Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for extracting certificates from digitally signed binaries #42

Merged
merged 28 commits into from
Jan 22, 2013

Conversation

jweyrich
Copy link
Contributor

A compact overview of the most important commits on this branch, in reverse order:

8a2a85f pesec: Show all signers and whether certificate signature is valid.
6005050 pesec: Support new CLI parameters --certoutform and --certout.
1d00753 Fix sign conversion warning.
8fa06d3 Parse certificates from digitally signed PE's.
e9accc4 README now contains instructions on how to build in Mac OS X.
8f185fe libpe: Fix missing cert types.
pesec: Handle unsupported/unknown values, and adjust printed data.
f8ace9e libpe: Fix indentation and line-breaks.
fcfe946 libpe: Add very basic support for the security directory.
bbe12bd libpe: Introduce new function pe_get_data_directory().
46a8153 Fix possible memory leaks in pe_get_directories().

Please, review those commits prefixed with "libpe" as they replace some #defines with enums, introduce new APIs, etc.
I felt it would be good to split the headers in order to avoid code duplication (mainly lib/libpe/types.h). Also though it would be positive to have separate headers for specific directory types (example, lib/libpe/dir_entry_security.h), so we don't clutter libpe.h with specifics.

I've tested only on Mac OS X, so I'd love some feedback from various users and systems.

Hope everyone enjoys it.

Logan Lamb and others added 28 commits November 7, 2012 22:42
pesec: Handle unsupported/unknown values, and adjust printed data.
small fix to is_pe so it will work after seeking elsewhere in the file
Declare variables right after usage when possible.
Add peres for work with resources
Fix some formatting.
@jweyrich
Copy link
Contributor Author

Now this PR should merge cleanly against your current master branch.
It does include some extra commits to fix a variety of warnings in peres, but it does not fix other problems. E.g.:

jweyrich@pharao$:pev [* win_certificate]$ ./src/peres -x samples/windows-live-messenger.exe 
Resource Table:                  0x152000 (14224 bytes)

!SAVE RESOURCES!
Save On:                         resources/bitmaps/1.bmp
Save On:                         resources/icons/2.ico
Save On:                         resources/icons/3.ico
Save On:                         resources/icons/4.ico
Save On:                         resources/icons/5.ico
Save On:                         resources/dialogs/6.dlg
Save On:                         resources/groupicons/7.ico
Save On:                         resources/groupicons/8.ico
peres(17206) malloc: *** error for object 0x10f601830: incorrect checksum for freed object - object was probably modified after being freed.
*** set a breakpoint in malloc_error_break to debug
Abort trap: 6

It also seems to enter an infinite loop when trying to extract resources from a specific PE.
If necessary, I can open an issue for each of these including a step-by-step on how to reproduce.

merces added a commit that referenced this pull request Jan 22, 2013
Support for extracting certificates from digitally signed binaries
@merces merces merged commit c840ab5 into mentebinaria:master Jan 22, 2013
@marcelomf
Copy link

Nice work jweyrich! Thank you for testing and understand code of peres.
Please, send me PEs, by email or file sharing.
[]s

@jweyrich
Copy link
Contributor Author

@marcelomf, I uploaded 2 PE samples to Dropbox and shared the folder with you. You probably got an email about it. If you prefer, I can upload it elsewhere. Just let me know.

  1. The 1st bug I mentioned seems to be fixed by a368dd3.
  2. The infinite loop is pending. I tested it under gdb and found that it occurs in lastNodeByTypeAndLevel. Looks like currentNode = currentNode->lastNode results in a circular reference at some point during the traversal, therefore the while-loop never ends. This is definitely something that would require me to study your data structure, so I'd be glad if you could take a look at this - If you accept a suggestion, I'd start by recursively printing out all NODE_PERES to find where the circular reference is (supposing I'm correct about it).
  3. If this is not asking too much, it would be nice to have a simple documentation explaining how your NODE_PERES structure should look like after parsing a simple PE that contains enough resources to exemplify.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants