Add fixed offline CAPI2 chain source probe

scripts/Capi2ProbeWorker.ps1

@@ -0,0 +1,27 @@
+# Fixed local operation. The parent bounds this process to twenty seconds.
+param([Parameter(Mandatory)][ValidatePattern('^[a-f0-9]{32}$')][string]$Nonce)
+$ErrorActionPreference='Stop'
+[Console]::OutputEncoding=[Text.UTF8Encoding]::new($false)
+. (Join-Path $PSScriptRoot 'WmiProbe.ps1')
+. (Join-Path $PSScriptRoot 'Capi2Probe.ps1')
+Initialize-WelaCapi2ProbeNative
+$before=[Wela.WmiProbe.Native]::Snapshot()
+$key=$null;$rsa=$null;$certificate=$null
+try {
+ $parameters=[Security.Cryptography.CngKeyCreationParameters]::new()
+ $parameters.Provider=[Security.Cryptography.CngProvider]::MicrosoftSoftwareKeyStorageProvider
+ $parameters.Parameters.Add([Security.Cryptography.CngProperty]::new('Length',[BitConverter]::GetBytes([int]2048),[Security.Cryptography.CngPropertyOptions]::None))
+ $key=[Security.Cryptography.CngKey]::Create([Security.Cryptography.CngAlgorithm]::Rsa,$null,$parameters)
+ if(-not $key.IsEphemeral -or $key.KeyName){throw 'The generated CNG key is not ephemeral.'}
+ $rsa=[Security.Cryptography.RSACng]::new($key)
+ $request=[Security.Cryptography.X509Certificates.CertificateRequest]::new(('CN=WelaCapi2Probe_'+$Nonce),$rsa,[Security.Cryptography.HashAlgorithmName]::SHA256,[Security.Cryptography.RSASignaturePadding]::Pkcs1)
+ $now=[DateTimeOffset][Wela.WmiProbe.Native]::UtcNow()
+ $certificate=$request.CreateSelfSigned($now.AddMinutes(-5),$now.AddMinutes(5))
+ $der=$certificate.Export([Security.Cryptography.X509Certificates.X509ContentType]::Cert)
+ $started=[Wela.WmiProbe.Native]::UtcNow()
+ $chain=[Wela.Capi2Probe.Native]::Build($der)
+ $completed=[Wela.WmiProbe.Native]::UtcNow()
+ $after=[Wela.WmiProbe.Native]::Snapshot()
+ if((Get-WelaWmiProbeTokenKey $before) -cne (Get-WelaWmiProbeTokenKey $after)){throw 'Worker token changed during the chain build.'}
+ [pscustomobject]@{Nonce=$Nonce;CertificateDerBase64=[Convert]::ToBase64String($der);Thumbprint=$certificate.Thumbprint;Subject=$certificate.Subject;KeyEphemeral=$key.IsEphemeral;ProcessId=$PID;ProcessName=[IO.Path]::GetFileName((Get-Process -Id $PID).Path);StartedUtc=$started.ToString('o');CompletedUtc=$completed.ToString('o');Clock='GetSystemTimePreciseAsFileTime';BeforeToken=$before;AfterToken=$after;Chain=$chain}|ConvertTo-Json -Depth 12 -Compress
+}finally{if($certificate){$certificate.Dispose()};if($rsa){$rsa.Dispose()};if($key){$key.Dispose()}}