoneId AS DWORD
 ImageHash(%SAFER_MAX_HASH_SIZE - 1) AS BYTE ' BYTE[SAFER_MAX_HASH_SIZE]
 dwImageHashSize AS DWORD
 ImageSize AS QUAD ' LARGE_INTEGER
 HashAlgorithm AS DWORD ' ALG_ID
 pByteBlock AS BYTE PTR
 hWndParent AS DWORD
 dwWVTUIChoice AS DWORD
END TYPE
'#include <poppack.h>
'//
'// Masks for the per-identity WinSafer flags
'//
%EQUATE `SAFER_POLICY_JOBID_MASK = &HFF000000
%EQUATE `SAFER_POLICY_JOBID_CONSTRAINED = &H04000000
%EQUATE `SAFER_POLICY_JOBID_UNTRUSTED = &H03000000
%EQUATE `SAFER_POLICY_ONLY_EXES = &H00010000
%EQUATE `SAFER_POLICY_SANDBOX_INERT = &H00020000
%EQUATE `SAFER_POLICY_HASH_DUPLICATE = &H00040000
%EQUATE `SAFER_POLICY_ONLY_AUDIT = &H00001000
%EQUATE `SAFER_POLICY_BLOCK_CLIENT_UI = &H00002000
%EQUATE `SAFER_POLICY_UIFLAGS_MASK = &H000000FF
%EQUATE `SAFER_POLICY_UIFLAGS_INFORMATION_PROMPT = &H00000001
%EQUATE `SAFER_POLICY_UIFLAGS_OPTION_PROMPT = &H00000002
%EQUATE `SAFER_POLICY_UIFLAGS_HIDDEN = &H00000004
'//
'// Information classes on the overall policy that can be queried
'// with SaferSet/GetPolicyInformation and set at different
'// policy scopes based on access of the caller.
'//
' enum SAFER_POLICY_INFO_CLASS
'//
'// Accesses the list of all Levels defined in a policy.
'// The corresponding data element is a buffer that is filled
'// with multiple DWORDs, each representing the LevelIds that
'// are defined within this scope.
'//
%EQUATE `SaferPolicyLevelList = 1
'//
'// for transparent enforcement of policy in the execution
'// framework -- will be used by native code execution but can
'// be used by any policy enforcement environment.
'// Corresponding data element is a DWORD holding a Boolean value.
'//
%EQUATE `SaferPolicyEnableTransparentEnforcement = 2
'//
'// Returns the name of the Level that has been designed
'// as the default level within the specified scope.
'// The corresponding data element is a single DWORD buffer
'// representing the LevelId of the default Level. If no
'// level has been configured to be the default, then the
'// GetInfo API will return FALSE and GetLastError will
'// return ERROR_NOT_FOUND.
'//
%EQUATE `SaferPolicyDefaultLevel = 3
'//
'// Returns whether Code Identities or Default Level within the
'// user scope can be considered during identification.
'//
%EQUATE `SaferPolicyEvaluateUserScope = 4
'//
'// Control Flags for safer policy scope.
'//
%EQUATE `SaferPolicyScopeFlags = 5
'//
'// Flags which indicate "audit" or "block client UI" rules
'//
%EQUATE `SaferPolicyDefaultLevelFlags = 6
'//
'// Flag which indicates if certificate rules are applied in CreateProcess
'//
%EQUATE `SaferPolicyAuthenticodeEnabled = 7
'//
'// Enumerations used for retrieving specific information about a
'// single authorization Level via SaferGet/SetInformationFromLevel.
'//
' enum SAFER_OBJECT_INFO_CLASS
%EQUATE `SaferObjectLevelId = 1 ' // get: DWORD
%EQUATE `SaferObjectScopeId = 2 ' // get: DWORD
%EQUATE `SaferObjectFriendlyName = 3 ' // get/set: LPCWSTR
%EQUATE `SaferObjectDescription = 4 ' // get/set: LPCWSTR
%EQUATE `SaferObjectBuiltin = 5 ' // get: DWORD boolean
%EQUATE `SaferObjectDisallowed = 6 ' // get: DWORD boolean
%EQUATE `SaferObjectDisableMaxPrivilege = 7 ' // get: DWORD boolean
%EQUATE `SaferObjectInvertDeletedPrivileges = 8 ' // get: DWORD boolean
%EQUATE `SaferObjectDeletedPrivileges = 9 ' // get: TOKEN_PRIVILEGES
%EQUATE `SaferObjectDefaultOwner = 10 ' // get: TOKEN_OWNER
%EQUATE `SaferObjectSidsToDisable = 11 ' // get: TOKEN_GROUPS
%EQUATE `SaferObjectRestrictedSidsInverted = 12 ' // get: TOKEN_GROUPS
%EQUATE `SaferObjectRestrictedSidsAdded = 13 ' // get: TOKEN_GROUPS
'//
'// To enumerate all identities, call GetInfo with
'// SaferObjectAllIdentificationGuids.
'//
%EQUATE `SaferObjectAllIdentificationGuids = 14 ' // get: SAFER_IDENTIFICATION_GUIDS
'//
'// To create a new identity, call SetInfo with
'// SaferObjectSingleIdentification with a new
'// unique GUID that you have generated.
'// To get details on a single identity, call GetInfo with
'// SaferObjectSingleIdentification with desired GUID.
'// To modify details of a single identity, call SetInfo with
'// SaferObjectSingleIdentification with desired info and GUID.
'// To delete an identity, call SetInfo with
'// SaferObjectSingleIdentification with the
'// header.dwIdentificationType set to 0.
'//
%EQUATE `SaferObjectSingleIdentification = 15 ' // get/set: SAFER_IDENTIFICATION_*
%EQUATE `SaferObjectExtendedError = 16 ' // get: DWORD dwError
'//
'// Structures and enums used by the SaferGet/SetLevelInformation APIs.
'//
'#include <pshpack8.h>
' enum SAFER_IDENTIFICATION_TYPES
%EQUATE `SaferIdentityDefault = 0
%EQUATE `SaferIdentityTypeImageName = 1
%EQUATE `SaferIdentityTypeImageHash = 2
%EQUATE `SaferIdentityTypeUrlZone = 3
%EQUATE `SaferIdentityTypeCertificate = 4
' // Size = 32 bytes
TYPE SAFER_IDENTIFICATION_HEADER ' Must be 8 byte aligned
 dwIdentificationType AS LONG ' SAFER_IDENTIFICATION_TYPES
 cbStructSize AS DWORD
 IdentificationGuid AS GUID ' GUID
 lastModified AS FILETIME ' FILETIME
END TYPE
' // Size = 552 bytes
TYPE SAFER_PATHNAME_IDENTIFICATION ' Must be 8 byte aligned
 header AS SAFER_IDENTIFICATION_HEADER ' SAFER_IDENTIFICATION_HEADER
 Description AS WSTRINGZ * %SAFER_MAX_DESCRIPTION_SIZE ' WCHAR[SAFER_MAX_DESCRIPTION_SIZE]
 ImageName AS WSTRINGZ PTR
 dwSaferFlags AS DWORD
END TYPE
' // Size = 1144 bytes
TYPE SAFER_HASH_IDENTIFICATION ' Must be 8 byte aligned
 header AS SAFER_IDENTIFICATION_HEADER ' SAFER_IDENTIFICATION_HEADER
 Description AS WSTRINGZ * %SAFER_MAX_DESCRIPTION_SIZE ' WCHAR[SAFER_MAX_DESCRIPTION_SIZE]
 FriendlyName AS WSTRINGZ * %SAFER_MAX_FRIENDLYNAME_SIZE ' WCHAR[SAFER_MAX_FRIENDLYNAME_SIZE]
 HashSize AS DWORD
 ImageHash(%SAFER_MAX_HASH_SIZE - 1) AS BYTE ' BYTE[SAFER_MAX_HASH_SIZE]
 HashAlgorithm AS DWORD ' ALG_ID
 ImageSize AS QUAD ' LARGE_INTEGER
 dwSaferFlags AS DWORD
 alignment__ AS DWORD ' // To keep 8 byte alignment
END TYPE
' // Size = 1216 bytes
TYPE SAFER_HASH_IDENTIFICATION2 ' Must be 8 byte aligned
 hashIdentification AS SAFER_HASH_IDENTIFICATION ' SAFER_HASH_IDENTIFICATION
 HashSize AS DWORD
 ImageHash(%SAFER_MAX_HASH_SIZE - 1) AS BYTE ' BYTE[SAFER_MAX_HASH_SIZE]
 HashAlgorithm AS DWORD ' ALG_ID
END TYPE
' // Size = 40 bytes
TYPE SAFER_URLZONE_IDENTIFICATION ' Must be 8 byte aligned
 header AS SAFER_IDENTIFICATION_HEADER ' SAFER_IDENTIFICATION_HEADER
 UrlZoneId AS DWORD
 dwSaferFlags AS DWORD
END TYPE
'#include <poppack.h>
'//
'// Functions related to querying and setting the global policy
'// controls to disable transparent enforcement, and perform level
'// enumeration operations.
'//
DECLARE FUNCTION SaferGetPolicyInformation LIB "advapi32.dll" ALIAS "SaferGetPolicyInformation" ( BYVAL dwScopeId AS QUAD , BYVAL SaferPolicyInfoClass AS LONG , BYVAL InfoBufferSize AS QUAD , BYREF InfoBuffer AS ANY , BYREF InfoBufferRetSize AS QUAD , BYVAL lpReserved AS QUAD ) AS LONG
DECLARE FUNCTION SaferSetPolicyInformation LIB "advapi32.dll" ALIAS "SaferSetPolicyInformation" ( BYVAL dwScopeId AS QUAD
 , BYVAL SaferPolicyInfoClass AS LONG
 , BYVAL InfoBufferSize AS DWORD
 , BYREF InfoBuffer AS ANY
 , BYVAL lpReserved AS DWORD
 ) AS LONG
'//
'// Functions to open or close a handle to a Safer Level.
'//
DECLARE FUNCTION SaferCreateLevel LIB "advapi32.dll" ALIAS "SaferCreateLevel" ( BYVAL dwScopeId AS QUAD , BYVAL dwLevelId AS QUAD , BYVAL OpenFlags AS QUAD , BYREF pLevelHandle AS QUAD , BYVAL lpReserved AS QUAD ) AS LONG
DECLARE FUNCTION SaferCloseLevel LIB "advapi32.dll" ALIAS "SaferCloseLevel" ( BYVAL hLevelHandle AS QUAD
 ) AS LONG
DECLARE FUNCTION SaferIdentifyLevel LIB "advapi32.dll" ALIAS "SaferIdentifyLevel" ( BYVAL dwNumProperties AS DWORD
 , BYREF pCodeProperties AS SAFER_CODE_PROPERTIES
 , BYREF pLevelHandle AS DWORD
 , BYVAL lpReserved AS DWORD
 ) AS LONG
DECLARE FUNCTION SaferComputeTokenFromLevel LIB "advapi32.dll" ALIAS "SaferComputeTokenFromLevel" ( BYVAL LevelHandle AS DWORD
 , BYVAL InAccessToken AS DWORD
 , BYREF OutAccessToken AS DWORD
 , BYVAL dwFlags AS DWORD
 , BYVAL lpReserved AS DWORD
 ) AS LONG
DECLARE FUNCTION SaferGetLevelInformation LIB "advapi32.dll" ALIAS "SaferGetLevelInformation" ( BYVAL LevelHandle AS DWORD
 , BYVAL dwInfoType AS DWORD
 , BYREF lpQueryBuffer AS ANY
 , BYVAL dwInBufferSize AS DWORD
 , BYREF lpdwOutBufferSize AS DWORD
 ) AS LONG
DECLARE FUNCTION SaferSetLevelInformation LIB "advapi32.dll" ALIAS "SaferSetLevelInformation" ( BYVAL LevelHandle AS DWORD
 , BYVAL dwInfoType AS DWORD
 , BYREF lpQueryBuffer AS ANY
 , BYVAL DdwInBufferSize AS WORD
 ) AS LONG
'//
'// This function performs logging of messages to the Application
'// event log. This is called by the hooks within CreateProcess,
'// ShellExecute and cmd when a lower trust evaluation result occurs.
'//
DECLARE FUNCTION SaferRecordEventLogEntry LIB "advapi32.dll" ALIAS "SaferRecordEventLogEntry" ( BYVAL LevelHandle AS QUAD , BYREF szTargetPath AS WSTRINGZ , BYVAL lpReserved AS QUAD ) AS LONG
DECLARE FUNCTION SaferiIsExecutableFileType LIB "advapi32.dll" ALIAS "SaferiIsExecutableFileType" ( BYREF szFullPathname AS WSTRINGZ
 , BYVAL bFromShellExecute AS BYTE
 ) AS LONG
$$SRP_POLICY_EXE = "EXE"$$
$$SRP_POLICY_DLL = "DLL"$$
$$SRP_POLICY_MSI = "MSI"$$
$$SRP_POLICY_SCRIPT = "SCRIPT"$$
$$SRP_POLICY_SHELL = "SHELL"$$
$$SRP_POLICY_NOV2 = "IGNORESRPV2"$$
#ENDIF
