Tidy and document structures, document more fields from Consent/AppInfo

src/Lithnet.CredentialProvider/ConsentUI/ConsentUIData.cs

@@ -34,14 +34,25 @@ namespace Lithnet.CredentialProvider
         /// <summary>
         /// Gets a value indicating the consent prompt type
         /// </summary>
-        public int PromptType => this.header.PromptType;
+        public ConsentUIPromptType PromptType => this.header.PromptType;
 
         /// <summary>
         /// Gets a handle to the Window that was responsible for invoking the ConsentUI prompt
         /// </summary>
-        public IntPtr HWnd => this.header.hWnd;
+        public IntPtr HWnd => this.header.hWindow;
 
-        public ElevationType ElevationType => this.header.elevationType;
+        /// <summary>
+        /// Gets the method that ConsentUI has been told to fetch approval.
+        /// In the case where a Credential Provider is initialised, this should always be `Credentials`.
+        /// </summary>
+        public ConsentUIElevationType ElevationType => this.header.ElevationType;
+
+        /// <summary>
+        /// A series of flags that AppInfo passes to ConsentUI to signifiy actions that need to
+        /// take place on the UI side.
+        /// This includes specifics around the UI that should be presented & signature verification settings.
+        /// </summary>
+        public ConsentUIFlags Flags => this.header.Flags;
 
         /// <summary>
         /// Gets the ID of the session where the ConsentUI prompt was originally invoked

src/Lithnet.CredentialProvider/ConsentUI/ConsentUIDataExe.cs

@@ -9,6 +9,9 @@ namespace Lithnet.CredentialProvider
     /// </summary>
     public class ConsentUIDataExe : ConsentUIData
     {
+        /// <summary>
+        /// A file handle pointing to the EXE in question
+        /// </summary>
         private IntPtr hFile;
 
         /// <summary>

src/Lithnet.CredentialProvider/ConsentUI/ConsentUIDataMsi.cs

@@ -9,6 +9,11 @@ namespace Lithnet.CredentialProvider
     /// </summary>
     public class ConsentUIDataMsi : ConsentUIData
     {
+        /// <summary>
+        /// The action being performed, such as Install, Uninstall or Repair
+        /// </summary>
+        public ConsentUIMsiAction Action { get; set; }
+
         /// <summary>
         /// The name of the product being installed
         /// </summary>
@@ -39,16 +44,6 @@ namespace Lithnet.CredentialProvider
         /// </summary>
         public string OriginalMsi { get; }
 
-        /// <summary>
-        /// A currently unknown parameter
-        /// </summary>
-        public string Unknown1 { get; }
-
-        /// <summary>
-        /// A currently unknown parameter
-        /// </summary>
-        public string Unknown2 { get; }
-
         internal ConsentUIDataMsi(IntPtr pData, int expectedSize) : base(pData, expectedSize)
         {
             if (this.header.Type != ConsentUIType.Msi)
@@ -58,14 +53,13 @@ namespace Lithnet.CredentialProvider
 
             var s = Marshal.PtrToStructure<ConsentUIStructureMsi>(pData);
 
+            this.Action = s.MsiAction;
             this.ProductName = this.GetStringValueIfValid(pData, (int)s.oProductName);
             this.Version = this.GetStringValueIfValid(pData, (int)s.oVersion);
             this.Locale = this.GetStringValueIfValid(pData, (int)s.oLocale);
             this.Publisher = this.GetStringValueIfValid(pData, (int)s.oPublisher);
             this.ExecutionPath = this.GetStringValueIfValid(pData, (int)s.oExecutionPath);
             this.OriginalMsi = this.GetStringValueIfValid(pData, (int)s.oOriginalMsi);
-            this.Unknown1 = this.GetStringValueIfValid(pData, (int)s.oUnknown1);
-            this.Unknown2 = this.GetStringValueIfValid(pData, (int)s.oUnknown2);
         }
     }
 }

src/Lithnet.CredentialProvider/Enums/ConsentUIElevationType.cs

@@ -0,0 +1,24 @@
+namespace Lithnet.CredentialProvider
+{
+    public enum ConsentUIElevationType
+    {
+        Unknown = 0,
+
+        /// <summary>
+        /// Automatic Admin Mode.
+        /// This seems to be an instance where UAC creates a local, secondary
+        /// account called '%username%_admin' which is used to elevate a process.
+        /// </summary>
+        AutomaticAdmin = 1,
+
+        /// <summary>
+        /// Prompt the user for consent (i.e. Yes or No)
+        /// </summary>
+        Consent = 2,
+
+        /// <summary>
+        /// Prompt the user for credentials
+        /// </summary>
+        Credentials = 3
+    }
+}

src/Lithnet.CredentialProvider/Enums/ConsentUIFlags.cs

@@ -0,0 +1,71 @@
+using System;
+
+namespace Lithnet.CredentialProvider
+{
+    [Flags]
+    public enum ConsentUIFlags
+    {
+        SkipSignatureVerification = 0x01,
+
+        /// <summary>
+        /// Indicates to ConsentUI that it needs to switch to the Secure Desktop
+        /// </summary>
+        SecureDesktop = 0x02,
+
+        Unknown1 = 0x04,
+        Unknown2 = 0x08,
+        Unknown3 = 0x10,
+
+        /// <summary>
+        /// This flag seems to cause ConsentUI to 
+        /// skip all signature verification related code.
+        /// </summary>
+        SkipVerification = 0x20,
+
+        /// <summary>
+        /// Indicates that the executable file is contained within a Windows directory.
+        /// As all the executables in System32, etc. are unsigned, ConsentUI
+        /// uses this to toggle catalog verification, if required.
+        /// </summary>
+        InWindowsDirectory = 0x40,
+
+        /// <summary>
+        /// Seems to indicates to ConsentUI that automatic elevation should occur,
+        /// and that the executable is in a safe Windows location
+        /// </summary>
+        AutoElevationWindows = 0x80,
+
+        /// <summary>
+        /// Like `AutoElevationWindows`, this seems indicates to ConsentUI that
+        /// automatic elevation should occur, but that further verification
+        /// inside ConsentUI should occur.
+        /// </summary>
+        AutoElevationOther = 0x100,
+
+        Unknown4 = 0x200,
+
+        /// <summary>
+        /// ConsentUI uses this flag to determine if it should pass
+        /// SIF_BASE_VERIFICATION | SIF_AUTHENTICODE_SIGNED to WTGetSignatureInfo
+        /// </summary>
+        PerformBaseVerification = 0x400,
+
+        /// <summary>
+        /// Indicates that the publisher is untrusted - this is what seems to trigger
+        /// an AMSI scan (i.e., SmartScreen)
+        /// </summary>
+        UntrustedPublisher = 0x800,
+
+        /// <summary>
+        /// This flag seems to cause ConsentUI to skip all elevation-related code and exit.
+        /// </summary>
+        BlockElevation = 0x1000,
+
+        /// <summary>
+        /// Corresponds to `ConsentUIElevationType.AutomaticAdmin`
+        /// This seems to be an instance where UAC creates a local, secondary
+        /// account called '%username%_admin' which is used to elevate a process.
+        /// </summary>
+        AutomaticAdminMode = 0x2000
+    }
+}

src/Lithnet.CredentialProvider/Enums/ConsentUIMsiAction.cs

@@ -0,0 +1,11 @@
+using System;
+
+namespace Lithnet.CredentialProvider
+{
+    public enum ConsentUIMsiAction : uint
+    {
+        Install = 0,
+        Uninstall = 1,
+        Update = 2
+    }
+}

src/Lithnet.CredentialProvider/Enums/ConsentUIPromptType.cs

@@ -1,9 +1,9 @@
 namespace Lithnet.CredentialProvider
 {
-    public enum ElevationType
+    public enum ConsentUIPromptType
     {
-        Unknown1 = 0,
+        Unknown = 0,
-        Unknown2 = 1,
+        AutomaticAdmin = 1,
         Consent = 2,
         Credentials = 3
     }

src/Lithnet.CredentialProvider/Interop/Structs/ConsentUIStructureHeader.cs

@@ -8,24 +8,24 @@ namespace Lithnet.CredentialProvider.Interop
     {
         public int Size; // 4
         public ConsentUIType Type; // 4
-        public int PromptType; // 4
+        public ConsentUIPromptType PromptType; // 4
         // padding on x64 - 4
 
         // 16 
 
-        public IntPtr hWnd; // 8
+        public IntPtr hWindow; // 8
         public IntPtr hToken; // 8
 
         // 32
 
-        public ElevationType elevationType; // 4
+        public ConsentUIElevationType ElevationType; // 4
         public int sessionId; // 4
         public IntPtr hMutex; // 8
 
         // 48+
 
-        public int unknownFlags1; // 4
+        public ConsentUIFlags Flags; // 4
-        public int unknownFlags2; // 4 
+        public int unknown0; // 4 
         public IntPtr pReturnAddress; // 8
 
         // 64

src/Lithnet.CredentialProvider/Interop/Structs/ConsentUIStructureMsi.cs

@@ -10,7 +10,7 @@ namespace Lithnet.CredentialProvider.Interop
 
         // 64 
 
-        public IntPtr hUnknown1; // 8 
+        public ConsentUIMsiAction MsiAction; // 8 
         public IntPtr oProductName; // 8
 
         // 64 + 16 == 80