Part of Authenticode verification consists of:
- Comparing the computed Authenticode hash to the digest
stored in the ContentInfo section
- Comparing hash(ContentInfo) to the digest stored in the
AuthenticatedAttributes section
- Verifying signed(hash(AuthenticatedAttributes)) using a
certificate identified by the issuer and serial number
specified in the SignerInfo section
This commit makes it so that the raw bytes needed to
calculate hash(ContentInfo) and hash(AuthenticatedAttributes)
are available for use.
============================================================
Allow missing [0] in SpcSpOpusInfo
Some executables have MoreInfo but not a ProgramName (and the documentation
lists both as OPTIONAL), so handle this case correctly.
Example:
```
01416b1730218454c99b13592650cb170402b86742b4bab971565903b841829b
SEQUENCE(2 elem)
OBJECT IDENTIFIER1.3.6.1.4.1.311.2.1.12spcSpOpusInfo(Microsoft code signing)
SET(1 elem)
SEQUENCE(1 elem)
[1](1 elem)
[0]http://www.mozilla.com
```
============================================================
Improve consistency of parsed serial numbers
When parsing the issuer serial number, call mbedtls_x509_get_serial instead of
parsing it as an integer directly with mbedtls_asn1_get_mpi. These two functions
differ in how they treat serial numbers prepended with '00' to prevent them from
being negative (the former preserves the '00', and the latter discards it). The
embedded certs are parsed via a call to mbedtls_x509_crt_parse_der, which uses
mbedtls_x509_get_serial behind the scenes, so there was an inconsistency between
lief_obj.signature.signer_info.issuer[1] and
lief_obj.signature.certificates[x].serial_number. Example:
8bf57d97dd917c4f823659266caaa33e7398406daf11ba8318e3f7414ee3fb24
============================================================
Handle SpcLink and SpcString CHOICEs in SpcSpOpusInfo
The Authenticode spec doc says that these can be CHOICES, so
handle the easy ones and safely skip the others.
============================================================
Allow Authenticode sig to be parsed even if cert parsing fails
By default, mbedtls doesn't support MD2 certs, which are fairly
common in older signed executables. Ex:
1cb16f94cebdcad7dd05c8537375a6ff6379fcdb08528fc83889f26efaa84e2a
============================================================
Enable mbed TLS MD2 and MD4 support; add Unix debug options
By default, mbedtls doesn't support MD2 certs, which are fairly
common in older signed executables. Ex:
1cb16f94cebdcad7dd05c8537375a6ff6379fcdb08528fc83889f26efaa84e2a
============================================================
Set MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION flag
Some older signed executables use certs with the SpcSpAgencyInfo
Critical Extension, which mbed TLS doesn't support, so set
MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION to have it
skip this extension. Example:
781ca31416ec708a587851dafd90c661b86f244ab8b8475c4185e958e54ff838
============================================================
Support accessing non-utf8 issuer names via Python
For a few signatures where the issuer name contained non-utf8
characters, accessing the issuer name field in Python would raise
a UnicodeDecodeError exception. Now this field is handled the
same way the names in the individual certs are (I'm not sure if
they get represented 100% correctly, but at least they are
consistent, which is good enough for me). Example:
048f91b9302c88380fc66adac1e314d82733089ef3a31eadca5f0cb4169b195f
PE's DATA_DIRECTORY_DEBUG does not define a single debug entry, but
a list of struct pe_debug entries (the number of entries is determined
by the data directory's size).
This commit reflect this layout by returning a vector<> when calling
PE.debug()
* JSON visitor are located in the format namespace
* Visitor are *real* visitor
* Visitable class has been renamed to Object
* Due to a bug in Visual Studio 2015, we move to VS2017
The abstracted attributes are:
* Address: virtual address where the relocation occurs
* Size: size in bits of the relocation
See: LIEF::Relocation / lief.Relocation and abstract_reader
Resolve: #53
API changes:
- 'has_dll_characteristics' renamed to 'has'
- 'add' to add a characteristic - added
- 'remove' to remove a characteristic - added
- operator+= to add a characteristic - added
- operator-= to remove a characteristic - added
For PE binary it's now possible get the *imphash* value through the
lief.PE.get_imphash function. It's also possible to resolve ordinals
imports by using the lief.PE.resolve_ordinals
Resolve#54
PE::Binary::get_content_from_virtual_address can now take either:
Absolute Virtual Address / Relative Virtual Address
In the PE Python API:
* Merge 'PE.parse_from_raw' and 'PE.parse'
* Change 'PE.Binary.section_from_virtual_address' to 'PE.Binary.section_from_rva'
In the PE C++ API:
* Change 'Binary::section_from_virtual_address' to 'Binary::section_from_rva'
* Improve Resource Manager
* Fix bug when rebuilding resources (aligment issue)
* Provide a Python API to access to the resource tree
* Pretty print lang/sublang of resources
* Parse resource dialog
* Parse resource icons
* Parse resource version
* Add tests on the resource builder
* Add tutorial (related to #28)
* Add 'hook_function' to hook a PE imported function
* Add tutorial on PE hooking (resolve#5)
* Add 'PE::get_import' and 'PE::has_import' to retrieve import
