Skip to content

Commit 03ac6e3

Browse files
vcsjonesvcsjones
committed
Pe testing (#12)
* Work in progress for examining the PE layout. * Added certificate padding rule. This rule looks for data past the PKCS#7 structure in WIN_CERTIFICATE.
1 parent 779057a commit 03ac6e3

File tree

9 files changed

+419
-23
lines changed

9 files changed

+419
-23
lines changed

‎AuthenticodeLint/AuthenticodeLint.csproj‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,17 +53,20 @@
5353
<Reference Include="System.Xml" />
5454
</ItemGroup>
5555
<ItemGroup>
56+
<Compile Include="CertificatePaddingExtractor.cs" />
5657
<Compile Include="CheckEngine.cs" />
5758
<Compile Include="CommandLineParser.cs" />
5859
<Compile Include="ConfigurationValidator.cs" />
5960
<Compile Include="Interop\CertStoreSafeHandle.cs" />
6061
<Compile Include="Interop\Crypt32.cs" />
6162
<Compile Include="Interop\CryptMsgSafeHandle.cs" />
6263
<Compile Include="Interop\LocalBufferSafeHandle.cs" />
64+
<Compile Include="Interop\Pe.cs" />
6365
<Compile Include="Interop\Wintrust.cs" />
6466
<Compile Include="IRuleResultCollector.cs" />
6567
<Compile Include="KnownGuids.cs" />
6668
<Compile Include="KnownOids.cs" />
69+
<Compile Include="PE\PortableExecutable.cs" />
6770
<Compile Include="PublisherInformation.cs" />
6871
<Compile Include="Rfc3161Signature.cs" />
6972
<Compile Include="Rules\IAuthenticodeRule.cs" />
@@ -78,6 +81,7 @@
7881
<Compile Include="Rules\SigningCertificateDigestAlgorithmRule.cs" />
7982
<Compile Include="Rules\TimestampedRule.cs" />
8083
<Compile Include="Rules\TrustedSignatureRule.cs" />
84+
<Compile Include="Rules\WinCertificatePaddingRule.cs" />
8185
<Compile Include="Signature.cs" />
8286
<Compile Include="SignatureExtractor.cs" />
8387
<Compile Include="Graph.cs" />

‎AuthenticodeLint/CertificatePaddingExtractor.cs‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
using AuthenticodeLint.PE;
2+
using System;
3+
using System.IO;
4+
using System.Security.Cryptography.Pkcs;
5+
6+
namespace AuthenticodeLint
7+
{
8+
public static class CertificatePaddingExtractor
9+
{
10+
public static byte[] ExtractPadding(string filePath)
11+
{
12+
using (var file = new PortableExecutable(filePath))
13+
{
14+
var dosHeader = file.GetDosHeader();
15+
var peHeader = file.GetPEHeader(dosHeader);
16+
var signatureLocation = peHeader.DataDirectories[ImageDataDirectoryEntry.IMAGE_DIRECTORY_ENTRY_SECURITY];
17+
using (var signatureData = file.ReadDataDirectory(signatureLocation))
18+
{
19+
using (var reader = new BinaryReader(signatureData))
20+
{
21+
var winCertLength = reader.ReadUInt32();
22+
var winCertRevision = reader.ReadUInt16();
23+
var winCertType = reader.ReadUInt16();
24+
if (winCertRevision != 0x200 && winCertRevision != 0x100)
25+
{
26+
return null;
27+
}
28+
if (winCertType != 0x0002)
29+
{
30+
return null;
31+
}
32+
using (var memoryStream = new MemoryStream())
33+
{
34+
int read;
35+
var buffer = new byte[0x1000];
36+
while ((read = reader.Read(buffer, 0, buffer.Length)) > 0)
37+
{
38+
memoryStream.Write(buffer, 0, read);
39+
}
40+
var winCertificate = memoryStream.ToArray();
41+
var signer = new SignedCms();
42+
signer.Decode(winCertificate);
43+
var roundTrip = signer.Encode();
44+
var sizeDifference = winCertificate.Length - roundTrip.Length;
45+
var difference = new byte[sizeDifference];
46+
Buffer.BlockCopy(winCertificate, roundTrip.Length, difference, 0, difference.Length);
47+
return difference;
48+
}
49+
}
50+
}
51+
}
52+
}
53+
}
54+
}

‎AuthenticodeLint/CheckEngine.cs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@ public IReadOnlyList<IAuthenticodeRule> GetRules()
2323
new PublisherInformationPresentRule(),
2424
new PublisherInformationUrlHttpsRule(),
2525
new SigningCertificateDigestAlgorithmRule(),
26-
new TrustedSignatureRule()
26+
new TrustedSignatureRule(),
27+
new WinCertificatePaddingRule()
2728
};
2829
}
2930

‎AuthenticodeLint/Interop/Pe.cs‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
using System.Runtime.InteropServices;
2+
3+
namespace AuthenticodeLint.Interop
4+
{
5+
[type: StructLayout(LayoutKind.Sequential, Pack = 4)]
6+
internal struct IMAGE_DOS_HEADER
7+
{
8+
public ushort e_magic;
9+
public ushort e_cblp;
10+
public ushort e_cp;
11+
public ushort e_crlc;
12+
public ushort e_cparhdr;
13+
public ushort e_minalloc;
14+
public ushort e_maxalloc;
15+
public ushort e_ss;
16+
public ushort e_sp;
17+
public ushort e_csum;
18+
public ushort e_ip;
19+
public ushort e_cs;
20+
public ushort e_lfarlc;
21+
public ushort e_ovno;
22+
public unsafe fixed ushort e_res[4];
23+
public ushort e_oemid;
24+
public ushort e_oeminfo;
25+
public unsafe fixed ushort e_res2[10];
26+
public int e_lfanew;
27+
}
28+
29+
[type: StructLayout(LayoutKind.Sequential, Size = 20, Pack = 4)]
30+
internal struct IMAGE_FILE_HEADER
31+
{
32+
public ushort Machine;
33+
public ushort NumberOfSections;
34+
public uint TimeDateStamp;
35+
public uint PointerToSymbolTable;
36+
public uint NumberOfSymbols;
37+
public ushort SizeOfOptionalHeader;
38+
public ushort Characteristics;
39+
}
40+
41+
[type: StructLayout(LayoutKind.Sequential, Pack = 4)]
42+
internal struct IMAGE_OPTIONAL_HEADER32
43+
{
44+
public ushort Magic;
45+
public byte MajorLinkerVersion;
46+
public byte MinorLinkerVersion;
47+
public uint SizeOfCode;
48+
public uint SizeOfInitializedData;
49+
public uint SizeOfUninitializedData;
50+
public uint AddressOfEntryPoint;
51+
public uint BaseOfCode;
52+
public uint BaseOfData;
53+
public uint ImageBase;
54+
public uint SectionAlignment;
55+
public uint FileAlignment;
56+
public ushort MajorOperatingSystemVersion;
57+
public ushort MinorOperatingSystemVersion;
58+
public ushort MajorImageVersion;
59+
public ushort MinorImageVersion;
60+
public ushort MajorSubsystemVersion;
61+
public ushort MinorSubsystemVersion;
62+
public uint Win32VersionValue;
63+
public uint SizeOfImage;
64+
public uint SizeOfHeaders;
65+
public uint CheckSum;
66+
public ushort Subsystem;
67+
public ushort DllCharacteristics;
68+
public uint SizeOfStackReserve;
69+
public uint SizeOfStackCommit;
70+
public uint SizeOfHeapReserve;
71+
public uint SizeOfHeapCommit;
72+
public uint LoaderFlags;
73+
public uint NumberOfRvaAndSizes;
74+
//Remove data directory.
75+
}
76+
77+
[type: StructLayout(LayoutKind.Sequential, Pack = 4)]
78+
internal struct IMAGE_OPTIONAL_HEADER64
79+
{
80+
public ushort Magic;
81+
public byte MajorLinkerVersion;
82+
public byte MinorLinkerVersion;
83+
public uint SizeOfCode;
84+
public uint SizeOfInitializedData;
85+
public uint SizeOfUninitializedData;
86+
public uint AddressOfEntryPoint;
87+
public uint BaseOfCode;
88+
public ulong ImageBase;
89+
public uint SectionAlignment;
90+
public uint FileAlignment;
91+
public ushort MajorOperatingSystemVersion;
92+
public ushort MinorOperatingSystemVersion;
93+
public ushort MajorImageVersion;
94+
public ushort MinorImageVersion;
95+
public ushort MajorSubsystemVersion;
96+
public ushort MinorSubsystemVersion;
97+
public uint Win32VersionValue;
98+
public uint SizeOfImage;
99+
public uint SizeOfHeaders;
100+
public uint CheckSum;
101+
public ushort Subsystem;
102+
public ushort DllCharacteristics;
103+
public ulong SizeOfStackReserve;
104+
public ulong SizeOfStackCommit;
105+
public ulong SizeOfHeapReserve;
106+
public ulong SizeOfHeapCommit;
107+
public uint LoaderFlags;
108+
public uint NumberOfRvaAndSizes;
109+
//Remove data directory.
110+
}
111+
112+
[type: StructLayout(LayoutKind.Sequential, Pack = 4)]
113+
public struct IMAGE_DATA_DIRECTORY
114+
{
115+
public uint VirtualAddress;
116+
public uint Size;
117+
}
118+
119+
[type: StructLayout(LayoutKind.Sequential, Pack = 4)]
120+
public struct IMAGE_SECTION_HEADER
121+
{
122+
public unsafe fixed byte Name[8];
123+
public uint PhysicalAddressOrVirtualSize;
124+
public uint VirtualAddress;
125+
public uint SizeOfRawData;
126+
public uint PointerToRawData;
127+
public uint PointerToRelocations;
128+
public uint PointerToLinenumbers;
129+
public ushort NumberOfRelocations;
130+
public ushort NumberOfLinenumbers;
131+
public uint Characteristics;
132+
}
133+
}

0 commit comments

Comments
 (0)