Static analysis: targeting, drive sweep and exclusions
Address: 0x1400766e0 (drive sweep), 0x140042c50 (classifier), 0x140041fc0 (share file)
Callers / callees: main → these; the folder parsers apply the exclusion sets
Purpose
Decide which roots get encrypted and which folders, files and processes are left alone.
Walkthrough
Root classification (FUN_140042c50), per root:
X:with a mounted local volume → local disk.X:reported asDRIVE_REMOTE, or a mapped share with no root dir (WNetGetConnectionW) → network disk.- A UNC path (
PathIsNetworkPathW) → network path. - Anything else → “Not allowed disk”, skipped.
-localonlydrops both network classes.
Drive sweep (FUN_1400766e0): uses GetLogicalDriveStringsW and GetDriveTypeW, and skips
CD-ROM and no-root-dir volumes. The loop is compiled with a fixed bound (cmp rsi, 0x2C),
so only the first five drive letters are
ever visited. A sixth or later volume, for example H: when C:–G: exist, is not encrypted in
sweep mode.
Share file (FUN_140041fc0): reads one UNC path or drive per line and replaces the
sweep. This path was read statically only; no live run used --share_file.
Key constants / structures
Exclusions are exact-match lookups in std::set containers built by static initializers
(FUN_1400018a0, FUN_140001ac0):
| Set | Address | Members |
|---|---|---|
| Folder names skipped | 0x1400f5e18 |
tmp, winnt, temp, thumb, $Recycle.Bin, $RECYCLE.BIN, System Volume Information, Boot, Windows, Trend Micro, ProgramData |
| Extensions skipped | 0x1400f5e08 |
.exe, .dll, .lnk, .sys, .msi, plus .akira and .arika added at runtime by FUN_14006ecf0 |
| Files skipped | – | akira_readme.txt; any file whose <name>.arika journal already exists |
| Protected processes | 0x1400f5e28 |
spoolsv.exe, fontdrvhost.exe, cmd.exe, explorer.exe, sihost.exe, SearchUI.exe, lsass.exe, dwm.exe, LogonUI.exe, winlogon.exe, services.exe, csrss.exe, smss.exe, System Idle Process, Secure System, conhost.exe, System, wininit.exe, Registry, Memory Compression |
| Force-Full extensions (153) | 0x1400f5e60 |
database extensions, see 04-encryption-modes.md |
| Force-Part extensions (20) | 0x1400f5e38 |
VM/disk-image extensions, see 04-encryption-modes.md |
Findings
- The five-drive limit is a real gap in coverage: hosts with many volumes keep the later ones intact.
- The
.arika-exists check stops a restarted run from double-encrypting a file.
Cross-references
- Related:
01-entry-point.md,04-encryption-modes.md