mirror of
https://github.com/QuasarApp/LIEF.git
synced 2025-04-28 05:14:33 +00:00
535623de3a
- Allow UTF8String and IA5String types when parsing the Issuer fields (previously only PrintableString types were handled). Handling these three types should be sufficient, based on the default types indicated at https://github.com/ARMmbed/mbedtls/blob/master/library/x509_create.c#L52. The approach used is similar to what's done in mbedtls's internal x509_get_attr_type_value function. Examples: ``` 8a364e0881fd7201cd6f0a0ff747451c9b93182d5699afb28ad8466f7f726660: SEQUENCE (4 elem) SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.6 countryName (X.520 DN component) PrintableString PL SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.10 organizationName (X.520 DN component) UTF8String Unizeto Technologies S.A. SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.11 organizationalUnitName (X.520 DN component) UTF8String Certum Certification Authority SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.3 commonName (X.520 DN component) UTF8String Certum Code Signing CA SHA2 From a test binary compiled with osslsigncode: SEQUENCE (6 elem) SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.6 countryName (X.520 DN component) PrintableString US SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.8 stateOrProvinceName (X.520 DN component) UTF8String State SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.7 localityName (X.520 DN component) UTF8String City SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.10 organizationName (X.520 DN component) UTF8String Cisco Talos SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.11 organizationalUnitName (X.520 DN component) UTF8String Test CA 1704a8ea9e24d8ed SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 1.2.840.113549.1.9.1 emailAddress (PKCS #9. Deprecated, use an altName extension instead) IA5String rfc2606@example.net ``` - Allow any order for the AuthenticatedAttributes, and ignore ones that aren't recognized. The code was looking for a strict ordering of the attributes, but Windows seems to be OK with any order. Example: ``` From f91e258ea71dcbfc82371b2ee3e20852e45bef0cb946223d1141a6ef1dfb793f: SEQUENCE (2 elem) OBJECT IDENTIFIER 1.3.6.1.4.1.311.2.1.12 spcSpOpusInfo (Microsoft code signing) SET (1 elem) SEQUENCE (0 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 1.2.840.113549.1.9.3 contentType (PKCS #9) SET (1 elem) OBJECT IDENTIFIER 1.3.6.1.4.1.311.2.1.4 spcIndirectDataContext (Microsoft code signing) SEQUENCE (2 elem) OBJECT IDENTIFIER 1.3.6.1.4.1.311.2.1.11 spcStatementType (Microsoft code signing) SET (1 elem) SEQUENCE (1 elem) OBJECT IDENTIFIER 1.3.6.1.4.1.311.2.1.21 individualCodeSigning (Microsoft) SEQUENCE (2 elem) OBJECT IDENTIFIER 1.2.840.113549.1.9.4 messageDigest (PKCS #9) SET (1 elem) OCTET STRING (20 byte) 7C87D331C6E62C0EC840BC23CA63FBC2CE68586F ``` - Allow the program name and/or more info to be missing from SpcSpOpusInfo. Examples: ``` 8a364e0881fd7201cd6f0a0ff747451c9b93182d5699afb28ad8466f7f726660: SEQUENCE (2 elem) OBJECT IDENTIFIER 1.3.6.1.4.1.311.2.1.12 spcSpOpusInfo (Microsoft code signing) SET (1 elem) SEQUENCE (0 elem) 0059fb3f225c5784789622eeccb97197d591972851b63d59f5bd107ddfdb7a21: SEQUENCE (2 elem) OBJECT IDENTIFIER 1.3.6.1.4.1.311.2.1.12 spcSpOpusInfo (Microsoft code signing) SET (1 elem) SEQUENCE (1 elem) [0] (1 elem) [0] (22 byte) 0047006F0054006F0020004F00700065006E00650072 ``` - I removed the #if 0 ContentInfo from being populated, and the code worked with all of the test samples I used... Is there another reason this code is commented out? - The authenticated_attribytes content_name_ member now gets populated. This was commented out with a TODO by it... Is there a reason this field wasn't being populated? - When the SignerInfo is printed, it will now show 'N/A' if no value was parsed out from the executable
About
The purpose of this project is to provide a cross platform library which can parse, modify and abstract ELF, PE and MachO formats.
Main features:
- Parsing: LIEF can parse ELF, PE, MachO, OAT, DEX, VDEX, ART and provides an user-friendly API to access to format internals.
- Modify: LIEF enables to modify some parts of these formats
- Abstract: Three formats have common features like sections, symbols, entry point... LIEF factors them.
- API: LIEF can be used in C, C++ and Python
Content
Downloads / Install
First make sur to have an updated version of setuptools:
pip install setuptools --upgrade
To install the latest version (release):
pip install lief
To install nightlty build:
pip install [--user] --index-url https://lief-project.github.io/packages lief
Packages
 | |||
| Linux | Windows - x86 | Windows - x86-64 | OSX |
|---|---|---|---|
| SDK | SDK | SDK | SDK |
| |||||
| Linux | Windows | OSX | CentOS | Android | Documentation |
|---|---|---|---|---|---|
| SDK |
SDK - x86
SDK - x86-64 |
SDK | SDK |
SDK - x86-64
SDK - x86 SDK - ARM SDK - AARCH64 |
Sphinx + Doxygen |
Here one can find guides to install or integrate LIEF:
Getting started
Python
C++
C
Documentation
Contact
- Mail: lief at quarkslab com
- Gitter: lief-project
About
Authors
Romain Thomas (@rh0main) - Quarkslab
License
LIEF is provided under the Apache 2.0 license.
Bibtex
@MISC {LIEF,
author = "Romain Thomas",
title = "LIEF - Library to Instrument Executable Formats",
howpublished = "https://lief.quarkslab.com/",
month = "April",
year = "2017",
}
