Release 2.20.

Breaks loading of all DOS executables.

patches/Compiler_Warnings/0001-ole32-Fix-compilation-with-recent-versions-of-gcc.patch

@@ -1,26 +0,0 @@
-From 43628d9b1905396ff6442e4f1e07c9dd48739b19 Mon Sep 17 00:00:00 2001
-From: Sebastian Lackner <sebastian@fds-team.de>
-Date: Fri, 14 Apr 2017 15:57:18 +0200
-Subject: ole32: Fix compilation with recent versions of gcc.
-
----
- dlls/ole32/storage32.h | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/dlls/ole32/storage32.h b/dlls/ole32/storage32.h
-index 4fcfd9c362..2b23ab8eb8 100644
---- a/dlls/ole32/storage32.h
-+++ b/dlls/ole32/storage32.h
-@@ -526,6 +526,9 @@ StgStreamImpl* StgStreamImpl_Construct(
- /******************************************************************************
-  * Endian conversion macros
-  */
-+#undef htole32
-+#undef htole16
-+
- #ifdef WORDS_BIGENDIAN
- 
- #define htole32(x) RtlUlongByteSwap(x)
--- 
-2.12.2
-

patches/Compiler_Warnings/0021-d2d1-Avoid-implicit-cast-of-interface-pointer.patch

@@ -1,18 +1,18 @@
-From 929eaf5dcdca040cd82141ad5ddfdcbc6c5f4a03 Mon Sep 17 00:00:00 2001
+From 79ff79dba6d5c8008c53e4bcf5e38c3a54271091 Mon Sep 17 00:00:00 2001
 From: Sebastian Lackner <sebastian@fds-team.de>
 Date: Tue, 22 Mar 2016 21:54:26 +0100
 Subject: d2d1: Avoid implicit cast of interface pointer.
 
 ---
- dlls/d2d1/brush.c    | 6 +++---
+ dlls/d2d1/brush.c    | 8 ++++----
  dlls/d2d1/geometry.c | 6 +++---
- 2 files changed, 6 insertions(+), 6 deletions(-)
+ 2 files changed, 7 insertions(+), 7 deletions(-)
 
 diff --git a/dlls/d2d1/brush.c b/dlls/d2d1/brush.c
-index aa92318..19b0993 100644
+index 7f4c7bbb763..30d25fec4b4 100644
 --- a/dlls/d2d1/brush.c
 +++ b/dlls/d2d1/brush.c
-@@ -181,7 +181,7 @@ static void d2d_brush_init(struct d2d_brush *brush, ID2D1Factory *factory,
+@@ -251,7 +251,7 @@ static void d2d_brush_init(struct d2d_brush *brush, ID2D1Factory *factory,
  
  static inline struct d2d_brush *impl_from_ID2D1SolidColorBrush(ID2D1SolidColorBrush *iface)
  {
@@ -21,7 +21,7 @@ index aa92318..19b0993 100644
  }
  
  static HRESULT STDMETHODCALLTYPE d2d_solid_color_brush_QueryInterface(ID2D1SolidColorBrush *iface,
-@@ -318,7 +318,7 @@ void d2d_solid_color_brush_init(struct d2d_brush *brush, ID2D1Factory *factory,
+@@ -394,7 +394,7 @@ HRESULT d2d_solid_color_brush_create(ID2D1Factory *factory, const D2D1_COLOR_F *
  
  static inline struct d2d_brush *impl_from_ID2D1LinearGradientBrush(ID2D1LinearGradientBrush *iface)
  {
@@ -30,7 +30,16 @@ index aa92318..19b0993 100644
  }
  
  static HRESULT STDMETHODCALLTYPE d2d_linear_gradient_brush_QueryInterface(ID2D1LinearGradientBrush *iface,
-@@ -476,7 +476,7 @@ void d2d_linear_gradient_brush_init(struct d2d_brush *brush, ID2D1Factory *facto
+@@ -580,7 +580,7 @@ HRESULT d2d_linear_gradient_brush_create(ID2D1Factory *factory, const D2D1_LINEA
+ 
+ static inline struct d2d_brush *impl_from_ID2D1RadialGradientBrush(ID2D1RadialGradientBrush *iface)
+ {
+-    return CONTAINING_RECORD(iface, struct d2d_brush, ID2D1Brush_iface);
++    return CONTAINING_RECORD((ID2D1Brush *)iface, struct d2d_brush, ID2D1Brush_iface);
+ }
+ 
+ static HRESULT STDMETHODCALLTYPE d2d_radial_gradient_brush_QueryInterface(ID2D1RadialGradientBrush *iface,
+@@ -776,7 +776,7 @@ HRESULT d2d_radial_gradient_brush_create(ID2D1Factory *factory, const D2D1_BRUSH
  
  static inline struct d2d_brush *impl_from_ID2D1BitmapBrush(ID2D1BitmapBrush *iface)
  {
@@ -40,10 +49,10 @@ index aa92318..19b0993 100644
  
  static HRESULT STDMETHODCALLTYPE d2d_bitmap_brush_QueryInterface(ID2D1BitmapBrush *iface,
 diff --git a/dlls/d2d1/geometry.c b/dlls/d2d1/geometry.c
-index 9fa1783..125c610 100644
+index a9588985642..b8457a9e1ea 100644
 --- a/dlls/d2d1/geometry.c
 +++ b/dlls/d2d1/geometry.c
-@@ -2022,7 +2022,7 @@ static const struct ID2D1GeometrySinkVtbl d2d_geometry_sink_vtbl =
+@@ -3024,7 +3024,7 @@ static const struct ID2D1GeometrySinkVtbl d2d_geometry_sink_vtbl =
  
  static inline struct d2d_geometry *impl_from_ID2D1PathGeometry(ID2D1PathGeometry *iface)
  {
@@ -52,7 +61,7 @@ index 9fa1783..125c610 100644
  }
  
  static HRESULT STDMETHODCALLTYPE d2d_path_geometry_QueryInterface(ID2D1PathGeometry *iface, REFIID iid, void **out)
-@@ -2283,7 +2283,7 @@ void d2d_path_geometry_init(struct d2d_geometry *geometry, ID2D1Factory *factory
+@@ -3540,7 +3540,7 @@ void d2d_path_geometry_init(struct d2d_geometry *geometry, ID2D1Factory *factory
  
  static inline struct d2d_geometry *impl_from_ID2D1RectangleGeometry(ID2D1RectangleGeometry *iface)
  {
@@ -61,7 +70,7 @@ index 9fa1783..125c610 100644
  }
  
  static HRESULT STDMETHODCALLTYPE d2d_rectangle_geometry_QueryInterface(ID2D1RectangleGeometry *iface,
-@@ -2531,7 +2531,7 @@ HRESULT d2d_rectangle_geometry_init(struct d2d_geometry *geometry, ID2D1Factory
+@@ -3876,7 +3876,7 @@ fail:
  
  static inline struct d2d_geometry *impl_from_ID2D1TransformedGeometry(ID2D1TransformedGeometry *iface)
  {
@@ -71,5 +80,5 @@ index 9fa1783..125c610 100644
  
  static HRESULT STDMETHODCALLTYPE d2d_transformed_geometry_QueryInterface(ID2D1TransformedGeometry *iface,
 -- 
-2.7.1
+2.14.1
 

patches/Compiler_Warnings/0033-evr-Avoid-implicit-cast-of-interface-pointer.patch

@@ -0,0 +1,25 @@
+From b4586e37df817f205c8bebe319b4765dea5c62d5 Mon Sep 17 00:00:00 2001
+From: Sebastian Lackner <sebastian@fds-team.de>
+Date: Sun, 24 Sep 2017 19:21:06 +0200
+Subject: evr: Avoid implicit cast of interface pointer.
+
+---
+ dlls/evr/evr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/dlls/evr/evr.c b/dlls/evr/evr.c
+index c2d2933211e..5533f38a649 100644
+--- a/dlls/evr/evr.c
++++ b/dlls/evr/evr.c
+@@ -136,7 +136,7 @@ static const IUnknownVtbl evr_inner_vtbl =
+ 
+ static inline evr_filter *impl_from_IBaseFilter(IBaseFilter *iface)
+ {
+-    return CONTAINING_RECORD(iface, evr_filter, filter);
++    return CONTAINING_RECORD(iface, evr_filter, filter.IBaseFilter_iface);
+ }
+ 
+ static HRESULT WINAPI filter_QueryInterface(IBaseFilter *iface, REFIID riid, void **ppv)
+-- 
+2.14.1
+

patches/advapi-LsaLookupPrivilegeName/0003-advapi32-Implement-LsaLookupPrivilegeName.patch

@@ -1,31 +1,17 @@
-From fcefc5661656de44d02fed0431b4a61fa618b663 Mon Sep 17 00:00:00 2001
+From ca415799729a5330fc9def2df8fb9c4ffef80448 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Sun, 5 Mar 2017 23:50:06 +0100
 Subject: advapi32: Implement LsaLookupPrivilegeName.
 
 ---
- dlls/advapi32/advapi32.spec   |  2 +-
  dlls/advapi32/advapi32_misc.h |  2 ++
- dlls/advapi32/lsa.c           | 39 +++++++++++++++++++++++++++++++++++++++
+ dlls/advapi32/lsa.c           | 30 ++++++++++++++++++++++++++++--
  dlls/advapi32/security.c      | 27 ++++++++++++++++++---------
  include/ntsecapi.h            |  1 +
- 5 files changed, 61 insertions(+), 10 deletions(-)
+ 4 files changed, 49 insertions(+), 11 deletions(-)
 
-diff --git a/dlls/advapi32/advapi32.spec b/dlls/advapi32/advapi32.spec
-index d5503490a0..709a385967 100644
---- a/dlls/advapi32/advapi32.spec
-+++ b/dlls/advapi32/advapi32.spec
-@@ -469,7 +469,7 @@
- @ stdcall LsaLookupNames(long long ptr ptr ptr)
- @ stdcall LsaLookupNames2(ptr long long ptr ptr ptr)
- @ stub LsaLookupPrivilegeDisplayName
--# @ stub LsaLookupPrivilegeName
-+@ stdcall LsaLookupPrivilegeName(long ptr ptr)
- # @ stub LsaLookupPrivilegeValue
- @ stdcall LsaLookupSids(ptr long ptr ptr ptr)
- # @ stub LsaLookupSids2
 diff --git a/dlls/advapi32/advapi32_misc.h b/dlls/advapi32/advapi32_misc.h
-index d116ecb836..ecb07f635a 100644
+index d116ecb836e..ecb07f635a6 100644
 --- a/dlls/advapi32/advapi32_misc.h
 +++ b/dlls/advapi32/advapi32_misc.h
 @@ -68,4 +68,6 @@ static inline WCHAR *strdupAW( const char *src )
@@ -36,28 +22,20 @@ index d116ecb836..ecb07f635a 100644
 +
  #endif /* __WINE_ADVAPI32MISC_H */
 diff --git a/dlls/advapi32/lsa.c b/dlls/advapi32/lsa.c
-index 3da6d19b82..af5f9dd46d 100644
+index 61c91f497eb..e6f88d2fa73 100644
 --- a/dlls/advapi32/lsa.c
 +++ b/dlls/advapi32/lsa.c
-@@ -973,3 +973,42 @@ NTSTATUS WINAPI LsaUnregisterPolicyChangeNotification(
-     FIXME("(%d,%p) stub\n", class, event);
-     return STATUS_SUCCESS;
- }
-+
-+/******************************************************************************
-+ * LsaLookupPrivilegeName [ADVAPI32.@]
-+ *
-+ */
-+NTSTATUS WINAPI LsaLookupPrivilegeName(
-+    LSA_HANDLE handle,
-+    PLUID lpLuid,
-+    PUNICODE_STRING *name)
-+{
+@@ -983,6 +983,32 @@ NTSTATUS WINAPI LsaLookupPrivilegeName(
+     LUID *luid,
+     UNICODE_STRING **name)
+ {
+-    FIXME("(%p,%p,%p) stub\n", handle, luid, name);
+-    return STATUS_NO_SUCH_PRIVILEGE;
 +    UNICODE_STRING *priv_unicode;
 +    size_t priv_size;
 +    WCHAR *strW;
 +
-+    TRACE("(%p, %p, %p)\n", handle, lpLuid, name);
++    TRACE("(%p, %p, %p)\n", handle, luid, name);
 +
 +    if (!handle)
 +        return STATUS_INVALID_HANDLE;
@@ -65,25 +43,25 @@ index 3da6d19b82..af5f9dd46d 100644
 +    if (!name)
 +        return STATUS_INVALID_PARAMETER;
 +
-+    if (lpLuid->HighPart ||
-+        (lpLuid->LowPart < SE_MIN_WELL_KNOWN_PRIVILEGE ||
-+         lpLuid->LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE ||
-+         !WellKnownPrivNames[lpLuid->LowPart]))
++    if (luid->HighPart ||
++        (luid->LowPart < SE_MIN_WELL_KNOWN_PRIVILEGE ||
++         luid->LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE ||
++         !WellKnownPrivNames[luid->LowPart]))
 +        return STATUS_NO_SUCH_PRIVILEGE;
 +
-+    priv_size = (strlenW(WellKnownPrivNames[lpLuid->LowPart]) + 1) * sizeof(WCHAR);
++    priv_size = (strlenW(WellKnownPrivNames[luid->LowPart]) + 1) * sizeof(WCHAR);
 +    priv_unicode = heap_alloc(sizeof(*priv_unicode) + priv_size);
 +    if (!priv_unicode) return STATUS_NO_MEMORY;
 +
 +    strW = (WCHAR *)(priv_unicode + 1);
-+    strcpyW(strW, WellKnownPrivNames[lpLuid->LowPart]);
++    strcpyW(strW, WellKnownPrivNames[luid->LowPart]);
 +    RtlInitUnicodeString(priv_unicode, strW);
 +
 +    *name = priv_unicode;
 +    return STATUS_SUCCESS;
-+}
+ }
 diff --git a/dlls/advapi32/security.c b/dlls/advapi32/security.c
-index e36792cff4..3bc8f48b19 100644
+index e36792cff4b..3bc8f48b19c 100644
 --- a/dlls/advapi32/security.c
 +++ b/dlls/advapi32/security.c
 @@ -1840,7 +1840,7 @@ static const WCHAR SE_IMPERSONATE_NAME_W[] =
@@ -147,7 +125,7 @@ index e36792cff4..3bc8f48b19 100644
      }
  }
 diff --git a/include/ntsecapi.h b/include/ntsecapi.h
-index 2bb3d312e4..0bf0eca43e 100644
+index 2bb3d312e43..0bf0eca43ed 100644
 --- a/include/ntsecapi.h
 +++ b/include/ntsecapi.h
 @@ -370,6 +370,7 @@ NTSTATUS WINAPI LsaLookupNames(LSA_HANDLE,ULONG,PLSA_UNICODE_STRING,PLSA_REFEREN
@@ -159,5 +137,5 @@ index 2bb3d312e4..0bf0eca43e 100644
  ULONG WINAPI LsaNtStatusToWinError(NTSTATUS);
  NTSTATUS WINAPI LsaOpenPolicy(PLSA_UNICODE_STRING,PLSA_OBJECT_ATTRIBUTES,ACCESS_MASK,PLSA_HANDLE);
 -- 
-2.13.1
+2.14.1
 

patches/advapi32-Token_Integrity_Level/0006-ntdll-Add-function-to-create-new-tokens-for-elevatio.patch

@@ -1,4 +1,4 @@
-From 0d98f9a1ea69511f6bb2901e71c72ac715bffd27 Mon Sep 17 00:00:00 2001
+From 6444094c9ef4f30a253bcee9e873ed511bda222c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Sat, 5 Aug 2017 01:45:29 +0200
 Subject: ntdll: Add function to create new tokens for elevation purposes.
@@ -13,12 +13,12 @@ Subject: ntdll: Add function to create new tokens for elevation purposes.
  6 files changed, 117 insertions(+)
 
 diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec
-index 30dfa60b1a0..69bfe923234 100644
+index c814f405017..eb84cc97bf8 100644
 --- a/dlls/ntdll/ntdll.spec
 +++ b/dlls/ntdll/ntdll.spec
-@@ -1480,6 +1480,9 @@
- @ cdecl wine_server_send_fd(long)
- @ cdecl __wine_make_process_system()
+@@ -1483,6 +1483,9 @@
+ # Virtual memory
+ @ cdecl __wine_locked_recvmsg(long ptr long)
  
 +# Token
 +@ cdecl __wine_create_default_token(long)
@@ -27,7 +27,7 @@ index 30dfa60b1a0..69bfe923234 100644
  @ cdecl wine_get_version() NTDLL_wine_get_version
  @ cdecl wine_get_patches() NTDLL_wine_get_patches
 diff --git a/dlls/ntdll/ntdll_misc.h b/dlls/ntdll/ntdll_misc.h
-index c97b1e1f73f..030704e1727 100644
+index 907bbdd2d95..a7810f716ad 100644
 --- a/dlls/ntdll/ntdll_misc.h
 +++ b/dlls/ntdll/ntdll_misc.h
 @@ -77,6 +77,9 @@ extern void virtual_init_threading(void) DECLSPEC_HIDDEN;
@@ -70,10 +70,10 @@ index f615ce2fea7..77048003ace 100644
  
  #define UNIMPLEMENTED_INFO_CLASS(c) \
 diff --git a/server/protocol.def b/server/protocol.def
-index b5b2650c8ed..9140feee717 100644
+index c8ab4bf8c36..59fe9aec7a8 100644
 --- a/server/protocol.def
 +++ b/server/protocol.def
-@@ -3615,6 +3615,14 @@ struct handle_info
+@@ -3628,6 +3628,14 @@ struct handle_info
  @END
  
  

patches/advapi32-Token_Integrity_Level/0008-ntdll-Implement-process-token-elevation-through-mani.patch

@@ -1,4 +1,4 @@
-From 7b7147df179554c5701f5d759a7b161d79ef90f3 Mon Sep 17 00:00:00 2001
+From e15be9d22652dbf7ef027ce5f3ef3faa42139c7a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Sat, 5 Aug 2017 03:39:55 +0200
 Subject: ntdll: Implement process token elevation through manifests.
@@ -12,13 +12,14 @@ Subject: ntdll: Implement process token elevation through manifests.
  5 files changed, 67 insertions(+)
 
 diff --git a/dlls/ntdll/loader.c b/dlls/ntdll/loader.c
-index a09eca9db75..2f6bcbde8fe 100644
+index cdf8d586c36..5162e2fc0ec 100644
 --- a/dlls/ntdll/loader.c
 +++ b/dlls/ntdll/loader.c
-@@ -3632,6 +3632,32 @@ static void load_global_options(void)
+@@ -3095,6 +3095,32 @@ static void load_global_options(void)
+ }
  
  
- /***********************************************************************
++/***********************************************************************
 + *           elevate_process
 + */
 +static void elevate_process( void )
@@ -44,11 +45,10 @@ index a09eca9db75..2f6bcbde8fe 100644
 +}
 +
 +
-+/***********************************************************************
+ /***********************************************************************
   *           start_process
   */
- static void start_process( void *arg )
-@@ -3679,6 +3705,7 @@ void WINAPI LdrInitializeThunk( void *kernel_start, ULONG_PTR unknown2,
+@@ -3111,6 +3137,7 @@ void WINAPI LdrInitializeThunk( void *kernel_start, ULONG_PTR unknown2,
                                  ULONG_PTR unknown3, ULONG_PTR unknown4 )
  {
      static const WCHAR globalflagW[] = {'G','l','o','b','a','l','F','l','a','g',0};
@@ -56,7 +56,7 @@ index a09eca9db75..2f6bcbde8fe 100644
      LARGE_INTEGER timeout;
      NTSTATUS status;
      WINE_MODREF *wm;
-@@ -3725,6 +3752,16 @@ void WINAPI LdrInitializeThunk( void *kernel_start, ULONG_PTR unknown2,
+@@ -3154,6 +3181,16 @@ void WINAPI LdrInitializeThunk( void *kernel_start, ULONG_PTR unknown2,
      if ((status = fixup_imports( wm, load_path )) != STATUS_SUCCESS) goto error;
      heap_set_debug_flags( GetProcessHeap() );
  
@@ -70,14 +70,14 @@ index a09eca9db75..2f6bcbde8fe 100644
 +        elevate_process();  /* FIXME: the process exists with a wrong token for a short time */
 +    }
 +
-     /* Store original entrypoint (in case it gets corrupted) */
-     start_params.kernel_start = kernel_start;
-     start_params.entry = wm->ldr.EntryPoint;
+     status = wine_call_on_stack( attach_process_dlls, wm, (char *)NtCurrentTeb()->Tib.StackBase - page_size );
+     if (status != STATUS_SUCCESS) goto error;
+ 
 diff --git a/server/process.c b/server/process.c
-index f0f60edcd3f..74675d343b4 100644
+index f8969433ede..10cf39d8962 100644
 --- a/server/process.c
 +++ b/server/process.c
-@@ -1146,6 +1146,14 @@ struct process_snapshot *process_snap( int *count )
+@@ -1136,6 +1136,14 @@ struct process_snapshot *process_snap( int *count )
      return snapshot;
  }
  
@@ -105,10 +105,10 @@ index 548796f9c22..262eb59627b 100644
  /* console functions */
  extern void inherit_console(struct thread *parent_thread, struct process *process, obj_handle_t hconin);
 diff --git a/server/protocol.def b/server/protocol.def
-index 300f23fb9b6..e5b598259f7 100644
+index 7590541ac8a..55cc768d21a 100644
 --- a/server/protocol.def
 +++ b/server/protocol.def
-@@ -3696,6 +3696,13 @@ struct handle_info
+@@ -3610,6 +3610,13 @@ struct handle_info
  @END
  
  
@@ -123,10 +123,10 @@ index 300f23fb9b6..e5b598259f7 100644
  @REQ(create_completion)
      unsigned int access;          /* desired access to a port */
 diff --git a/server/token.c b/server/token.c
-index c9d36a5b4f3..385ea3bbfda 100644
+index 7abd92386ea..49e84362a83 100644
 --- a/server/token.c
 +++ b/server/token.c
-@@ -1822,3 +1822,17 @@ DECL_HANDLER(create_token)
+@@ -1813,3 +1813,17 @@ DECL_HANDLER(create_token)
          release_object( token );
      }
  }
@@ -145,5 +145,5 @@ index c9d36a5b4f3..385ea3bbfda 100644
 +    }
 +}
 -- 
-2.13.1
+2.14.1
 

patches/advapi32-Token_Integrity_Level/0010-server-Implement-support-for-creating-processes-usin.patch

@@ -1,4 +1,4 @@
-From 9709db4e722195a70c5950b78b445c71eac495af Mon Sep 17 00:00:00 2001
+From 2993a76ec1711bb3ea1e889289f8d129f17ae2a3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Sun, 6 Aug 2017 02:08:05 +0200
 Subject: server: Implement support for creating processes using a token.
@@ -14,10 +14,10 @@ Subject: server: Implement support for creating processes using a token.
  7 files changed, 59 insertions(+), 21 deletions(-)
 
 diff --git a/dlls/kernel32/process.c b/dlls/kernel32/process.c
-index cacdcb3b621..3ae9d175a79 100644
+index c3dcd1349b3..69a026d5441 100644
 --- a/dlls/kernel32/process.c
 +++ b/dlls/kernel32/process.c
-@@ -2064,7 +2064,7 @@ static NTSTATUS create_struct_sd(PSECURITY_DESCRIPTOR nt_sd, struct security_des
+@@ -2051,7 +2051,7 @@ static NTSTATUS create_struct_sd(PSECURITY_DESCRIPTOR nt_sd, struct security_des
   * Create a new process. If hFile is a valid handle we have an exe
   * file, otherwise it is a Winelib app.
   */
@@ -26,7 +26,7 @@ index cacdcb3b621..3ae9d175a79 100644
                              LPCWSTR cur_dir, LPSECURITY_ATTRIBUTES psa, LPSECURITY_ATTRIBUTES tsa,
                              BOOL inherit, DWORD flags, LPSTARTUPINFOW startup,
                              LPPROCESS_INFORMATION info, LPCSTR unixdir,
-@@ -2210,6 +2210,7 @@ static BOOL create_process( HANDLE hFile, LPCWSTR filename, LPWSTR cmd_line, LPW
+@@ -2197,6 +2197,7 @@ static BOOL create_process( HANDLE hFile, LPCWSTR filename, LPWSTR cmd_line, LPW
          req->info_size      = startup_info_size;
          req->env_size       = (env_end - env) * sizeof(WCHAR);
          req->process_sd_size = process_sd_size;
@@ -34,7 +34,7 @@ index cacdcb3b621..3ae9d175a79 100644
  
          wine_server_add_data( req, startup_info, startup_info_size );
          wine_server_add_data( req, env, (env_end - env) * sizeof(WCHAR) );
-@@ -2310,7 +2311,7 @@ error:
+@@ -2297,7 +2298,7 @@ error:
   *
   * Create a new VDM process for a 16-bit or DOS application.
   */
@@ -43,7 +43,7 @@ index cacdcb3b621..3ae9d175a79 100644
                                  LPSECURITY_ATTRIBUTES psa, LPSECURITY_ATTRIBUTES tsa,
                                  BOOL inherit, DWORD flags, LPSTARTUPINFOW startup,
                                  LPPROCESS_INFORMATION info, LPCSTR unixdir,
-@@ -2334,7 +2335,7 @@ static BOOL create_vdm_process( LPCWSTR filename, LPWSTR cmd_line, LPWSTR env, L
+@@ -2321,7 +2322,7 @@ static BOOL create_vdm_process( LPCWSTR filename, LPWSTR cmd_line, LPWSTR env, L
          return FALSE;
      }
      sprintfW(new_cmd_line, argsW, winevdmW, buffer, cmd_line);
@@ -52,7 +52,7 @@ index cacdcb3b621..3ae9d175a79 100644
                            flags, startup, info, unixdir, binary_info, exec_only );
      HeapFree( GetProcessHeap(), 0, new_cmd_line );
      return ret;
-@@ -2346,7 +2347,7 @@ static BOOL create_vdm_process( LPCWSTR filename, LPWSTR cmd_line, LPWSTR env, L
+@@ -2333,7 +2334,7 @@ static BOOL create_vdm_process( LPCWSTR filename, LPWSTR cmd_line, LPWSTR env, L
   *
   * Create a new cmd shell process for a .BAT file.
   */
@@ -61,7 +61,7 @@ index cacdcb3b621..3ae9d175a79 100644
                                  LPSECURITY_ATTRIBUTES psa, LPSECURITY_ATTRIBUTES tsa,
                                  BOOL inherit, DWORD flags, LPSTARTUPINFOW startup,
                                  LPPROCESS_INFORMATION info )
-@@ -2371,8 +2372,8 @@ static BOOL create_cmd_process( LPCWSTR filename, LPWSTR cmd_line, LPVOID env, L
+@@ -2358,8 +2359,8 @@ static BOOL create_cmd_process( LPCWSTR filename, LPWSTR cmd_line, LPVOID env, L
      strcpyW( newcmdline, comspec );
      strcatW( newcmdline, slashcW );
      strcatW( newcmdline, cmd_line );
@@ -72,7 +72,7 @@ index cacdcb3b621..3ae9d175a79 100644
      HeapFree( GetProcessHeap(), 0, newcmdline );
      return ret;
  }
-@@ -2482,7 +2483,9 @@ BOOL WINAPI CreateProcessInternalW( HANDLE token, LPCWSTR app_name, LPWSTR cmd_l
+@@ -2469,7 +2470,9 @@ BOOL WINAPI CreateProcessInternalW( HANDLE token, LPCWSTR app_name, LPWSTR cmd_l
  
      TRACE("app %s cmdline %s\n", debugstr_w(app_name), debugstr_w(cmd_line) );
  
@@ -83,10 +83,10 @@ index cacdcb3b621..3ae9d175a79 100644
      if (new_token) FIXME("No support for returning created process token\n");
  
      if (!(tidy_cmdline = get_file_name( app_name, cmd_line, name, sizeof(name)/sizeof(WCHAR),
-@@ -2540,20 +2543,20 @@ BOOL WINAPI CreateProcessInternalW( HANDLE token, LPCWSTR app_name, LPWSTR cmd_l
+@@ -2527,20 +2530,20 @@ BOOL WINAPI CreateProcessInternalW( HANDLE token, LPCWSTR app_name, LPWSTR cmd_l
                 debugstr_w(name), (binary_info.flags & BINARY_FLAG_64BIT) ? 64 : 32,
-                binary_info.res_start, binary_info.res_end, binary_info.arch,
-                (binary_info.flags & BINARY_FLAG_FAKEDLL) ? ", fakedll" : "" );
+                wine_dbgstr_longlong(binary_info.res_start), wine_dbgstr_longlong(binary_info.res_end),
+                binary_info.arch, (binary_info.flags & BINARY_FLAG_FAKEDLL) ? ", fakedll" : "" );
 -        retv = create_process( hFile, name, tidy_cmdline, envW, cur_dir, process_attr, thread_attr,
 +        retv = create_process( token, hFile, name, tidy_cmdline, envW, cur_dir, process_attr, thread_attr,
                                 inherit, flags, startup_info, info, unixdir, &binary_info, FALSE );
@@ -107,7 +107,7 @@ index cacdcb3b621..3ae9d175a79 100644
                                 inherit, flags, startup_info, info, unixdir, &binary_info, FALSE );
          break;
      case BINARY_UNKNOWN:
-@@ -2565,7 +2568,7 @@ BOOL WINAPI CreateProcessInternalW( HANDLE token, LPCWSTR app_name, LPWSTR cmd_l
+@@ -2552,7 +2555,7 @@ BOOL WINAPI CreateProcessInternalW( HANDLE token, LPCWSTR app_name, LPWSTR cmd_l
                  TRACE( "starting %s as DOS binary\n", debugstr_w(name) );
                  binary_info.type = BINARY_DOS;
                  binary_info.arch = IMAGE_FILE_MACHINE_I386;
@@ -116,7 +116,7 @@ index cacdcb3b621..3ae9d175a79 100644
                                             inherit, flags, startup_info, info, unixdir,
                                             &binary_info, FALSE );
                  break;
-@@ -2573,7 +2576,7 @@ BOOL WINAPI CreateProcessInternalW( HANDLE token, LPCWSTR app_name, LPWSTR cmd_l
+@@ -2560,7 +2563,7 @@ BOOL WINAPI CreateProcessInternalW( HANDLE token, LPCWSTR app_name, LPWSTR cmd_l
              if (!strcmpiW( p, batW ) || !strcmpiW( p, cmdW ) )
              {
                  TRACE( "starting %s as batch binary\n", debugstr_w(name) );
@@ -125,10 +125,10 @@ index cacdcb3b621..3ae9d175a79 100644
                                             inherit, flags, startup_info, info );
                  break;
              }
-@@ -2692,12 +2695,12 @@ static void exec_process( LPCWSTR name )
-         TRACE( "starting %s as Win%d binary (%p-%p, arch %04x)\n",
+@@ -2680,12 +2683,12 @@ static void exec_process( LPCWSTR name )
                 debugstr_w(name), (binary_info.flags & BINARY_FLAG_64BIT) ? 64 : 32,
-                binary_info.res_start, binary_info.res_end, binary_info.arch );
+                wine_dbgstr_longlong(binary_info.res_start), wine_dbgstr_longlong(binary_info.res_end),
+                binary_info.arch );
 -        create_process( hFile, name, GetCommandLineW(), NULL, NULL, NULL, NULL,
 +        create_process( NULL, hFile, name, GetCommandLineW(), NULL, NULL, NULL, NULL,
                          FALSE, 0, &startup_info, &info, NULL, &binary_info, TRUE );
@@ -140,7 +140,7 @@ index cacdcb3b621..3ae9d175a79 100644
                          FALSE, 0, &startup_info, &info, NULL, &binary_info, TRUE );
          break;
      case BINARY_UNKNOWN:
-@@ -2711,7 +2714,7 @@ static void exec_process( LPCWSTR name )
+@@ -2699,7 +2702,7 @@ static void exec_process( LPCWSTR name )
      case BINARY_WIN16:
      case BINARY_DOS:
          TRACE( "starting %s as Win16/DOS binary\n", debugstr_w(name) );
@@ -150,10 +150,10 @@ index cacdcb3b621..3ae9d175a79 100644
          break;
      default:
 diff --git a/server/process.c b/server/process.c
-index 74675d343b4..ef2452fb8fb 100644
+index 81cea2f1baa..7d2206f2744 100644
 --- a/server/process.c
 +++ b/server/process.c
-@@ -501,7 +501,7 @@ static void start_sigkill_timer( struct process *process )
+@@ -496,7 +496,7 @@ static void start_sigkill_timer( struct process *process )
  
  /* create a new process and its main thread */
  /* if the function fails the fd is closed */
@@ -162,7 +162,7 @@ index 74675d343b4..ef2452fb8fb 100644
  {
      struct process *process;
      struct thread *thread = NULL;
-@@ -571,7 +571,7 @@ struct thread *create_process( int fd, struct thread *parent_thread, int inherit
+@@ -567,7 +567,7 @@ struct thread *create_process( int fd, struct thread *parent_thread, int inherit
                                         : alloc_handle_table( process, 0 );
          /* Note: for security reasons, starting a new process does not attempt
           * to use the current impersonation token for the new process */
@@ -171,7 +171,7 @@ index 74675d343b4..ef2452fb8fb 100644
          process->affinity = parent->affinity;
      }
      if (!process->handles || !process->token) goto error;
-@@ -1160,6 +1160,7 @@ DECL_HANDLER(new_process)
+@@ -1147,6 +1147,7 @@ DECL_HANDLER(new_process)
      struct startup_info *info;
      struct thread *thread;
      struct process *process;
@@ -179,7 +179,7 @@ index 74675d343b4..ef2452fb8fb 100644
      struct process *parent = current->process;
      int socket_fd = thread_get_inflight_fd( current, req->socket_fd );
      const struct security_descriptor *process_sd = NULL, *thread_sd = NULL;
-@@ -1195,9 +1196,27 @@ DECL_HANDLER(new_process)
+@@ -1182,9 +1183,27 @@ DECL_HANDLER(new_process)
          return;
      }
  
@@ -208,7 +208,7 @@ index 74675d343b4..ef2452fb8fb 100644
          return;
      }
  
-@@ -1205,6 +1224,7 @@ DECL_HANDLER(new_process)
+@@ -1192,6 +1211,7 @@ DECL_HANDLER(new_process)
      if (!(info = alloc_object( &startup_info_ops )))
      {
          close( socket_fd );
@@ -216,7 +216,7 @@ index 74675d343b4..ef2452fb8fb 100644
          return;
      }
      info->exe_file = NULL;
-@@ -1287,7 +1307,7 @@ DECL_HANDLER(new_process)
+@@ -1274,7 +1294,7 @@ DECL_HANDLER(new_process)
          }
      }
  
@@ -225,7 +225,7 @@ index 74675d343b4..ef2452fb8fb 100644
      process = thread->process;
      process->startup_info = (struct startup_info *)grab_object( info );
  
-@@ -1369,6 +1389,7 @@ DECL_HANDLER(new_process)
+@@ -1356,6 +1376,7 @@ DECL_HANDLER(new_process)
      }
  
   done:
@@ -234,10 +234,10 @@ index 74675d343b4..ef2452fb8fb 100644
  }
  
 diff --git a/server/process.h b/server/process.h
-index 262eb59627b..fcb45d8d676 100644
+index 78e88ec350a..313c36ab241 100644
 --- a/server/process.h
 +++ b/server/process.h
-@@ -115,7 +115,7 @@ struct process_snapshot
+@@ -114,7 +114,7 @@ struct process_snapshot
  extern unsigned int alloc_ptid( void *ptr );
  extern void free_ptid( unsigned int id );
  extern void *get_ptid_entry( unsigned int id );
@@ -247,10 +247,10 @@ index 262eb59627b..fcb45d8d676 100644
  extern struct thread *get_process_first_thread( struct process *process );
  extern struct process *get_process_from_id( process_id_t id );
 diff --git a/server/protocol.def b/server/protocol.def
-index e5b598259f7..7106cdb6f04 100644
+index 1ea129fec08..95513fef6c3 100644
 --- a/server/protocol.def
 +++ b/server/protocol.def
-@@ -767,6 +767,7 @@ struct rawinput_device
+@@ -739,6 +739,7 @@ struct rawinput_device
      data_size_t  info_size;      /* size of startup info */
      data_size_t  env_size;       /* size of the environment */
      data_size_t  process_sd_size;/* size of the process security descriptor */
@@ -259,10 +259,10 @@ index e5b598259f7..7106cdb6f04 100644
      VARARG(env,unicode_str,env_size);                       /* environment for new process */
      VARARG(process_sd,security_descriptor,process_sd_size); /* security descriptor to set on the process */
 diff --git a/server/request.c b/server/request.c
-index 83e608917f8..23760cdeb98 100644
+index 6120bc550ff..a648c306496 100644
 --- a/server/request.c
 +++ b/server/request.c
-@@ -571,7 +571,7 @@ static void master_socket_poll_event( struct fd *fd, int event )
+@@ -570,7 +570,7 @@ static void master_socket_poll_event( struct fd *fd, int event )
          int client = accept( get_unix_fd( master_socket->fd ), (struct sockaddr *) &dummy, &len );
          if (client == -1) return;
          fcntl( client, F_SETFL, O_NONBLOCK );
@@ -285,10 +285,10 @@ index 21e90ccf23f..32dfe5f8db9 100644
  static inline const ACE_HEADER *ace_next( const ACE_HEADER *ace )
  {
 diff --git a/server/token.c b/server/token.c
-index 385ea3bbfda..c507294b49d 100644
+index 49e84362a83..f6b6165d7a9 100644
 --- a/server/token.c
 +++ b/server/token.c
-@@ -851,6 +851,12 @@ int token_assign_label( struct token *token, PSID label )
+@@ -843,6 +843,12 @@ int token_assign_label( struct token *token, PSID label )
      return ret;
  }
  
@@ -301,7 +301,7 @@ index 385ea3bbfda..c507294b49d 100644
  struct token *token_create_admin( void )
  {
      struct token *token = NULL;
-@@ -1278,6 +1284,11 @@ const SID *token_get_primary_group( struct token *token )
+@@ -1269,6 +1275,11 @@ const SID *token_get_primary_group( struct token *token )
      return token->primary_group;
  }
  
@@ -314,5 +314,5 @@ index 385ea3bbfda..c507294b49d 100644
  {
      GENERIC_MAPPING mapping;
 -- 
-2.13.1
+2.14.2
 

patches/api-ms-win-Stub_DLLs/0001-kernelbase-Add-dll-and-add-stub-for-QuirkIsEnabled.patch

@@ -1,4 +1,4 @@
-From 959bc50b0ad246420e4f697e28371a3bb99f69f2 Mon Sep 17 00:00:00 2001
+From 634abe5fdb4fcd20f1675324f0adbe9d302c1d56 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Fri, 15 Jan 2016 13:01:15 +0100
 Subject: kernelbase: Add dll and add stub for QuirkIsEnabled.
@@ -10,7 +10,7 @@ Subject: kernelbase: Add dll and add stub for QuirkIsEnabled.
  3 files changed, 12 insertions(+), 2 deletions(-)
 
 diff --git a/dlls/api-ms-win-core-quirks-l1-1-0/api-ms-win-core-quirks-l1-1-0.spec b/dlls/api-ms-win-core-quirks-l1-1-0/api-ms-win-core-quirks-l1-1-0.spec
-index e8f77c73f3..1485512d0e 100644
+index e8f77c73f36..1485512d0ef 100644
 --- a/dlls/api-ms-win-core-quirks-l1-1-0/api-ms-win-core-quirks-l1-1-0.spec
 +++ b/dlls/api-ms-win-core-quirks-l1-1-0/api-ms-win-core-quirks-l1-1-0.spec
 @@ -1,6 +1,6 @@
@@ -22,7 +22,7 @@ index e8f77c73f3..1485512d0e 100644
  @ stdcall QuirkIsEnabled3(ptr ptr) kernelbase.QuirkIsEnabled3
  @ stub QuirkIsEnabledForPackage
 diff --git a/dlls/kernelbase/kernelbase.spec b/dlls/kernelbase/kernelbase.spec
-index 67003da332..9fba5803b2 100644
+index 75916a4851c..2f04a0a46f9 100644
 --- a/dlls/kernelbase/kernelbase.spec
 +++ b/dlls/kernelbase/kernelbase.spec
 @@ -1223,7 +1223,7 @@
@@ -35,7 +35,7 @@ index 67003da332..9fba5803b2 100644
  @ stdcall QuirkIsEnabled3(ptr ptr)
  # @ stub QuirkIsEnabledForPackage
 diff --git a/dlls/kernelbase/main.c b/dlls/kernelbase/main.c
-index 30cba3f6ca..6673f9b63e 100644
+index ff1b2f67623..f4d7cde8b7d 100644
 --- a/dlls/kernelbase/main.c
 +++ b/dlls/kernelbase/main.c
 @@ -1,4 +1,5 @@
@@ -44,10 +44,11 @@ index 30cba3f6ca..6673f9b63e 100644
   * Copyright 2017 Andrey Gusev
   *
   * This library is free software; you can redistribute it and/or
-@@ -21,6 +22,15 @@
- WINE_DEFAULT_DEBUG_CHANNEL(kernelbase);
+@@ -49,6 +50,15 @@ LONG WINAPI AppPolicyGetThreadInitializationType(HANDLE token, AppPolicyThreadIn
+     return ERROR_SUCCESS;
+ }
  
- /***********************************************************************
++/***********************************************************************
 + *           QuirkIsEnabled   (KERNELBASE.@)
 + */
 +BOOL WINAPI QuirkIsEnabled(void *arg)
@@ -56,10 +57,9 @@ index 30cba3f6ca..6673f9b63e 100644
 +    return FALSE;
 +}
 +
-+/***********************************************************************
+ /***********************************************************************
   *          QuirkIsEnabled3 (KERNELBASE.@)
   */
- BOOL WINAPI QuirkIsEnabled3(void *unk1, void *unk2)
 -- 
-2.11.0
+2.14.1
 

patches/api-ms-win-Stub_DLLs/0008-api-ms-win-shcore-obsolete-l1-1-0-Add-dll.patch

@@ -1,4 +1,4 @@
-From 49eb261c42d89a4c755914a40af797eb0b04d816 Mon Sep 17 00:00:00 2001
+From 44c826229e00ebefac0bca596746c1037c5c370b Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Sun, 17 Jan 2016 17:02:41 +0100
 Subject: api-ms-win-shcore-obsolete-l1-1-0: Add dll.
@@ -13,27 +13,27 @@ Subject: api-ms-win-shcore-obsolete-l1-1-0: Add dll.
  create mode 100644 dlls/api-ms-win-shcore-obsolete-l1-1-0/api-ms-win-shcore-obsolete-l1-1-0.spec
 
 diff --git a/configure.ac b/configure.ac
-index e8b9c2a..736c744 100644
+index cc1d5ba443c..78c163e5f35 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -2801,6 +2801,7 @@ WINE_CONFIG_DLL(api-ms-win-service-management-l2-1-0)
+@@ -2939,6 +2939,7 @@ WINE_CONFIG_DLL(api-ms-win-service-management-l2-1-0)
  WINE_CONFIG_DLL(api-ms-win-service-private-l1-1-1)
  WINE_CONFIG_DLL(api-ms-win-service-winsvc-l1-1-0)
  WINE_CONFIG_DLL(api-ms-win-service-winsvc-l1-2-0)
 +WINE_CONFIG_DLL(api-ms-win-shcore-obsolete-l1-1-0)
+ WINE_CONFIG_DLL(api-ms-win-shcore-scaling-l1-1-1)
  WINE_CONFIG_DLL(api-ms-win-shell-shellcom-l1-1-0)
  WINE_CONFIG_DLL(api-ms-win-shell-shellfolders-l1-1-0)
- WINE_CONFIG_DLL(apphelp)
 diff --git a/dlls/api-ms-win-shcore-obsolete-l1-1-0/Makefile.in b/dlls/api-ms-win-shcore-obsolete-l1-1-0/Makefile.in
 new file mode 100644
-index 0000000..6588d13
+index 00000000000..6588d13937e
 --- /dev/null
 +++ b/dlls/api-ms-win-shcore-obsolete-l1-1-0/Makefile.in
 @@ -0,0 +1 @@
 +MODULE    = api-ms-win-shcore-obsolete-l1-1-0.dll
 diff --git a/dlls/api-ms-win-shcore-obsolete-l1-1-0/api-ms-win-shcore-obsolete-l1-1-0.spec b/dlls/api-ms-win-shcore-obsolete-l1-1-0/api-ms-win-shcore-obsolete-l1-1-0.spec
 new file mode 100644
-index 0000000..edb8143
+index 00000000000..edb8143799d
 --- /dev/null
 +++ b/dlls/api-ms-win-shcore-obsolete-l1-1-0/api-ms-win-shcore-obsolete-l1-1-0.spec
 @@ -0,0 +1,3 @@
@@ -41,20 +41,20 @@ index 0000000..edb8143
 +@ stdcall SHStrDupA(str ptr) shcore.SHStrDupA
 +@ stdcall SHStrDupW(wstr ptr) shcore.SHStrDupW
 diff --git a/tools/make_specfiles b/tools/make_specfiles
-index 6fb6376..c19993d 100755
+index ec4b68c2cf1..00f70283d49 100755
 --- a/tools/make_specfiles
 +++ b/tools/make_specfiles
-@@ -270,6 +270,10 @@ my @dll_groups =
+@@ -330,6 +330,10 @@ my @dll_groups =
+   "shlwapi",
    "shcore",
   ],
-  [
++ [
 +  "shcore",
 +  "api-ms-win-shcore-obsolete-l1-1-0",
 + ],
-+ [
+  [
    "user32",
    "api-ms-win-core-stringansi-l1-1-0",
-   "api-ms-win-core-string-l2-1-0",
 -- 
-2.9.0
+2.14.2
 

patches/api-ms-win-Stub_DLLs/0010-ext-ms-win-appmodel-usercontext-l1-1-0-Add-dll-and-a.patch

@@ -1,4 +1,4 @@
-From 23e58d6cb2f258da259a1efce72fd2e1d58a530b Mon Sep 17 00:00:00 2001
+From 9b292e1bcfc18eecb70ac34fdd302d1274f68bb0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Sun, 17 Jan 2016 17:12:45 +0100
 Subject: ext-ms-win-appmodel-usercontext-l1-1-0: Add dll and add stub for
@@ -15,11 +15,11 @@ Subject: ext-ms-win-appmodel-usercontext-l1-1-0: Add dll and add stub for
  create mode 100644 dlls/ext-ms-win-appmodel-usercontext-l1-1-0/main.c
 
 diff --git a/configure.ac b/configure.ac
-index 1d1846dbb7..e9cf69d3fe 100644
+index cd6fe607f65..3e0f37d2753 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3045,6 +3045,7 @@ WINE_CONFIG_DLL(esent)
- WINE_CONFIG_DLL(evr)
+@@ -3126,6 +3126,7 @@ WINE_CONFIG_DLL(evr)
+ WINE_CONFIG_TEST(dlls/evr/tests)
  WINE_CONFIG_DLL(explorerframe,,[clean])
  WINE_CONFIG_TEST(dlls/explorerframe/tests)
 +WINE_CONFIG_DLL(ext-ms-win-appmodel-usercontext-l1-1-0)
@@ -28,7 +28,7 @@ index 1d1846dbb7..e9cf69d3fe 100644
  WINE_CONFIG_DLL(ext-ms-win-gdi-dc-create-l1-1-1)
 diff --git a/dlls/ext-ms-win-appmodel-usercontext-l1-1-0/Makefile.in b/dlls/ext-ms-win-appmodel-usercontext-l1-1-0/Makefile.in
 new file mode 100644
-index 0000000000..16eee7588f
+index 00000000000..16eee7588ff
 --- /dev/null
 +++ b/dlls/ext-ms-win-appmodel-usercontext-l1-1-0/Makefile.in
 @@ -0,0 +1,4 @@
@@ -38,7 +38,7 @@ index 0000000000..16eee7588f
 +	main.c
 diff --git a/dlls/ext-ms-win-appmodel-usercontext-l1-1-0/ext-ms-win-appmodel-usercontext-l1-1-0.spec b/dlls/ext-ms-win-appmodel-usercontext-l1-1-0/ext-ms-win-appmodel-usercontext-l1-1-0.spec
 new file mode 100644
-index 0000000000..7642d156c9
+index 00000000000..7642d156c94
 --- /dev/null
 +++ b/dlls/ext-ms-win-appmodel-usercontext-l1-1-0/ext-ms-win-appmodel-usercontext-l1-1-0.spec
 @@ -0,0 +1,3 @@
@@ -47,7 +47,7 @@ index 0000000000..7642d156c9
 +@ stub UserContextExtSetToken
 diff --git a/dlls/ext-ms-win-appmodel-usercontext-l1-1-0/main.c b/dlls/ext-ms-win-appmodel-usercontext-l1-1-0/main.c
 new file mode 100644
-index 0000000000..7a9e75f710
+index 00000000000..7a9e75f7109
 --- /dev/null
 +++ b/dlls/ext-ms-win-appmodel-usercontext-l1-1-0/main.c
 @@ -0,0 +1,35 @@
@@ -87,5 +87,5 @@ index 0000000000..7a9e75f710
 +    return S_OK;
 +}
 -- 
-2.12.2
+2.14.1
 

patches/api-ms-win-Stub_DLLs/0011-api-ms-win-shcore-thread-l1-1-0-Add-dll.patch

@@ -1,4 +1,4 @@
-From c0c54145e9b77cabfe520050f1a383659abd679f Mon Sep 17 00:00:00 2001
+From 19a4e40be4d9ef69c06b79185631f462f613c906 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Tue, 19 Jan 2016 16:19:11 +0100
 Subject: api-ms-win-shcore-thread-l1-1-0: Add dll
@@ -13,27 +13,27 @@ Subject: api-ms-win-shcore-thread-l1-1-0: Add dll
  create mode 100644 dlls/api-ms-win-shcore-thread-l1-1-0/api-ms-win-shcore-thread-l1-1-0.spec
 
 diff --git a/configure.ac b/configure.ac
-index 3847ab8..876b232 100644
+index 4f88873c57c..9efeb2fb02f 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -2797,6 +2797,7 @@ WINE_CONFIG_DLL(api-ms-win-service-management-l2-1-0)
- WINE_CONFIG_DLL(api-ms-win-service-winsvc-l1-1-0)
+@@ -2941,6 +2941,7 @@ WINE_CONFIG_DLL(api-ms-win-service-winsvc-l1-1-0)
  WINE_CONFIG_DLL(api-ms-win-service-winsvc-l1-2-0)
  WINE_CONFIG_DLL(api-ms-win-shcore-obsolete-l1-1-0)
+ WINE_CONFIG_DLL(api-ms-win-shcore-scaling-l1-1-1)
 +WINE_CONFIG_DLL(api-ms-win-shcore-thread-l1-1-0)
  WINE_CONFIG_DLL(api-ms-win-shell-shellcom-l1-1-0)
  WINE_CONFIG_DLL(api-ms-win-shell-shellfolders-l1-1-0)
  WINE_CONFIG_DLL(apphelp)
 diff --git a/dlls/api-ms-win-shcore-thread-l1-1-0/Makefile.in b/dlls/api-ms-win-shcore-thread-l1-1-0/Makefile.in
 new file mode 100644
-index 0000000..0a20ccf
+index 00000000000..0a20ccf206f
 --- /dev/null
 +++ b/dlls/api-ms-win-shcore-thread-l1-1-0/Makefile.in
 @@ -0,0 +1 @@
 +MODULE    = api-ms-win-shcore-thread-l1-1-0.dll
 diff --git a/dlls/api-ms-win-shcore-thread-l1-1-0/api-ms-win-shcore-thread-l1-1-0.spec b/dlls/api-ms-win-shcore-thread-l1-1-0/api-ms-win-shcore-thread-l1-1-0.spec
 new file mode 100644
-index 0000000..1533005
+index 00000000000..15330050ded
 --- /dev/null
 +++ b/dlls/api-ms-win-shcore-thread-l1-1-0/api-ms-win-shcore-thread-l1-1-0.spec
 @@ -0,0 +1,8 @@
@@ -46,10 +46,10 @@ index 0000000..1533005
 +@ stdcall SHSetThreadRef(ptr) shcore.SHSetThreadRef
 +@ stub SetProcessReference
 diff --git a/tools/make_specfiles b/tools/make_specfiles
-index e16a378..3fd4f36 100755
+index 00f70283d49..7abb3be32e6 100755
 --- a/tools/make_specfiles
 +++ b/tools/make_specfiles
-@@ -268,6 +268,7 @@ my @dll_groups =
+@@ -333,6 +333,7 @@ my @dll_groups =
   [
    "shcore",
    "api-ms-win-shcore-obsolete-l1-1-0",
@@ -58,5 +58,5 @@ index e16a378..3fd4f36 100755
   [
    "user32",
 -- 
-2.9.0
+2.14.2
 

patches/api-ms-win-Stub_DLLs/0014-api-ms-win-shcore-stream-l1-1-0-Add-dll.patch

@@ -1,4 +1,4 @@
-From dece0c4c7519885d8e6da604de5735f1ebed7769 Mon Sep 17 00:00:00 2001
+From 56a35eb70c12ef297d1030e7a13f9a5f5746d057 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Sat, 23 Jan 2016 20:56:53 +0100
 Subject: api-ms-win-shcore-stream-l1-1-0: Add dll
@@ -13,27 +13,27 @@ Subject: api-ms-win-shcore-stream-l1-1-0: Add dll
  create mode 100644 dlls/api-ms-win-shcore-stream-l1-1-0/api-ms-win-shcore-stream-l1-1-0.spec
 
 diff --git a/configure.ac b/configure.ac
-index d88aa46..f5d8f62 100644
+index 9efeb2fb02f..115becf5aaf 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -2798,6 +2798,7 @@ WINE_CONFIG_DLL(api-ms-win-service-management-l2-1-0)
- WINE_CONFIG_DLL(api-ms-win-service-winsvc-l1-1-0)
+@@ -2941,6 +2941,7 @@ WINE_CONFIG_DLL(api-ms-win-service-winsvc-l1-1-0)
  WINE_CONFIG_DLL(api-ms-win-service-winsvc-l1-2-0)
  WINE_CONFIG_DLL(api-ms-win-shcore-obsolete-l1-1-0)
+ WINE_CONFIG_DLL(api-ms-win-shcore-scaling-l1-1-1)
 +WINE_CONFIG_DLL(api-ms-win-shcore-stream-l1-1-0)
  WINE_CONFIG_DLL(api-ms-win-shcore-thread-l1-1-0)
  WINE_CONFIG_DLL(api-ms-win-shell-shellcom-l1-1-0)
  WINE_CONFIG_DLL(api-ms-win-shell-shellfolders-l1-1-0)
 diff --git a/dlls/api-ms-win-shcore-stream-l1-1-0/Makefile.in b/dlls/api-ms-win-shcore-stream-l1-1-0/Makefile.in
 new file mode 100644
-index 0000000..df2caad
+index 00000000000..df2caadd38b
 --- /dev/null
 +++ b/dlls/api-ms-win-shcore-stream-l1-1-0/Makefile.in
 @@ -0,0 +1 @@
 +MODULE    = api-ms-win-shcore-stream-l1-1-0.dll
 diff --git a/dlls/api-ms-win-shcore-stream-l1-1-0/api-ms-win-shcore-stream-l1-1-0.spec b/dlls/api-ms-win-shcore-stream-l1-1-0/api-ms-win-shcore-stream-l1-1-0.spec
 new file mode 100644
-index 0000000..1ee9dd3
+index 00000000000..1ee9dd335b6
 --- /dev/null
 +++ b/dlls/api-ms-win-shcore-stream-l1-1-0/api-ms-win-shcore-stream-l1-1-0.spec
 @@ -0,0 +1,15 @@
@@ -53,10 +53,10 @@ index 0000000..1ee9dd3
 +@ stdcall SHOpenRegStreamA(long str str long) shcore.SHOpenRegStreamA
 +@ stdcall SHOpenRegStreamW(long wstr wstr long) shcore.SHOpenRegStreamW
 diff --git a/tools/make_specfiles b/tools/make_specfiles
-index 6a08495..dc429d7 100755
+index 7abb3be32e6..86509aa7fb7 100755
 --- a/tools/make_specfiles
 +++ b/tools/make_specfiles
-@@ -270,6 +270,7 @@ my @dll_groups =
+@@ -334,6 +334,7 @@ my @dll_groups =
    "shcore",
    "api-ms-win-shcore-obsolete-l1-1-0",
    "api-ms-win-shcore-thread-l1-1-0",
@@ -65,5 +65,5 @@ index 6a08495..dc429d7 100755
   [
    "user32",
 -- 
-2.9.0
+2.14.2
 

patches/api-ms-win-Stub_DLLs/0015-ext-ms-win-ntuser-mouse-l1-1-0-Add-dll.patch

@@ -1,4 +1,4 @@
-From 1d6b09ecb94a11bef9142a975b1d2053696193c4 Mon Sep 17 00:00:00 2001
+From ac72ceb861a2f245f4a79e783cac404f613b40e4 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Sat, 23 Jan 2016 21:00:39 +0100
 Subject: ext-ms-win-ntuser-mouse-l1-1-0: Add dll.
@@ -13,10 +13,10 @@ Subject: ext-ms-win-ntuser-mouse-l1-1-0: Add dll.
  create mode 100644 dlls/ext-ms-win-ntuser-mouse-l1-1-0/ext-ms-win-ntuser-mouse-l1-1-0.spec
 
 diff --git a/configure.ac b/configure.ac
-index dd536e88742..6fa34f04129 100644
+index f653064bce0..9ff3018ffa0 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3105,6 +3105,7 @@ WINE_CONFIG_DLL(ext-ms-win-gdi-render-l1-1-0)
+@@ -3138,6 +3138,7 @@ WINE_CONFIG_DLL(ext-ms-win-gdi-render-l1-1-0)
  WINE_CONFIG_DLL(ext-ms-win-kernel32-package-current-l1-1-0)
  WINE_CONFIG_DLL(ext-ms-win-kernel32-package-l1-1-1)
  WINE_CONFIG_DLL(ext-ms-win-ntuser-message-l1-1-1)
@@ -43,17 +43,17 @@ index 00000000000..22128a256f1
 +@ stdcall SetCapture(long) user32.SetCapture
 +@ stdcall TrackMouseEvent(ptr) user32.TrackMouseEvent
 diff --git a/tools/make_specfiles b/tools/make_specfiles
-index c84686b111b..7e2a921ed18 100755
+index 48fae02c87f..4e5d114356c 100755
 --- a/tools/make_specfiles
 +++ b/tools/make_specfiles
-@@ -330,6 +330,7 @@ my @dll_groups =
+@@ -339,6 +339,7 @@ my @dll_groups =
    "api-ms-win-ntuser-dc-access-l1-1-0",
    "api-ms-win-rtcore-ntuser-private-l1-1-0",
    "ext-ms-win-ntuser-message-l1-1-1",
 +  "ext-ms-win-ntuser-mouse-l1-1-0",
    "ext-ms-win-ntuser-private-l1-1-1",
    "ext-ms-win-ntuser-rectangle-ext-l1-1-0",
-   "ext-ms-win-ntuser-uicontext-ext-l1-1-0",
+   "api-ms-win-ntuser-rectangle-l1-1-0",
 -- 
-2.13.1
+2.14.1
 

patches/api-ms-win-Stub_DLLs/0019-api-ms-win-rtcore-ntuser-draw-l1-1-0-Add-dll.patch

@@ -1,4 +1,4 @@
-From d1fc786a0fe69d811970d4edd1403e1383b9d5f8 Mon Sep 17 00:00:00 2001
+From acffeda04d634fcbf0e35734f2d758c4db558e53 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Sat, 23 Jan 2016 21:08:48 +0100
 Subject: api-ms-win-rtcore-ntuser-draw-l1-1-0: Add dll.
@@ -13,11 +13,11 @@ Subject: api-ms-win-rtcore-ntuser-draw-l1-1-0: Add dll.
  create mode 100644 dlls/api-ms-win-rtcore-ntuser-draw-l1-1-0/api-ms-win-rtcore-ntuser-draw-l1-1-0.spec
 
 diff --git a/configure.ac b/configure.ac
-index 2e2bcd12af6..d6a4e04dd8d 100644
+index 6621de58f49..db6567341b4 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -2856,6 +2856,7 @@ WINE_CONFIG_DLL(api-ms-win-mm-mme-l1-1-0)
- WINE_CONFIG_DLL(api-ms-win-ntuser-dc-access-l1-1-0)
+@@ -2897,6 +2897,7 @@ WINE_CONFIG_DLL(api-ms-win-ntuser-dc-access-l1-1-0)
+ WINE_CONFIG_DLL(api-ms-win-ntuser-rectangle-l1-1-0)
  WINE_CONFIG_DLL(api-ms-win-power-base-l1-1-0)
  WINE_CONFIG_DLL(api-ms-win-power-setting-l1-1-0)
 +WINE_CONFIG_DLL(api-ms-win-rtcore-ntuser-draw-l1-1-0)
@@ -39,10 +39,10 @@ index 00000000000..59900a93eb5
 @@ -0,0 +1 @@
 +@ stdcall RedrawWindow(long ptr long long) user32.RedrawWindow
 diff --git a/tools/make_specfiles b/tools/make_specfiles
-index 2748a12d038..b9959cc51f1 100755
+index d62172215fc..82717b9ceb3 100755
 --- a/tools/make_specfiles
 +++ b/tools/make_specfiles
-@@ -314,6 +314,7 @@ my @dll_groups =
+@@ -337,6 +337,7 @@ my @dll_groups =
    "api-ms-win-core-string-l2-1-0",
    "api-ms-win-downlevel-user32-l1-1-0",
    "api-ms-win-ntuser-dc-access-l1-1-0",
@@ -51,5 +51,5 @@ index 2748a12d038..b9959cc51f1 100755
    "api-ms-win-rtcore-ntuser-window-l1-1-0",
    "ext-ms-win-ntuser-message-l1-1-1",
 -- 
-2.12.2
+2.14.1
 

patches/bcrypt-Improvements/0031-include-Add-ecdsa-and-asymmetric-key-related-bcrypt-.patch

@@ -0,0 +1,86 @@
+From 4deacb4fe26419c2c3e7e9e7b194736e2f0b6063 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Fri, 29 Sep 2017 18:49:09 +0200
+Subject: include: Add ecdsa and asymmetric key related bcrypt definitions.
+
+---
+ include/bcrypt.h   | 28 ++++++++++++++++++++++++++++
+ include/ntstatus.h |  2 ++
+ 2 files changed, 30 insertions(+)
+
+diff --git a/include/bcrypt.h b/include/bcrypt.h
+index de812ffe333..f524cb9afdc 100644
+--- a/include/bcrypt.h
++++ b/include/bcrypt.h
+@@ -61,6 +61,8 @@ typedef LONG NTSTATUS;
+ #define BCRYPT_OPAQUE_KEY_BLOB   (const WCHAR []){'O','p','a','q','u','e','K','e','y','B','l','o','b',0}
+ #define BCRYPT_KEY_DATA_BLOB     (const WCHAR []){'K','e','y','D','a','t','a','B','l','o','b',0}
+ #define BCRYPT_AES_WRAP_KEY_BLOB (const WCHAR []){'R','f','c','3','5','6','5','K','e','y','W','r','a','p','B','l','o','b',0}
++#define BCRYPT_ECCPUBLIC_BLOB    (const WCHAR []){'E','C','C','P','U','B','L','I','C','B','L','O','B',0}
++#define BCRYPT_ECCPRIVATE_BLOB   (const WCHAR []){'E','C','C','P','R','I','V','A','T','E','B','L','O','B',0}
+ 
+ #define MS_PRIMITIVE_PROVIDER (const WCHAR [])\
+     {'M','i','c','r','o','s','o','f','t',' ','P','r','i','m','i','t','i','v','e',' ','P','r','o','v','i','d','e','r',0}
+@@ -74,6 +76,9 @@ typedef LONG NTSTATUS;
+ #define BCRYPT_SHA256_ALGORITHM     (const WCHAR []){'S','H','A','2','5','6',0}
+ #define BCRYPT_SHA384_ALGORITHM     (const WCHAR []){'S','H','A','3','8','4',0}
+ #define BCRYPT_SHA512_ALGORITHM     (const WCHAR []){'S','H','A','5','1','2',0}
++#define BCRYPT_ECDSA_P256_ALGORITHM (const WCHAR []){'E','C','D','S','A','_','P','2','5','6',0}
++#define BCRYPT_ECDSA_P384_ALGORITHM (const WCHAR []){'E','C','D','S','A','_','P','3','8','4',0}
++#define BCRYPT_ECDSA_P521_ALGORITHM (const WCHAR []){'E','C','D','S','A','_','P','5','2','1',0}
+ 
+ #define BCRYPT_CHAIN_MODE_NA        (const WCHAR []){'C','h','a','i','n','i','n','g','M','o','d','e','N','/','A',0}
+ #define BCRYPT_CHAIN_MODE_CBC       (const WCHAR []){'C','h','a','i','n','i','n','g','M','o','d','e','C','B','C',0}
+@@ -82,6 +87,13 @@ typedef LONG NTSTATUS;
+ #define BCRYPT_CHAIN_MODE_CCM       (const WCHAR []){'C','h','a','i','n','i','n','g','M','o','d','e','C','C','M',0}
+ #define BCRYPT_CHAIN_MODE_GCM       (const WCHAR []){'C','h','a','i','n','i','n','g','M','o','d','e','G','C','M',0}
+ 
++#define BCRYPT_ECDSA_PUBLIC_P256_MAGIC  0x31534345
++#define BCRYPT_ECDSA_PRIVATE_P256_MAGIC 0x32534345
++#define BCRYPT_ECDSA_PUBLIC_P384_MAGIC  0x33534345
++#define BCRYPT_ECDSA_PRIVATE_P384_MAGIC 0x34534345
++#define BCRYPT_ECDSA_PUBLIC_P521_MAGIC  0x35534345
++#define BCRYPT_ECDSA_PRIVATE_P521_MAGIC 0x36534345
++
+ typedef struct _BCRYPT_ALGORITHM_IDENTIFIER
+ {
+     LPWSTR pszName;
+@@ -120,6 +132,22 @@ typedef struct _BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO
+     ULONG dwFlags;
+ } BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO, *PBCRYPT_AUTHENTICATED_CIPHER_MODE_INFO;
+ 
++typedef struct _BCRYPT_ECCKEY_BLOB
++{
++    ULONG dwMagic;
++    ULONG cbKey;
++} BCRYPT_ECCKEY_BLOB, *PBCRYPT_ECCKEY_BLOB;
++
++typedef struct _BCRYPT_PKCS1_PADDING_INFO
++{
++    LPCWSTR pszAlgId;
++} BCRYPT_PKCS1_PADDING_INFO;
++
++#define BCRYPT_PAD_NONE   0x00000001
++#define BCRYPT_PAD_PKCS1  0x00000002
++#define BCRYPT_PAD_OAEP   0x00000004
++#define BCRYPT_PAD_PSS    0x00000008
++
+ #define BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO_VERSION 1
+ 
+ #define BCRYPT_AUTH_MODE_CHAIN_CALLS_FLAG 0x00000001
+diff --git a/include/ntstatus.h b/include/ntstatus.h
+index 7026de7f85f..735b6c2c41c 100644
+--- a/include/ntstatus.h
++++ b/include/ntstatus.h
+@@ -990,6 +990,8 @@
+ 
+ #define STATUS_WOW_ASSERTION             ((NTSTATUS) 0xC0009898)
+ 
++#define STATUS_INVALID_SIGNATURE         ((NTSTATUS) 0xC000A000)
++#define STATUS_HMAC_NOT_SUPPORTED        ((NTSTATUS) 0xC000A001)
+ #define STATUS_AUTH_TAG_MISMATCH         ((NTSTATUS) 0xC000A002)
+ 
+ #define RPC_NT_INVALID_STRING_BINDING    ((NTSTATUS) 0xC0020001)
+-- 
+2.14.1
+

patches/bcrypt-Improvements/0032-bcrypt-tests-Add-basic-test-for-ecdsa.patch

@@ -0,0 +1,109 @@
+From bbc4343e5ce6b5a5404dbd9d61ce7f49f042da52 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Fri, 29 Sep 2017 18:50:04 +0200
+Subject: bcrypt/tests: Add basic test for ecdsa.
+
+---
+ dlls/bcrypt/tests/bcrypt.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 65 insertions(+)
+
+diff --git a/dlls/bcrypt/tests/bcrypt.c b/dlls/bcrypt/tests/bcrypt.c
+index ae48914b5de..be901202970 100644
+--- a/dlls/bcrypt/tests/bcrypt.c
++++ b/dlls/bcrypt/tests/bcrypt.c
+@@ -50,6 +50,8 @@ static NTSTATUS (WINAPI *pBCryptDestroyKey)(BCRYPT_KEY_HANDLE);
+ static NTSTATUS (WINAPI *pBCryptImportKey)(BCRYPT_ALG_HANDLE, BCRYPT_KEY_HANDLE, LPCWSTR, BCRYPT_KEY_HANDLE *,
+                                            PUCHAR, ULONG, PUCHAR, ULONG, ULONG);
+ static NTSTATUS (WINAPI *pBCryptExportKey)(BCRYPT_KEY_HANDLE, BCRYPT_KEY_HANDLE, LPCWSTR, PUCHAR, ULONG, ULONG *, ULONG);
++static NTSTATUS (WINAPI *pBCryptImportKeyPair)(BCRYPT_ALG_HANDLE, BCRYPT_KEY_HANDLE, LPCWSTR, BCRYPT_KEY_HANDLE *, UCHAR *, ULONG, ULONG);
++static NTSTATUS (WINAPI *pBCryptVerifySignature)(BCRYPT_KEY_HANDLE, VOID *, UCHAR *, ULONG, UCHAR *, ULONG, ULONG);
+ 
+ static void test_BCryptGenRandom(void)
+ {
+@@ -1635,6 +1637,66 @@ static void test_key_import_export(void)
+     ok(ret == STATUS_SUCCESS, "got %08x\n", ret);
+ }
+ 
++static BYTE eccPubkey[] =
++{
++    /* X */
++    0x3b, 0x3c, 0x34, 0xc8, 0x3f, 0x15, 0xea, 0x02, 0x68, 0x46, 0x69, 0xdf, 0x0c, 0xa6, 0xee, 0x7a,
++    0xd9, 0x82, 0x08, 0x9b, 0x37, 0x53, 0x42, 0xf3, 0x13, 0x63, 0xda, 0x65, 0x79, 0xe8, 0x04, 0x9e,
++    /* Y */
++    0x8c, 0x77, 0xc4, 0x33, 0x77, 0xd9, 0x5a, 0x7f, 0x60, 0x7b, 0x98, 0xce, 0xf3, 0x96, 0x56, 0xd6,
++    0xb5, 0x8d, 0x87, 0x7a, 0x00, 0x2b, 0xf3, 0x70, 0xb3, 0x90, 0x73, 0xa0, 0x56, 0x06, 0x3b, 0x22,
++};
++static BYTE certHash[] =
++{
++    0x28, 0x19, 0x0f, 0x15, 0x6d, 0x75, 0xcc, 0xcf, 0x62, 0xf1, 0x5e, 0xe6, 0x8a, 0xc3, 0xf0, 0x5d,
++    0x89, 0x28, 0x2d, 0x48, 0xd8, 0x73, 0x7c, 0x05, 0x05, 0x8e, 0xbc, 0xce, 0x28, 0xb7, 0xba, 0xc9,
++};
++static BYTE certSignature[] =
++{
++    /* r */
++    0xd7, 0x29, 0xce, 0x5a, 0xef, 0x74, 0x85, 0xd1, 0x18, 0x5f, 0x6e, 0xf1, 0xba, 0x53, 0xd4, 0xcd,
++    0xdd, 0xe0, 0x5d, 0xf1, 0x5e, 0x48, 0x51, 0xea, 0x63, 0xc0, 0xe8, 0xe2, 0xf6, 0xfa, 0x4c, 0xaf,
++    /* s */
++    0xe3, 0x94, 0x15, 0x3b, 0x6c, 0x71, 0x6e, 0x44, 0x22, 0xcb, 0xa0, 0x88, 0xcd, 0x0a, 0x5a, 0x50,
++    0x29, 0x7c, 0x5c, 0xd6, 0x6c, 0xd2, 0xe0, 0x7f, 0xcd, 0x02, 0x92, 0x21, 0x4c, 0x2c, 0x92, 0xee,
++};
++
++static void test_ECDSA(void)
++{
++    BYTE buffer[sizeof(BCRYPT_ECCKEY_BLOB) + sizeof(eccPubkey)];
++    BCRYPT_ECCKEY_BLOB *ecckey = (void *)buffer;
++    BCRYPT_ALG_HANDLE alg = NULL;
++    BCRYPT_KEY_HANDLE key = NULL;
++    NTSTATUS status;
++
++    status = pBCryptOpenAlgorithmProvider(&alg, BCRYPT_ECDSA_P256_ALGORITHM, NULL, 0);
++    if (status)
++    {
++        todo_wine win_skip("Failed to open ECDSA provider: %08x, skipping test\n", status);
++        return;
++    }
++
++    ecckey->dwMagic = BCRYPT_ECDSA_PUBLIC_P256_MAGIC;
++    memcpy(ecckey + 1, eccPubkey, sizeof(eccPubkey));
++
++    ecckey->cbKey = 2;
++    status = pBCryptImportKeyPair(alg, NULL, BCRYPT_ECCPUBLIC_BLOB, &key, buffer, sizeof(buffer), 0);
++    ok(status == STATUS_INVALID_PARAMETER, "Expected STATUS_INVALID_PARAMETER, got %08x\n", status);
++
++    ecckey->cbKey = sizeof(eccPubkey) / 2;
++    status = pBCryptImportKeyPair(alg, NULL, BCRYPT_ECCPUBLIC_BLOB, &key, buffer, sizeof(buffer), 0);
++    ok(!status, "BCryptImportKeyPair failed: %08x\n", status);
++
++    status = pBCryptVerifySignature(key, NULL, certHash, sizeof(certHash) - 1, certSignature, sizeof(certSignature), 0);
++    ok(status == STATUS_INVALID_SIGNATURE, "Expected STATUS_INVALID_SIGNATURE, got %08x\n", status);
++
++    status = pBCryptVerifySignature(key, NULL, certHash, sizeof(certHash), certSignature, sizeof(certSignature), 0);
++    ok(!status, "BCryptVerifySignature failed: %08x\n", status);
++
++    pBCryptDestroyKey(key);
++    pBCryptCloseAlgorithmProvider(alg, 0);
++}
++
+ START_TEST(bcrypt)
+ {
+     HMODULE module;
+@@ -1665,6 +1727,8 @@ START_TEST(bcrypt)
+     pBCryptDestroyKey = (void *)GetProcAddress(module, "BCryptDestroyKey");
+     pBCryptImportKey = (void *)GetProcAddress(module, "BCryptImportKey");
+     pBCryptExportKey = (void *)GetProcAddress(module, "BCryptExportKey");
++    pBCryptImportKeyPair = (void *)GetProcAddress(module, "BCryptImportKeyPair");
++    pBCryptVerifySignature = (void *)GetProcAddress(module, "BCryptVerifySignature");
+ 
+     test_BCryptGenRandom();
+     test_BCryptGetFipsAlgorithmMode();
+@@ -1679,6 +1743,7 @@ START_TEST(bcrypt)
+     test_BCryptEncrypt();
+     test_BCryptDecrypt();
+     test_key_import_export();
++    test_ECDSA();
+ 
+     if (pBCryptHash) /* >= Win 10 */
+         test_BcryptHash();
+-- 
+2.14.1
+

patches/bcrypt-Improvements/0033-bcrypt-Implement-importing-of-ecdsa-keys.patch

@@ -0,0 +1,308 @@
+From 745f8d61f2335efb96078f937ca113f144892cc3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Fri, 29 Sep 2017 19:18:58 +0200
+Subject: bcrypt: Implement importing of ecdsa keys.
+
+---
+ dlls/bcrypt/bcrypt.spec    |   4 +-
+ dlls/bcrypt/bcrypt_main.c  | 156 ++++++++++++++++++++++++++++++++++++++++++---
+ dlls/bcrypt/tests/bcrypt.c |   6 +-
+ include/bcrypt.h           |   2 +
+ 4 files changed, 154 insertions(+), 14 deletions(-)
+
+diff --git a/dlls/bcrypt/bcrypt.spec b/dlls/bcrypt/bcrypt.spec
+index f8a8c45a1d5..5d21b4646cc 100644
+--- a/dlls/bcrypt/bcrypt.spec
++++ b/dlls/bcrypt/bcrypt.spec
+@@ -32,7 +32,7 @@
+ @ stdcall BCryptHash(ptr ptr long ptr long ptr long)
+ @ stdcall BCryptHashData(ptr ptr long long)
+ @ stdcall BCryptImportKey(ptr ptr wstr ptr ptr long ptr long long)
+-@ stub BCryptImportKeyPair
++@ stdcall BCryptImportKeyPair(ptr ptr wstr ptr ptr long long)
+ @ stdcall BCryptOpenAlgorithmProvider(ptr wstr wstr long)
+ @ stub BCryptQueryContextConfiguration
+ @ stub BCryptQueryContextFunctionConfiguration
+@@ -50,7 +50,7 @@
+ @ stub BCryptSignHash
+ @ stub BCryptUnregisterConfigChangeNotify
+ @ stub BCryptUnregisterProvider
+-@ stub BCryptVerifySignature
++@ stdcall BCryptVerifySignature(ptr ptr ptr long ptr long long)
+ @ stub GetAsymmetricEncryptionInterface
+ @ stub GetCipherInterface
+ @ stub GetHashInterface
+diff --git a/dlls/bcrypt/bcrypt_main.c b/dlls/bcrypt/bcrypt_main.c
+index 4e1992292cd..f822a7aadf3 100644
+--- a/dlls/bcrypt/bcrypt_main.c
++++ b/dlls/bcrypt/bcrypt_main.c
+@@ -181,7 +181,9 @@ enum alg_id
+     ALG_ID_SHA1,
+     ALG_ID_SHA256,
+     ALG_ID_SHA384,
+-    ALG_ID_SHA512
++    ALG_ID_SHA512,
++    ALG_ID_ECDSA_P256,
++    ALG_ID_ECDSA_P384,
+ };
+ 
+ enum mode_id
+@@ -201,13 +203,15 @@ static const struct {
+     const WCHAR *alg_name;
+     BOOL symmetric;
+ } alg_props[] = {
+-    /* ALG_ID_AES    */ {  654,    0,    0, BCRYPT_AES_ALGORITHM,    TRUE  },
+-    /* ALG_ID_MD5    */ {  274,   16,  512, BCRYPT_MD5_ALGORITHM,    FALSE },
+-    /* ALG_ID_RNG    */ {    0,    0,    0, BCRYPT_RNG_ALGORITHM,    FALSE },
+-    /* ALG_ID_SHA1   */ {  278,   20,  512, BCRYPT_SHA1_ALGORITHM,   FALSE },
+-    /* ALG_ID_SHA256 */ {  286,   32,  512, BCRYPT_SHA256_ALGORITHM, FALSE },
+-    /* ALG_ID_SHA384 */ {  382,   48, 1024, BCRYPT_SHA384_ALGORITHM, FALSE },
+-    /* ALG_ID_SHA512 */ {  382,   64, 1024, BCRYPT_SHA512_ALGORITHM, FALSE },
++    /* ALG_ID_AES    */     {  654,    0,    0, BCRYPT_AES_ALGORITHM,        TRUE  },
++    /* ALG_ID_MD5    */     {  274,   16,  512, BCRYPT_MD5_ALGORITHM,        FALSE },
++    /* ALG_ID_RNG    */     {    0,    0,    0, BCRYPT_RNG_ALGORITHM,        FALSE },
++    /* ALG_ID_SHA1   */     {  278,   20,  512, BCRYPT_SHA1_ALGORITHM,       FALSE },
++    /* ALG_ID_SHA256 */     {  286,   32,  512, BCRYPT_SHA256_ALGORITHM,     FALSE },
++    /* ALG_ID_SHA384 */     {  382,   48, 1024, BCRYPT_SHA384_ALGORITHM,     FALSE },
++    /* ALG_ID_SHA512 */     {  382,   64, 1024, BCRYPT_SHA512_ALGORITHM,     FALSE },
++    /* ALG_ID_ECDSA_P256 */ {    0,   0,     0, BCRYPT_ECDSA_P256_ALGORITHM, FALSE  },
++    /* ALG_ID_ECDSA_P384 */ {    0,   0,     0, BCRYPT_ECDSA_P384_ALGORITHM, FALSE  },
+ };
+ 
+ struct algorithm
+@@ -284,6 +288,8 @@ NTSTATUS WINAPI BCryptOpenAlgorithmProvider( BCRYPT_ALG_HANDLE *handle, LPCWSTR
+     else if (!strcmpW( id, BCRYPT_SHA256_ALGORITHM )) alg_id = ALG_ID_SHA256;
+     else if (!strcmpW( id, BCRYPT_SHA384_ALGORITHM )) alg_id = ALG_ID_SHA384;
+     else if (!strcmpW( id, BCRYPT_SHA512_ALGORITHM )) alg_id = ALG_ID_SHA512;
++    else if (!strcmpW( id, BCRYPT_ECDSA_P256_ALGORITHM )) alg_id = ALG_ID_ECDSA_P256;
++    else if (!strcmpW( id, BCRYPT_ECDSA_P384_ALGORITHM )) alg_id = ALG_ID_ECDSA_P384;
+     else
+     {
+         FIXME( "algorithm %s not supported\n", debugstr_w(id) );
+@@ -825,6 +831,12 @@ struct key_symmetric
+     ULONG              secret_len;
+ };
+ 
++struct key_asymmetric
++{
++    UCHAR             *pubkey;
++    ULONG              pubkey_len;
++};
++
+ struct key
+ {
+     struct object      hdr;
+@@ -832,6 +844,7 @@ struct key
+     union
+     {
+         struct key_symmetric s;
++        struct key_asymmetric a;
+     } u;
+ };
+ 
+@@ -871,6 +884,33 @@ static NTSTATUS key_symmetric_init( struct key *key, struct algorithm *alg, cons
+     return STATUS_SUCCESS;
+ }
+ 
++static NTSTATUS key_asymmetric_init( struct key *key, struct algorithm *alg, const UCHAR *pubkey, ULONG pubkey_len )
++{
++    UCHAR *buffer;
++
++    if (!libgnutls_handle) return STATUS_INTERNAL_ERROR;
++
++    switch (alg->id)
++    {
++    case ALG_ID_ECDSA_P256:
++    case ALG_ID_ECDSA_P384:
++        break;
++
++    default:
++        FIXME( "algorithm %u not supported\n", alg->id );
++        return STATUS_NOT_SUPPORTED;
++    }
++
++    if (!(buffer = HeapAlloc( GetProcessHeap(), 0, pubkey_len ))) return STATUS_NO_MEMORY;
++    memcpy( buffer, pubkey, pubkey_len );
++
++    key->alg_id         = alg->id;
++    key->u.a.pubkey     = buffer;
++    key->u.a.pubkey_len = pubkey_len;
++
++    return STATUS_SUCCESS;
++}
++
+ static inline BOOL key_is_symmetric( struct key *key )
+ {
+     return alg_props[key->alg_id].symmetric;
+@@ -903,7 +943,13 @@ static NTSTATUS key_duplicate( struct key *key_orig, struct key *key_copy )
+     }
+     else
+     {
+-        return STATUS_NOT_IMPLEMENTED;
++        if (!(buffer = HeapAlloc( GetProcessHeap(), 0, key_orig->u.a.pubkey_len ))) return STATUS_NO_MEMORY;
++        memcpy( buffer, key_orig->u.a.pubkey, key_orig->u.a.pubkey_len );
++
++        key_copy->u.a.pubkey      = buffer;
++        key_copy->u.a.pubkey_len  = key_orig->u.a.pubkey_len;
++
++        return STATUS_SUCCESS;
+     }
+ }
+ 
+@@ -1085,6 +1131,10 @@ static NTSTATUS key_destroy( struct key *key )
+         if (key->u.s.handle) pgnutls_cipher_deinit( key->u.s.handle );
+         HeapFree( GetProcessHeap(), 0, key->u.s.secret );
+     }
++    else
++    {
++        HeapFree( GetProcessHeap(), 0, key->u.a.pubkey );
++    }
+     HeapFree( GetProcessHeap(), 0, key );
+     return STATUS_SUCCESS;
+ }
+@@ -1112,6 +1162,12 @@ static NTSTATUS key_symmetric_init( struct key *key, struct algorithm *alg, UCHA
+     return STATUS_NOT_IMPLEMENTED;
+ }
+ 
++static NTSTATUS key_asymmetric_init( struct key *key, struct algorithm *alg, const UCHAR *pubkey, ULONG pubkey_len )
++{
++    ERR( "support for keys not available at build time\n" );
++    return STATUS_NOT_IMPLEMENTED;
++}
++
+ static NTSTATUS key_duplicate( struct key *key_orig, struct key *key_copy )
+ {
+     ERR( "support for keys not available at build time\n" );
+@@ -1334,6 +1390,88 @@ NTSTATUS WINAPI BCryptExportKey( BCRYPT_KEY_HANDLE export_key, BCRYPT_KEY_HANDLE
+     return STATUS_INVALID_PARAMETER;
+ }
+ 
++NTSTATUS WINAPI BCryptImportKeyPair( BCRYPT_ALG_HANDLE algorithm, BCRYPT_KEY_HANDLE decrypt_key, const WCHAR *type,
++                                     BCRYPT_KEY_HANDLE *ret_key, UCHAR *input, ULONG input_len, ULONG flags )
++{
++    struct algorithm *alg = algorithm;
++    NTSTATUS status;
++    struct key *key;
++
++    TRACE( "%p, %p, %s, %p, %p, %u, %u\n", algorithm, decrypt_key, debugstr_w(type), ret_key, input, input_len, flags );
++
++    if (!alg || alg->hdr.magic != MAGIC_ALG) return STATUS_INVALID_HANDLE;
++    if (!ret_key || !type || !input) return STATUS_INVALID_PARAMETER;
++
++    *ret_key = NULL;
++
++    if (decrypt_key)
++    {
++        FIXME( "decrypting of key not yet supported\n" );
++        return STATUS_NOT_IMPLEMENTED;
++    }
++
++    if (!strcmpW( type, BCRYPT_ECCPUBLIC_BLOB ))
++    {
++        BCRYPT_ECCKEY_BLOB *ecc_blob = (BCRYPT_ECCKEY_BLOB *)input;
++        DWORD key_size, magic;
++
++        if (input_len < sizeof(*ecc_blob))
++            return STATUS_INVALID_PARAMETER;
++
++        switch (alg->id)
++        {
++            case ALG_ID_ECDSA_P256:
++                key_size = 32;
++                magic = BCRYPT_ECDSA_PUBLIC_P256_MAGIC;
++                break;
++            case ALG_ID_ECDSA_P384:
++                key_size = 48;
++                magic = BCRYPT_ECDSA_PUBLIC_P384_MAGIC;
++                break;
++
++            default:
++                FIXME("Algorithm %d does not yet support importing blob of type: %s\n", alg->id, debugstr_w(type));
++                return STATUS_NOT_SUPPORTED;
++        }
++
++        if (ecc_blob->dwMagic != magic)
++            return STATUS_NOT_SUPPORTED;
++
++        if (ecc_blob->cbKey != key_size)
++            return STATUS_INVALID_PARAMETER;
++
++        if (!(key = HeapAlloc( GetProcessHeap(), 0, sizeof(*key) )))
++            return STATUS_NO_MEMORY;
++
++        key->hdr.magic = MAGIC_KEY;
++        if ((status = key_asymmetric_init( key, alg, (BYTE *)(ecc_blob + 1), ecc_blob->cbKey * 2 )))
++        {
++            HeapFree( GetProcessHeap(), 0, key );
++            return status;
++        }
++
++        *ret_key = key;
++        return STATUS_SUCCESS;
++    }
++
++    FIXME( "unsupported key type %s\n", debugstr_w(type) );
++    return STATUS_NOT_SUPPORTED;
++}
++
++NTSTATUS WINAPI BCryptVerifySignature( BCRYPT_KEY_HANDLE handle, void *padding, UCHAR *hash, ULONG hash_len,
++                                       UCHAR *signature, ULONG signature_len, ULONG flags )
++{
++    struct key *key = handle;
++
++    FIXME( "%p, %p, %p, %u, %p, %u, %08x: stub!\n", handle, padding, hash,
++           hash_len, signature, signature_len, flags );
++
++    if (!key || key->hdr.magic != MAGIC_KEY) return STATUS_INVALID_HANDLE;
++    if (!key_is_asymmetric(key)) return STATUS_NOT_SUPPORTED;
++
++    return STATUS_NOT_IMPLEMENTED;
++}
++
+ NTSTATUS WINAPI BCryptDestroyKey( BCRYPT_KEY_HANDLE handle )
+ {
+     struct key *key = handle;
+diff --git a/dlls/bcrypt/tests/bcrypt.c b/dlls/bcrypt/tests/bcrypt.c
+index be901202970..20f70706430 100644
+--- a/dlls/bcrypt/tests/bcrypt.c
++++ b/dlls/bcrypt/tests/bcrypt.c
+@@ -1672,7 +1672,7 @@ static void test_ECDSA(void)
+     status = pBCryptOpenAlgorithmProvider(&alg, BCRYPT_ECDSA_P256_ALGORITHM, NULL, 0);
+     if (status)
+     {
+-        todo_wine win_skip("Failed to open ECDSA provider: %08x, skipping test\n", status);
++        win_skip("Failed to open ECDSA provider: %08x, skipping test\n", status);
+         return;
+     }
+ 
+@@ -1688,10 +1688,10 @@ static void test_ECDSA(void)
+     ok(!status, "BCryptImportKeyPair failed: %08x\n", status);
+ 
+     status = pBCryptVerifySignature(key, NULL, certHash, sizeof(certHash) - 1, certSignature, sizeof(certSignature), 0);
+-    ok(status == STATUS_INVALID_SIGNATURE, "Expected STATUS_INVALID_SIGNATURE, got %08x\n", status);
++    todo_wine ok(status == STATUS_INVALID_SIGNATURE, "Expected STATUS_INVALID_SIGNATURE, got %08x\n", status);
+ 
+     status = pBCryptVerifySignature(key, NULL, certHash, sizeof(certHash), certSignature, sizeof(certSignature), 0);
+-    ok(!status, "BCryptVerifySignature failed: %08x\n", status);
++    todo_wine ok(!status, "BCryptVerifySignature failed: %08x\n", status);
+ 
+     pBCryptDestroyKey(key);
+     pBCryptCloseAlgorithmProvider(alg, 0);
+diff --git a/include/bcrypt.h b/include/bcrypt.h
+index f524cb9afdc..3dcc953e9ed 100644
+--- a/include/bcrypt.h
++++ b/include/bcrypt.h
+@@ -185,8 +185,10 @@ NTSTATUS WINAPI BCryptGetFipsAlgorithmMode(BOOLEAN *);
+ NTSTATUS WINAPI BCryptGetProperty(BCRYPT_HANDLE, LPCWSTR, PUCHAR, ULONG, ULONG *, ULONG);
+ NTSTATUS WINAPI BCryptHash(BCRYPT_ALG_HANDLE, PUCHAR, ULONG, PUCHAR, ULONG, PUCHAR, ULONG);
+ NTSTATUS WINAPI BCryptHashData(BCRYPT_HASH_HANDLE, PUCHAR, ULONG, ULONG);
++NTSTATUS WINAPI BCryptImportKeyPair(BCRYPT_ALG_HANDLE, BCRYPT_KEY_HANDLE, LPCWSTR, BCRYPT_KEY_HANDLE *, UCHAR *, ULONG, ULONG);
+ NTSTATUS WINAPI BCryptOpenAlgorithmProvider(BCRYPT_ALG_HANDLE *, LPCWSTR, LPCWSTR, ULONG);
+ NTSTATUS WINAPI BCryptSetProperty(BCRYPT_HANDLE, LPCWSTR, PUCHAR, ULONG, ULONG);
+ NTSTATUS WINAPI BCryptDuplicateHash(BCRYPT_HASH_HANDLE, BCRYPT_HASH_HANDLE *, UCHAR *, ULONG, ULONG);
++NTSTATUS WINAPI BCryptVerifySignature(BCRYPT_KEY_HANDLE, void *, UCHAR *, ULONG, UCHAR *, ULONG, ULONG);
+ 
+ #endif  /* __WINE_BCRYPT_H */
+-- 
+2.14.1
+

patches/bcrypt-Improvements/0034-bcrypt-Implement-BCryptVerifySignature-for-ecdsa-sig.patch

@@ -0,0 +1,437 @@
+From 09e86a5b33ead90b064eeb1d728f567283dfa389 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Fri, 29 Sep 2017 20:31:00 +0200
+Subject: bcrypt: Implement BCryptVerifySignature for ecdsa signatures.
+
+---
+ dlls/bcrypt/bcrypt_main.c  | 326 ++++++++++++++++++++++++++++++++++++++++++++-
+ dlls/bcrypt/tests/bcrypt.c |   4 +-
+ 2 files changed, 326 insertions(+), 4 deletions(-)
+
+diff --git a/dlls/bcrypt/bcrypt_main.c b/dlls/bcrypt/bcrypt_main.c
+index f822a7aadf3..881f6f7eb0c 100644
+--- a/dlls/bcrypt/bcrypt_main.c
++++ b/dlls/bcrypt/bcrypt_main.c
+@@ -27,6 +27,7 @@
+ #elif defined(SONAME_LIBGNUTLS)
+ #include <gnutls/gnutls.h>
+ #include <gnutls/crypto.h>
++#include <gnutls/abstract.h>
+ #endif
+ 
+ #include "ntstatus.h"
+@@ -49,9 +50,26 @@ static HINSTANCE instance;
+ #if defined(HAVE_GNUTLS_CIPHER_INIT) && !defined(HAVE_COMMONCRYPTO_COMMONDIGEST_H)
+ WINE_DECLARE_DEBUG_CHANNEL(winediag);
+ 
++#if GNUTLS_VERSION_MAJOR < 3
++typedef enum
++{
++    GNUTLS_ECC_CURVE_INVALID = 0,
++    GNUTLS_ECC_CURVE_SECP224R1,
++    GNUTLS_ECC_CURVE_SECP256R1,
++    GNUTLS_ECC_CURVE_SECP384R1,
++    GNUTLS_ECC_CURVE_SECP521R1,
++} gnutls_ecc_curve_t;
++#endif
++
+ /* Not present in gnutls version < 3.0 */
+ static int (*pgnutls_cipher_tag)(gnutls_cipher_hd_t handle, void *tag, size_t tag_size);
+ static int (*pgnutls_cipher_add_auth)(gnutls_cipher_hd_t handle, const void *ptext, size_t ptext_size);
++static int (*pgnutls_pubkey_import_ecc_raw)(gnutls_pubkey_t key, gnutls_ecc_curve_t curve,
++                                            const gnutls_datum_t *x, const gnutls_datum_t *y);
++static gnutls_sign_algorithm_t (*pgnutls_pk_to_sign)(gnutls_pk_algorithm_t pk, gnutls_digest_algorithm_t hash);
++static int (*pgnutls_pubkey_verify_hash2)(gnutls_pubkey_t key, gnutls_sign_algorithm_t algo,
++                                          unsigned int flags, const gnutls_datum_t *hash,
++                                          const gnutls_datum_t *signature);
+ 
+ static void *libgnutls_handle;
+ #define MAKE_FUNCPTR(f) static typeof(f) * p##f
+@@ -64,12 +82,15 @@ MAKE_FUNCPTR(gnutls_global_init);
+ MAKE_FUNCPTR(gnutls_global_set_log_function);
+ MAKE_FUNCPTR(gnutls_global_set_log_level);
+ MAKE_FUNCPTR(gnutls_perror);
++MAKE_FUNCPTR(gnutls_pubkey_init);
++MAKE_FUNCPTR(gnutls_pubkey_deinit);
+ #undef MAKE_FUNCPTR
+ 
+ #if GNUTLS_VERSION_MAJOR < 3
+ #define GNUTLS_CIPHER_AES_192_CBC 92
+ #define GNUTLS_CIPHER_AES_128_GCM 93
+ #define GNUTLS_CIPHER_AES_256_GCM 94
++#define GNUTLS_PK_ECC 4
+ #endif
+ 
+ static int compat_gnutls_cipher_tag(gnutls_cipher_hd_t handle, void *tag, size_t tag_size)
+@@ -82,6 +103,24 @@ static int compat_gnutls_cipher_add_auth(gnutls_cipher_hd_t handle, const void *
+     return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
+ }
+ 
++static int compat_gnutls_pubkey_import_ecc_raw(gnutls_pubkey_t key, gnutls_ecc_curve_t curve,
++                                               const gnutls_datum_t *x, const gnutls_datum_t *y)
++{
++    return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
++}
++
++static gnutls_sign_algorithm_t compat_gnutls_pk_to_sign(gnutls_pk_algorithm_t pk, gnutls_digest_algorithm_t hash)
++{
++    return GNUTLS_SIGN_UNKNOWN;
++}
++
++static int compat_gnutls_pubkey_verify_hash2(gnutls_pubkey_t key, gnutls_sign_algorithm_t algo,
++                                             unsigned int flags, const gnutls_datum_t *hash,
++                                             const gnutls_datum_t *signature)
++{
++    return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
++}
++
+ static void gnutls_log( int level, const char *msg )
+ {
+     TRACE( "<%d> %s", level, msg );
+@@ -113,6 +152,8 @@ static BOOL gnutls_initialize(void)
+     LOAD_FUNCPTR(gnutls_global_set_log_function)
+     LOAD_FUNCPTR(gnutls_global_set_log_level)
+     LOAD_FUNCPTR(gnutls_perror)
++    LOAD_FUNCPTR(gnutls_pubkey_init);
++    LOAD_FUNCPTR(gnutls_pubkey_deinit);
+ #undef LOAD_FUNCPTR
+ 
+     if (!(pgnutls_cipher_tag = wine_dlsym( libgnutls_handle, "gnutls_cipher_tag", NULL, 0 )))
+@@ -125,6 +166,21 @@ static BOOL gnutls_initialize(void)
+         WARN("gnutls_cipher_add_auth not found\n");
+         pgnutls_cipher_add_auth = compat_gnutls_cipher_add_auth;
+     }
++    if (!(pgnutls_pubkey_import_ecc_raw = wine_dlsym( libgnutls_handle, "gnutls_pubkey_import_ecc_raw", NULL, 0 )))
++    {
++        WARN("gnutls_pubkey_import_ecc_raw not found\n");
++        pgnutls_pubkey_import_ecc_raw = compat_gnutls_pubkey_import_ecc_raw;
++    }
++    if (!(pgnutls_pk_to_sign = wine_dlsym( libgnutls_handle, "gnutls_pk_to_sign", NULL, 0 )))
++    {
++        WARN("gnutls_pk_to_sign not found\n");
++        pgnutls_pk_to_sign = compat_gnutls_pk_to_sign;
++    }
++    if (!(pgnutls_pubkey_verify_hash2 = wine_dlsym( libgnutls_handle, "gnutls_pubkey_verify_hash2", NULL, 0 )))
++    {
++        WARN("gnutls_pubkey_verify_hash2 not found\n");
++        pgnutls_pubkey_verify_hash2 = compat_gnutls_pubkey_verify_hash2;
++    }
+ 
+     if ((ret = pgnutls_global_init()) != GNUTLS_E_SUCCESS)
+     {
+@@ -1124,6 +1180,264 @@ static NTSTATUS key_symmetric_get_secret( struct key *key, UCHAR **secret, ULONG
+     return STATUS_SUCCESS;
+ }
+ 
++struct buffer
++{
++    BYTE *buffer;
++    DWORD length;
++    DWORD pos;
++    BOOL error;
++};
++
++static void buffer_init( struct buffer *buffer )
++{
++    buffer->buffer = NULL;
++    buffer->length = 0;
++    buffer->pos = 0;
++    buffer->error = FALSE;
++}
++
++static void buffer_free( struct buffer *buffer )
++{
++    HeapFree( GetProcessHeap(), 0, buffer->buffer );
++}
++
++static void buffer_append( struct buffer *buffer, BYTE *data, DWORD len )
++{
++    if (!len) return;
++
++    if (buffer->pos + len > buffer->length)
++    {
++        DWORD new_length = max( max( buffer->pos + len, buffer->length * 2 ), 64 );
++        BYTE *new_buffer;
++
++        if (buffer->buffer)
++            new_buffer = HeapReAlloc( GetProcessHeap(), 0, buffer->buffer, new_length );
++        else
++            new_buffer = HeapAlloc( GetProcessHeap(), 0, new_length );
++
++        if (!new_buffer)
++        {
++            ERR( "out of memory\n" );
++            buffer->error = TRUE;
++            return;
++        }
++
++        buffer->buffer = new_buffer;
++        buffer->length = new_length;
++    }
++
++    memcpy( &buffer->buffer[buffer->pos], data, len );
++    buffer->pos += len;
++}
++
++static void buffer_append_byte( struct buffer *buffer, BYTE value )
++{
++    buffer_append( buffer, &value, sizeof(value) );
++}
++
++static void buffer_append_asn1_length( struct buffer *buffer, DWORD length )
++{
++    DWORD num_bytes;
++
++    if (length < 128)
++    {
++        buffer_append_byte( buffer, length );
++        return;
++    }
++
++    if (length <= 0xff) num_bytes = 1;
++    else if (length <= 0xffff) num_bytes = 2;
++    else if (length <= 0xffffff) num_bytes = 3;
++    else num_bytes = 4;
++
++    buffer_append_byte( buffer, 0x80 | num_bytes );
++    while (num_bytes--)
++        buffer_append_byte( buffer, length >> (num_bytes * 8) );
++}
++
++static void buffer_append_asn1_integer( struct buffer *buffer, BYTE *data, DWORD len )
++{
++    DWORD leading_zero = (*data & 0x80) != 0;
++
++    buffer_append_byte( buffer, 0x02 );  /* tag */
++    buffer_append_asn1_length( buffer, len + leading_zero );
++    if (leading_zero) buffer_append_byte( buffer, 0 );
++    buffer_append( buffer, data, len );
++}
++
++static void buffer_append_asn1_sequence( struct buffer *buffer, struct buffer *content )
++{
++    if (content->error)
++    {
++        buffer->error = TRUE;
++        return;
++    }
++
++    buffer_append_byte( buffer, 0x30 );  /* tag */
++    buffer_append_asn1_length( buffer, content->pos );
++    buffer_append( buffer, content->buffer, content->pos );
++}
++
++static void buffer_append_asn1_r_s( struct buffer *buffer, BYTE *r, DWORD r_len, BYTE *s, DWORD s_len )
++{
++    struct buffer value;
++
++    buffer_init( &value );
++    buffer_append_asn1_integer( &value, r, r_len );
++    buffer_append_asn1_integer( &value, s, s_len );
++    buffer_append_asn1_sequence( buffer, &value );
++    buffer_free( &value );
++}
++
++static NTSTATUS import_gnutls_pubkey_ecc( struct key *key, gnutls_pubkey_t *gnutls_key )
++{
++    gnutls_ecc_curve_t curve;
++    gnutls_datum_t x, y;
++    int ret;
++
++    switch (key->alg_id)
++    {
++        case ALG_ID_ECDSA_P256: curve = GNUTLS_ECC_CURVE_SECP256R1; break;
++        case ALG_ID_ECDSA_P384: curve = GNUTLS_ECC_CURVE_SECP384R1; break;
++
++        default:
++            FIXME( "Algorithm %d not yet supported\n", key->alg_id );
++            return STATUS_NOT_IMPLEMENTED;
++    }
++
++    if ((ret = pgnutls_pubkey_init( gnutls_key )))
++    {
++        pgnutls_perror( ret );
++        return STATUS_INTERNAL_ERROR;
++    }
++
++    x.data = key->u.a.pubkey;
++    x.size = key->u.a.pubkey_len / 2;
++    y.data = key->u.a.pubkey + x.size;
++    y.size = x.size;
++
++    if ((ret = pgnutls_pubkey_import_ecc_raw( *gnutls_key, curve, &x, &y )))
++    {
++        pgnutls_perror( ret );
++        pgnutls_pubkey_deinit( *gnutls_key );
++        return STATUS_INTERNAL_ERROR;
++    }
++
++    return STATUS_SUCCESS;
++}
++
++static NTSTATUS import_gnutls_pubkey( struct key *key,  gnutls_pubkey_t *gnutls_key)
++{
++    switch (key->alg_id)
++    {
++        case ALG_ID_ECDSA_P256:
++        case ALG_ID_ECDSA_P384:
++            return import_gnutls_pubkey_ecc( key, gnutls_key );
++
++        default:
++            FIXME("Algorithm %d not yet supported\n", key->alg_id);
++            return STATUS_NOT_IMPLEMENTED;
++    }
++}
++
++static NTSTATUS prepare_gnutls_signature_ecc( struct key *key, UCHAR *signature, ULONG signature_len,
++                                              gnutls_datum_t *gnutls_signature )
++{
++    struct buffer buffer;
++    DWORD r_len = signature_len / 2;
++    DWORD s_len = r_len;
++    BYTE *r = signature;
++    BYTE *s = signature + r_len;
++
++    buffer_init( &buffer );
++    buffer_append_asn1_r_s( &buffer, r, r_len, s, s_len );
++    if (buffer.error)
++    {
++        buffer_free( &buffer );
++        return STATUS_NO_MEMORY;
++    }
++
++    gnutls_signature->data = buffer.buffer;
++    gnutls_signature->size = buffer.pos;
++    return STATUS_SUCCESS;
++}
++
++static NTSTATUS prepare_gnutls_signature( struct key *key, UCHAR *signature, ULONG signature_len,
++                                          gnutls_datum_t *gnutls_signature )
++{
++    switch (key->alg_id)
++    {
++        case ALG_ID_ECDSA_P256:
++        case ALG_ID_ECDSA_P384:
++            return prepare_gnutls_signature_ecc( key, signature, signature_len, gnutls_signature );
++
++        default:
++            FIXME( "Algorithm %d not yet supported\n", key->alg_id );
++            return STATUS_NOT_IMPLEMENTED;
++    }
++}
++
++static NTSTATUS key_asymmetric_verify( struct key *key, void *padding, UCHAR *hash, ULONG hash_len,
++                                       UCHAR *signature, ULONG signature_len, DWORD flags )
++{
++    gnutls_digest_algorithm_t hash_algo;
++    gnutls_sign_algorithm_t sign_algo;
++    gnutls_datum_t gnutls_hash, gnutls_signature;
++    gnutls_pk_algorithm_t pk_algo;
++    gnutls_pubkey_t gnutls_key;
++    NTSTATUS status;
++    int ret;
++
++    if (flags)
++        FIXME( "Flags %08x not supported\n", flags );
++
++    /* only the hash size must match, not the actual hash function */
++    switch (hash_len)
++    {
++        case 32: hash_algo = GNUTLS_DIG_SHA256; break;
++        case 48: hash_algo = GNUTLS_DIG_SHA384; break;
++
++        default:
++            FIXME( "Hash size %u not yet supported\n", hash_len );
++            return STATUS_INVALID_SIGNATURE;
++    }
++
++    switch (key->alg_id)
++    {
++        case ALG_ID_ECDSA_P256:
++        case ALG_ID_ECDSA_P384:
++            pk_algo = GNUTLS_PK_ECC;
++            break;
++
++        default:
++            FIXME( "Algorithm %d not yet supported\n", key->alg_id );
++            return STATUS_NOT_IMPLEMENTED;
++    }
++
++    if ((sign_algo = pgnutls_pk_to_sign( pk_algo, hash_algo )) == GNUTLS_SIGN_UNKNOWN)
++    {
++        FIXME("Gnutls does not support algorithm %d with hash len %u\n", key->alg_id, hash_len);
++        return STATUS_NOT_IMPLEMENTED;
++    }
++
++    if ((status = import_gnutls_pubkey( key, &gnutls_key )))
++        return status;
++
++    if ((status = prepare_gnutls_signature( key, signature, signature_len, &gnutls_signature )))
++    {
++        pgnutls_pubkey_deinit( gnutls_key );
++        return status;
++    }
++
++    gnutls_hash.data = hash;
++    gnutls_hash.size = hash_len;
++    ret = pgnutls_pubkey_verify_hash2( gnutls_key, sign_algo, 0, &gnutls_hash, &gnutls_signature );
++
++    HeapFree( GetProcessHeap(), 0, gnutls_signature.data );
++    pgnutls_pubkey_deinit( gnutls_key );
++    return (ret < 0) ? STATUS_INVALID_SIGNATURE : STATUS_SUCCESS;
++}
++
+ static NTSTATUS key_destroy( struct key *key )
+ {
+     if (key_is_symmetric(key))
+@@ -1230,6 +1544,13 @@ static NTSTATUS key_symmetric_get_secret( struct key *key, UCHAR **secret, ULONG
+     return STATUS_NOT_IMPLEMENTED;
+ }
+ 
++static NTSTATUS key_asymmetric_verify( struct key *key, void *padding, UCHAR *hash, ULONG hash_len,
++                                       UCHAR *signature, ULONG signature_len, DWORD flags )
++{
++    ERR( "support for keys not available at build time\n" );
++    return STATUS_NOT_IMPLEMENTED;
++}
++
+ static NTSTATUS key_destroy( struct key *key )
+ {
+     ERR( "support for keys not available at build time\n" );
+@@ -1463,13 +1784,14 @@ NTSTATUS WINAPI BCryptVerifySignature( BCRYPT_KEY_HANDLE handle, void *padding,
+ {
+     struct key *key = handle;
+ 
+-    FIXME( "%p, %p, %p, %u, %p, %u, %08x: stub!\n", handle, padding, hash,
++    TRACE( "%p, %p, %p, %u, %p, %u, %08x\n", handle, padding, hash,
+            hash_len, signature, signature_len, flags );
+ 
+     if (!key || key->hdr.magic != MAGIC_KEY) return STATUS_INVALID_HANDLE;
++    if (!hash || !hash_len || !signature || !signature_len) return STATUS_INVALID_PARAMETER;
+     if (!key_is_asymmetric(key)) return STATUS_NOT_SUPPORTED;
+ 
+-    return STATUS_NOT_IMPLEMENTED;
++    return key_asymmetric_verify( key, padding, hash, hash_len, signature, signature_len, flags );
+ }
+ 
+ NTSTATUS WINAPI BCryptDestroyKey( BCRYPT_KEY_HANDLE handle )
+diff --git a/dlls/bcrypt/tests/bcrypt.c b/dlls/bcrypt/tests/bcrypt.c
+index 20f70706430..73bd4d69a5b 100644
+--- a/dlls/bcrypt/tests/bcrypt.c
++++ b/dlls/bcrypt/tests/bcrypt.c
+@@ -1688,10 +1688,10 @@ static void test_ECDSA(void)
+     ok(!status, "BCryptImportKeyPair failed: %08x\n", status);
+ 
+     status = pBCryptVerifySignature(key, NULL, certHash, sizeof(certHash) - 1, certSignature, sizeof(certSignature), 0);
+-    todo_wine ok(status == STATUS_INVALID_SIGNATURE, "Expected STATUS_INVALID_SIGNATURE, got %08x\n", status);
++    ok(status == STATUS_INVALID_SIGNATURE, "Expected STATUS_INVALID_SIGNATURE, got %08x\n", status);
+ 
+     status = pBCryptVerifySignature(key, NULL, certHash, sizeof(certHash), certSignature, sizeof(certSignature), 0);
+-    todo_wine ok(!status, "BCryptVerifySignature failed: %08x\n", status);
++    ok(!status, "BCryptVerifySignature failed: %08x\n", status);
+ 
+     pBCryptDestroyKey(key);
+     pBCryptCloseAlgorithmProvider(alg, 0);
+-- 
+2.14.1
+

patches/bcrypt-Improvements/0035-bcrypt-Initial-implementation-for-RSA-key-import-and.patch

@@ -0,0 +1,296 @@
+From 72f7ded1f27e7d14b7efb7200b43e320f3e245d4 Mon Sep 17 00:00:00 2001
+From: Kimmo Myllyvirta <kimmo.myllyvirta@gmail.com>
+Date: Tue, 10 Oct 2017 16:40:41 +0300
+Subject: bcrypt: Initial implementation for RSA key import and signature
+ verification.
+
+---
+ dlls/bcrypt/bcrypt_main.c | 128 ++++++++++++++++++++++++++++++++++++++++++----
+ include/bcrypt.h          |  17 ++++++
+ 2 files changed, 135 insertions(+), 10 deletions(-)
+
+diff --git a/dlls/bcrypt/bcrypt_main.c b/dlls/bcrypt/bcrypt_main.c
+index 881f6f7eb0c..3356364a6dc 100644
+--- a/dlls/bcrypt/bcrypt_main.c
++++ b/dlls/bcrypt/bcrypt_main.c
+@@ -71,6 +71,9 @@ static int (*pgnutls_pubkey_verify_hash2)(gnutls_pubkey_t key, gnutls_sign_algor
+                                           unsigned int flags, const gnutls_datum_t *hash,
+                                           const gnutls_datum_t *signature);
+ 
++/* Not present in gnutls version < 2.11.0 */
++static int (*pgnutls_pubkey_import_rsa_raw)(gnutls_pubkey_t key, const gnutls_datum_t *m, const gnutls_datum_t *e);
++
+ static void *libgnutls_handle;
+ #define MAKE_FUNCPTR(f) static typeof(f) * p##f
+ MAKE_FUNCPTR(gnutls_cipher_decrypt2);
+@@ -121,6 +124,11 @@ static int compat_gnutls_pubkey_verify_hash2(gnutls_pubkey_t key, gnutls_sign_al
+     return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
+ }
+ 
++static int compat_gnutls_pubkey_import_rsa_raw(gnutls_pubkey_t key, const gnutls_datum_t *m, const gnutls_datum_t *e)
++{
++    return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
++}
++
+ static void gnutls_log( int level, const char *msg )
+ {
+     TRACE( "<%d> %s", level, msg );
+@@ -181,6 +189,11 @@ static BOOL gnutls_initialize(void)
+         WARN("gnutls_pubkey_verify_hash2 not found\n");
+         pgnutls_pubkey_verify_hash2 = compat_gnutls_pubkey_verify_hash2;
+     }
++    if (!(pgnutls_pubkey_import_rsa_raw = wine_dlsym( libgnutls_handle, "gnutls_pubkey_import_rsa_raw", NULL, 0 )))
++    {
++        WARN("gnutls_pubkey_import_rsa_raw not found\n");
++        pgnutls_pubkey_import_rsa_raw = compat_gnutls_pubkey_import_rsa_raw;
++    }
+ 
+     if ((ret = pgnutls_global_init()) != GNUTLS_E_SUCCESS)
+     {
+@@ -234,6 +247,7 @@ enum alg_id
+     ALG_ID_AES,
+     ALG_ID_MD5,
+     ALG_ID_RNG,
++    ALG_ID_RSA,
+     ALG_ID_SHA1,
+     ALG_ID_SHA256,
+     ALG_ID_SHA384,
+@@ -262,6 +276,7 @@ static const struct {
+     /* ALG_ID_AES    */     {  654,    0,    0, BCRYPT_AES_ALGORITHM,        TRUE  },
+     /* ALG_ID_MD5    */     {  274,   16,  512, BCRYPT_MD5_ALGORITHM,        FALSE },
+     /* ALG_ID_RNG    */     {    0,    0,    0, BCRYPT_RNG_ALGORITHM,        FALSE },
++    /* ALG_ID_RSA    */     {    0,    0,    0, BCRYPT_RSA_ALGORITHM,        FALSE },
+     /* ALG_ID_SHA1   */     {  278,   20,  512, BCRYPT_SHA1_ALGORITHM,       FALSE },
+     /* ALG_ID_SHA256 */     {  286,   32,  512, BCRYPT_SHA256_ALGORITHM,     FALSE },
+     /* ALG_ID_SHA384 */     {  382,   48, 1024, BCRYPT_SHA384_ALGORITHM,     FALSE },
+@@ -340,6 +355,7 @@ NTSTATUS WINAPI BCryptOpenAlgorithmProvider( BCRYPT_ALG_HANDLE *handle, LPCWSTR
+     if (!strcmpW( id, BCRYPT_AES_ALGORITHM )) alg_id = ALG_ID_AES;
+     else if (!strcmpW( id, BCRYPT_MD5_ALGORITHM )) alg_id = ALG_ID_MD5;
+     else if (!strcmpW( id, BCRYPT_RNG_ALGORITHM )) alg_id = ALG_ID_RNG;
++    else if (!strcmpW( id, BCRYPT_RSA_ALGORITHM )) alg_id = ALG_ID_RSA;
+     else if (!strcmpW( id, BCRYPT_SHA1_ALGORITHM )) alg_id = ALG_ID_SHA1;
+     else if (!strcmpW( id, BCRYPT_SHA256_ALGORITHM )) alg_id = ALG_ID_SHA256;
+     else if (!strcmpW( id, BCRYPT_SHA384_ALGORITHM )) alg_id = ALG_ID_SHA384;
+@@ -950,6 +966,7 @@ static NTSTATUS key_asymmetric_init( struct key *key, struct algorithm *alg, con
+     {
+     case ALG_ID_ECDSA_P256:
+     case ALG_ID_ECDSA_P384:
++    case ALG_ID_RSA:
+         break;
+ 
+     default:
+@@ -1326,6 +1343,34 @@ static NTSTATUS import_gnutls_pubkey_ecc( struct key *key, gnutls_pubkey_t *gnut
+     return STATUS_SUCCESS;
+ }
+ 
++static NTSTATUS import_gnutls_pubkey_rsa( struct key *key, gnutls_pubkey_t *gnutls_key )
++{
++    BCRYPT_RSAKEY_BLOB *rsa_blob;
++    gnutls_datum_t m, e;
++    int ret;
++
++    if ((ret = pgnutls_pubkey_init( gnutls_key )))
++    {
++        pgnutls_perror( ret );
++        return STATUS_INTERNAL_ERROR;
++    }
++
++    rsa_blob = (BCRYPT_RSAKEY_BLOB *)key->u.a.pubkey;
++    e.data = key->u.a.pubkey + sizeof(*rsa_blob);
++    e.size = rsa_blob->cbPublicExp;
++    m.data = key->u.a.pubkey + sizeof(*rsa_blob) + rsa_blob->cbPublicExp;
++    m.size = rsa_blob->cbModulus;
++
++    if ((ret = pgnutls_pubkey_import_rsa_raw( *gnutls_key, &m, &e )))
++    {
++        pgnutls_perror( ret );
++        pgnutls_pubkey_deinit( *gnutls_key );
++        return STATUS_INTERNAL_ERROR;
++    }
++
++    return STATUS_SUCCESS;
++}
++
+ static NTSTATUS import_gnutls_pubkey( struct key *key,  gnutls_pubkey_t *gnutls_key)
+ {
+     switch (key->alg_id)
+@@ -1333,6 +1378,8 @@ static NTSTATUS import_gnutls_pubkey( struct key *key,  gnutls_pubkey_t *gnutls_
+         case ALG_ID_ECDSA_P256:
+         case ALG_ID_ECDSA_P384:
+             return import_gnutls_pubkey_ecc( key, gnutls_key );
++        case ALG_ID_RSA:
++            return import_gnutls_pubkey_rsa( key, gnutls_key );
+ 
+         default:
+             FIXME("Algorithm %d not yet supported\n", key->alg_id);
+@@ -1362,6 +1409,14 @@ static NTSTATUS prepare_gnutls_signature_ecc( struct key *key, UCHAR *signature,
+     return STATUS_SUCCESS;
+ }
+ 
++static NTSTATUS prepare_gnutls_signature_rsa( struct key *key, UCHAR *signature, ULONG signature_len,
++                                              gnutls_datum_t *gnutls_signature )
++{
++    gnutls_signature->data = signature;
++    gnutls_signature->size = signature_len;
++    return STATUS_SUCCESS;
++}
++
+ static NTSTATUS prepare_gnutls_signature( struct key *key, UCHAR *signature, ULONG signature_len,
+                                           gnutls_datum_t *gnutls_signature )
+ {
+@@ -1370,6 +1425,8 @@ static NTSTATUS prepare_gnutls_signature( struct key *key, UCHAR *signature, ULO
+         case ALG_ID_ECDSA_P256:
+         case ALG_ID_ECDSA_P384:
+             return prepare_gnutls_signature_ecc( key, signature, signature_len, gnutls_signature );
++        case ALG_ID_RSA:
++            return prepare_gnutls_signature_rsa( key, signature, signature_len, gnutls_signature );
+ 
+         default:
+             FIXME( "Algorithm %d not yet supported\n", key->alg_id );
+@@ -1388,18 +1445,38 @@ static NTSTATUS key_asymmetric_verify( struct key *key, void *padding, UCHAR *ha
+     NTSTATUS status;
+     int ret;
+ 
+-    if (flags)
+-        FIXME( "Flags %08x not supported\n", flags );
++    if (key->alg_id == ALG_ID_RSA)
++    {
++        BCRYPT_PKCS1_PADDING_INFO *pinfo = (BCRYPT_PKCS1_PADDING_INFO *)padding;
+ 
+-    /* only the hash size must match, not the actual hash function */
+-    switch (hash_len)
++        if (!(flags & BCRYPT_PAD_PKCS1) || !pinfo) return STATUS_INVALID_PARAMETER;
++        if (!pinfo->pszAlgId) return STATUS_INVALID_SIGNATURE;
++
++        if (!strcmpW( pinfo->pszAlgId, BCRYPT_SHA1_ALGORITHM )) hash_algo = GNUTLS_DIG_SHA1;
++        else if (!strcmpW( pinfo->pszAlgId, BCRYPT_SHA256_ALGORITHM )) hash_algo = GNUTLS_DIG_SHA256;
++        else if (!strcmpW( pinfo->pszAlgId, BCRYPT_SHA384_ALGORITHM )) hash_algo = GNUTLS_DIG_SHA384;
++        else if (!strcmpW( pinfo->pszAlgId, BCRYPT_SHA512_ALGORITHM )) hash_algo = GNUTLS_DIG_SHA512;
++        else
++        {
++            FIXME( "Hash algorithm %s not supported\n", debugstr_w(pinfo->pszAlgId) );
++            return STATUS_NOT_SUPPORTED;
++        }
++    }
++    else
+     {
+-        case 32: hash_algo = GNUTLS_DIG_SHA256; break;
+-        case 48: hash_algo = GNUTLS_DIG_SHA384; break;
++        if (flags)
++            FIXME( "Flags %08x not supported\n", flags );
+ 
+-        default:
+-            FIXME( "Hash size %u not yet supported\n", hash_len );
+-            return STATUS_INVALID_SIGNATURE;
++        /* only the hash size must match, not the actual hash function */
++        switch (hash_len)
++        {
++            case 32: hash_algo = GNUTLS_DIG_SHA256; break;
++            case 48: hash_algo = GNUTLS_DIG_SHA384; break;
++
++            default:
++                FIXME( "Hash size %u not yet supported\n", hash_len );
++                return STATUS_INVALID_SIGNATURE;
++        }
+     }
+ 
+     switch (key->alg_id)
+@@ -1408,6 +1485,9 @@ static NTSTATUS key_asymmetric_verify( struct key *key, void *padding, UCHAR *ha
+         case ALG_ID_ECDSA_P384:
+             pk_algo = GNUTLS_PK_ECC;
+             break;
++        case ALG_ID_RSA:
++            pk_algo = GNUTLS_PK_RSA;
++            break;
+ 
+         default:
+             FIXME( "Algorithm %d not yet supported\n", key->alg_id );
+@@ -1433,7 +1513,8 @@ static NTSTATUS key_asymmetric_verify( struct key *key, void *padding, UCHAR *ha
+     gnutls_hash.size = hash_len;
+     ret = pgnutls_pubkey_verify_hash2( gnutls_key, sign_algo, 0, &gnutls_hash, &gnutls_signature );
+ 
+-    HeapFree( GetProcessHeap(), 0, gnutls_signature.data );
++    if (gnutls_signature.data != signature)
++        HeapFree( GetProcessHeap(), 0, gnutls_signature.data );
+     pgnutls_pubkey_deinit( gnutls_key );
+     return (ret < 0) ? STATUS_INVALID_SIGNATURE : STATUS_SUCCESS;
+ }
+@@ -1774,6 +1855,33 @@ NTSTATUS WINAPI BCryptImportKeyPair( BCRYPT_ALG_HANDLE algorithm, BCRYPT_KEY_HAN
+         *ret_key = key;
+         return STATUS_SUCCESS;
+     }
++    else if (!strcmpW( type, BCRYPT_RSAPUBLIC_BLOB ))
++    {
++        BCRYPT_RSAKEY_BLOB *rsa_blob = (BCRYPT_RSAKEY_BLOB *)input;
++
++        if (input_len < sizeof(*rsa_blob))
++            return STATUS_INVALID_PARAMETER;
++
++        if (alg->id != ALG_ID_RSA)
++            return STATUS_NOT_SUPPORTED;
++
++        if (rsa_blob->Magic != BCRYPT_RSAPUBLIC_MAGIC)
++            return STATUS_NOT_SUPPORTED;
++
++        if (!(key = HeapAlloc( GetProcessHeap(), 0, sizeof(*key) )))
++            return STATUS_NO_MEMORY;
++
++        key->hdr.magic = MAGIC_KEY;
++        if ((status = key_asymmetric_init( key, alg, (BYTE *)rsa_blob,
++                sizeof(*rsa_blob) + rsa_blob->cbPublicExp + rsa_blob->cbModulus )))
++        {
++            HeapFree( GetProcessHeap(), 0, key );
++            return status;
++        }
++
++        *ret_key = key;
++        return STATUS_SUCCESS;
++    }
+ 
+     FIXME( "unsupported key type %s\n", debugstr_w(type) );
+     return STATUS_NOT_SUPPORTED;
+diff --git a/include/bcrypt.h b/include/bcrypt.h
+index 3dcc953e9ed..944796024bf 100644
+--- a/include/bcrypt.h
++++ b/include/bcrypt.h
+@@ -63,6 +63,8 @@ typedef LONG NTSTATUS;
+ #define BCRYPT_AES_WRAP_KEY_BLOB (const WCHAR []){'R','f','c','3','5','6','5','K','e','y','W','r','a','p','B','l','o','b',0}
+ #define BCRYPT_ECCPUBLIC_BLOB    (const WCHAR []){'E','C','C','P','U','B','L','I','C','B','L','O','B',0}
+ #define BCRYPT_ECCPRIVATE_BLOB   (const WCHAR []){'E','C','C','P','R','I','V','A','T','E','B','L','O','B',0}
++#define BCRYPT_RSAPUBLIC_BLOB    (const WCHAR []){'R','S','A','P','U','B','L','I','C','B','L','O','B',0}
++#define BCRYPT_RSAPRIVATE_BLOB   (const WCHAR []){'R','S','A','P','R','I','V','A','T','E','B','L','O','B',0}
+ 
+ #define MS_PRIMITIVE_PROVIDER (const WCHAR [])\
+     {'M','i','c','r','o','s','o','f','t',' ','P','r','i','m','i','t','i','v','e',' ','P','r','o','v','i','d','e','r',0}
+@@ -72,6 +74,7 @@ typedef LONG NTSTATUS;
+ #define BCRYPT_AES_ALGORITHM        (const WCHAR []){'A','E','S',0}
+ #define BCRYPT_MD5_ALGORITHM        (const WCHAR []){'M','D','5',0}
+ #define BCRYPT_RNG_ALGORITHM        (const WCHAR []){'R','N','G',0}
++#define BCRYPT_RSA_ALGORITHM        (const WCHAR []){'R','S','A',0}
+ #define BCRYPT_SHA1_ALGORITHM       (const WCHAR []){'S','H','A','1',0}
+ #define BCRYPT_SHA256_ALGORITHM     (const WCHAR []){'S','H','A','2','5','6',0}
+ #define BCRYPT_SHA384_ALGORITHM     (const WCHAR []){'S','H','A','3','8','4',0}
+@@ -138,6 +141,20 @@ typedef struct _BCRYPT_ECCKEY_BLOB
+     ULONG cbKey;
+ } BCRYPT_ECCKEY_BLOB, *PBCRYPT_ECCKEY_BLOB;
+ 
++#define BCRYPT_RSAPUBLIC_MAGIC      0x31415352
++#define BCRYPT_RSAPRIVATE_MAGIC     0x32415352
++#define BCRYPT_RSAFULLPRIVATE_MAGIC 0x33415352
++
++typedef struct _BCRYPT_RSAKEY_BLOB
++{
++    ULONG Magic;
++    ULONG BitLength;
++    ULONG cbPublicExp;
++    ULONG cbModulus;
++    ULONG cbPrime1;
++    ULONG cbPrime2;
++} BCRYPT_RSAKEY_BLOB;
++
+ typedef struct _BCRYPT_PKCS1_PADDING_INFO
+ {
+     LPCWSTR pszAlgId;
+-- 
+2.14.1
+