Windows: add ARM64 system encryption support

[0x1337F00D]

Summary

This adds Windows system encryption support for the native ARM64 UEFI/GPT boot path. It includes the Windows driver, application, installer, resource-selection and fail-closed handoff changes. The companion bootloader implementation is in VeraCrypt-DCS#47.

Development and validation were performed on Windows 11 ARM64 in a Parallels VM.

Architecture

Native ARM64 boot path

• Builds the Windows boot driver for ARM64.
• Adds tracked AA64 DCS resources and selects them by native machine architecture in Mount, Format, Setup and SetupDLL, including Win32 installer processes running on ARM64 Windows.
• Adds Stage-Dcs.ps1 to stage DCS artifacts deterministically while validating PE machine type (0xAA64) and content hashes.

Explicit DCS handoff

The companion DCS code allocates an owned 4 KiB UEFI runtime page and publishes a small versioned descriptor through a volatile runtime variable. The driver validates protocol magic/version, size, CRC and ownership before copying the bounded boot-argument structure. It then zeroes only the owned page and clears the variable.

The password payload is therefore not intentionally persisted in NVRAM, and the driver does not rely on scanning stale physical addresses.

Fail-closed activation

Arm64BootArgsHandoffRequired is persisted before the first system-encryption transform can make the handoff mandatory. Once required, missing or invalid boot arguments fail closed instead of allowing Windows to continue with an unusable encrypted boot volume.

Normal and rescue decryption clear that requirement only after the final header has been written, flushed, reread and verified as erased. The registry update is flushed before the rescue completion marker is removed, so a crash cannot prematurely disable the handoff requirement.

Validation

Built successfully from the final one-commit tree:

• Driver ARM64 Release: PASS (veracrypt.sys SHA-256 C06AFDF5C6D79A64D8147DF98569C5804D3ACEE4F6E78C76E82EB2EC8603A4CF)
• Mount ARM64 Release: PASS
• Format ARM64 Release: PASS
• Setup Win32 Release: PASS
• SetupDLL Win32 Release: PASS
• Companion DCS AArch64 and x64 Release: PASS with VS2022/EDK2 /W4 /WX

Three consecutive encrypted-system reboots passed in the Parallels ARM64 VM on the preceding evidence build. The final one-commit tree additionally contains narrowly scoped decryption-finalization durability hardening; it was rebuilt and independently reviewed. A second full decrypt/re-encrypt cycle was intentionally omitted to avoid unnecessary repeated full-disk transforms.

Diagnostic builds used during development verified DCS payload CRC, disk identity, header read/salt, KDF/decryption and mounted/encrypted state. Oracle, breadcrumb, stage-limit and lab-only logging code is absent from this PR.

Release integration

Runtime validation used locally test-signed components. Official driver and EFI signing remain part of the VeraCrypt release process; no test certificate, private signing material or signing bypass is included in this PR.

Related work

The mounted-volume direct-I/O optimization is intentionally isolated in #1839.