mirror of
https://github.com/openziti/desktop-edge-win.git
synced 2026-10-15 17:11:19 +00:00
dovholuknf
1c596661b7
* rename checkers -> Checkers * add SignedFile verifier and use it to verify the signed file
539 lines
17 KiB
C#
539 lines
17 KiB
C#
using System;
|
|
using System.Runtime.InteropServices;
|
|
|
|
namespace ZitiUpdateService.Checkers.PeFile {
|
|
|
|
//defined by http://www.pinvoke.net/default.aspx/Structures/IMAGE_FILE_HEADER.html
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
public struct IMAGE_FILE_HEADER {
|
|
public UInt16 Machine;
|
|
public UInt16 NumberOfSections;
|
|
public UInt32 TimeDateStamp;
|
|
public UInt32 PointerToSymbolTable;
|
|
public UInt32 NumberOfSymbols;
|
|
public UInt16 SizeOfOptionalHeader;
|
|
public UInt16 Characteristics;
|
|
}
|
|
|
|
//see http://www.pinvoke.net/default.aspx/Structures/IMAGE_OPTIONAL_HEADER32.html
|
|
//defined by http://www.pinvoke.net/default.aspx/Structures/IMAGE_OPTIONAL_HEADER32.html
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
public struct IMAGE_DATA_DIRECTORY {
|
|
public UInt32 VirtualAddress;
|
|
public UInt32 Size;
|
|
}
|
|
|
|
public enum MachineType : ushort {
|
|
Native = 0,
|
|
I386 = 0x014c,
|
|
Itanium = 0x0200,
|
|
x64 = 0x8664
|
|
}
|
|
|
|
public sealed class MagicType {
|
|
public const Int16 IMAGE_NT_OPTIONAL_HDR32_MAGIC = 0x10b;
|
|
public const Int16 IMAGE_NT_OPTIONAL_HDR64_MAGIC = 0x20b;
|
|
}
|
|
|
|
public enum SubSystemType : ushort {
|
|
IMAGE_SUBSYSTEM_UNKNOWN = 0,
|
|
IMAGE_SUBSYSTEM_NATIVE = 1,
|
|
IMAGE_SUBSYSTEM_WINDOWS_GUI = 2,
|
|
IMAGE_SUBSYSTEM_WINDOWS_CUI = 3,
|
|
IMAGE_SUBSYSTEM_POSIX_CUI = 7,
|
|
IMAGE_SUBSYSTEM_WINDOWS_CE_GUI = 9,
|
|
IMAGE_SUBSYSTEM_EFI_APPLICATION = 10,
|
|
IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER = 11,
|
|
IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER = 12,
|
|
IMAGE_SUBSYSTEM_EFI_ROM = 13,
|
|
IMAGE_SUBSYSTEM_XBOX = 14
|
|
|
|
}
|
|
|
|
public enum DllCharacteristicsType : ushort {
|
|
RES_0 = 0x0001,
|
|
RES_1 = 0x0002,
|
|
RES_2 = 0x0004,
|
|
RES_3 = 0x0008,
|
|
IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE = 0x0040,
|
|
IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY = 0x0080,
|
|
IMAGE_DLL_CHARACTERISTICS_NX_COMPAT = 0x0100,
|
|
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION = 0x0200,
|
|
IMAGE_DLLCHARACTERISTICS_NO_SEH = 0x0400,
|
|
IMAGE_DLLCHARACTERISTICS_NO_BIND = 0x0800,
|
|
RES_4 = 0x1000,
|
|
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = 0x2000,
|
|
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = 0x8000
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Explicit)]
|
|
public struct IMAGE_OPTIONAL_HEADER32 {
|
|
[FieldOffset(0)] public ushort Magic;
|
|
|
|
[FieldOffset(2)] public byte MajorLinkerVersion;
|
|
|
|
[FieldOffset(3)] public byte MinorLinkerVersion;
|
|
|
|
[FieldOffset(4)] public uint SizeOfCode;
|
|
|
|
[FieldOffset(8)] public uint SizeOfInitializedData;
|
|
|
|
[FieldOffset(12)] public uint SizeOfUninitializedData;
|
|
|
|
[FieldOffset(16)] public uint AddressOfEntryPoint;
|
|
|
|
[FieldOffset(20)] public uint BaseOfCode;
|
|
|
|
// PE32 contains this additional field
|
|
[FieldOffset(24)] public uint BaseOfData;
|
|
|
|
[FieldOffset(28)] public uint ImageBase;
|
|
|
|
[FieldOffset(32)] public uint SectionAlignment;
|
|
|
|
[FieldOffset(36)] public uint FileAlignment;
|
|
|
|
[FieldOffset(40)] public ushort MajorOperatingSystemVersion;
|
|
|
|
[FieldOffset(42)] public ushort MinorOperatingSystemVersion;
|
|
|
|
[FieldOffset(44)] public ushort MajorImageVersion;
|
|
|
|
[FieldOffset(46)] public ushort MinorImageVersion;
|
|
|
|
[FieldOffset(48)] public ushort MajorSubsystemVersion;
|
|
|
|
[FieldOffset(50)] public ushort MinorSubsystemVersion;
|
|
|
|
[FieldOffset(52)] public uint Win32VersionValue;
|
|
|
|
[FieldOffset(56)] public uint SizeOfImage;
|
|
|
|
[FieldOffset(60)] public uint SizeOfHeaders;
|
|
|
|
[FieldOffset(64)] public uint CheckSum;
|
|
|
|
[FieldOffset(68)] public SubSystemType Subsystem;
|
|
|
|
[FieldOffset(70)] public DllCharacteristicsType DllCharacteristics;
|
|
|
|
[FieldOffset(72)] public uint SizeOfStackReserve;
|
|
|
|
[FieldOffset(76)] public uint SizeOfStackCommit;
|
|
|
|
[FieldOffset(80)] public uint SizeOfHeapReserve;
|
|
|
|
[FieldOffset(84)] public uint SizeOfHeapCommit;
|
|
|
|
[FieldOffset(88)] public uint LoaderFlags;
|
|
|
|
[FieldOffset(92)] public uint NumberOfRvaAndSizes;
|
|
|
|
[FieldOffset(96)] public IMAGE_DATA_DIRECTORY ExportTable;
|
|
|
|
[FieldOffset(104)] public IMAGE_DATA_DIRECTORY ImportTable;
|
|
|
|
[FieldOffset(112)] public IMAGE_DATA_DIRECTORY ResourceTable;
|
|
|
|
[FieldOffset(120)] public IMAGE_DATA_DIRECTORY ExceptionTable;
|
|
|
|
[FieldOffset(128)] public IMAGE_DATA_DIRECTORY CertificateTable;
|
|
|
|
[FieldOffset(136)] public IMAGE_DATA_DIRECTORY BaseRelocationTable;
|
|
|
|
[FieldOffset(144)] public IMAGE_DATA_DIRECTORY Debug;
|
|
|
|
[FieldOffset(152)] public IMAGE_DATA_DIRECTORY Architecture;
|
|
|
|
[FieldOffset(160)] public IMAGE_DATA_DIRECTORY GlobalPtr;
|
|
|
|
[FieldOffset(168)] public IMAGE_DATA_DIRECTORY TLSTable;
|
|
|
|
[FieldOffset(176)] public IMAGE_DATA_DIRECTORY LoadConfigTable;
|
|
|
|
[FieldOffset(184)] public IMAGE_DATA_DIRECTORY BoundImport;
|
|
|
|
[FieldOffset(192)] public IMAGE_DATA_DIRECTORY IAT;
|
|
|
|
[FieldOffset(200)] public IMAGE_DATA_DIRECTORY DelayImportDescriptor;
|
|
|
|
[FieldOffset(208)] public IMAGE_DATA_DIRECTORY CLRRuntimeHeader;
|
|
|
|
[FieldOffset(216)] public IMAGE_DATA_DIRECTORY Reserved;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Explicit)]
|
|
public struct IMAGE_OPTIONAL_HEADER64 {
|
|
[FieldOffset(0)] public ushort Magic;
|
|
|
|
[FieldOffset(2)] public byte MajorLinkerVersion;
|
|
|
|
[FieldOffset(3)] public byte MinorLinkerVersion;
|
|
|
|
[FieldOffset(4)] public uint SizeOfCode;
|
|
|
|
[FieldOffset(8)] public uint SizeOfInitializedData;
|
|
|
|
[FieldOffset(12)] public uint SizeOfUninitializedData;
|
|
|
|
[FieldOffset(16)] public uint AddressOfEntryPoint;
|
|
|
|
[FieldOffset(20)] public uint BaseOfCode;
|
|
|
|
[FieldOffset(24)] public ulong ImageBase;
|
|
|
|
[FieldOffset(32)] public uint SectionAlignment;
|
|
|
|
[FieldOffset(36)] public uint FileAlignment;
|
|
|
|
[FieldOffset(40)] public ushort MajorOperatingSystemVersion;
|
|
|
|
[FieldOffset(42)] public ushort MinorOperatingSystemVersion;
|
|
|
|
[FieldOffset(44)] public ushort MajorImageVersion;
|
|
|
|
[FieldOffset(46)] public ushort MinorImageVersion;
|
|
|
|
[FieldOffset(48)] public ushort MajorSubsystemVersion;
|
|
|
|
[FieldOffset(50)] public ushort MinorSubsystemVersion;
|
|
|
|
[FieldOffset(52)] public uint Win32VersionValue;
|
|
|
|
[FieldOffset(56)] public uint SizeOfImage;
|
|
|
|
[FieldOffset(60)] public uint SizeOfHeaders;
|
|
|
|
[FieldOffset(64)] public uint CheckSum;
|
|
|
|
[FieldOffset(68)] public SubSystemType Subsystem;
|
|
|
|
[FieldOffset(70)] public DllCharacteristicsType DllCharacteristics;
|
|
|
|
[FieldOffset(72)] public ulong SizeOfStackReserve;
|
|
|
|
[FieldOffset(80)] public ulong SizeOfStackCommit;
|
|
|
|
[FieldOffset(88)] public ulong SizeOfHeapReserve;
|
|
|
|
[FieldOffset(96)] public ulong SizeOfHeapCommit;
|
|
|
|
[FieldOffset(104)] public uint LoaderFlags;
|
|
|
|
[FieldOffset(108)] public uint NumberOfRvaAndSizes;
|
|
|
|
[FieldOffset(112)] public IMAGE_DATA_DIRECTORY ExportTable;
|
|
|
|
[FieldOffset(120)] public IMAGE_DATA_DIRECTORY ImportTable;
|
|
|
|
[FieldOffset(128)] public IMAGE_DATA_DIRECTORY ResourceTable;
|
|
|
|
[FieldOffset(136)] public IMAGE_DATA_DIRECTORY ExceptionTable;
|
|
|
|
[FieldOffset(144)] public IMAGE_DATA_DIRECTORY CertificateTable;
|
|
|
|
[FieldOffset(152)] public IMAGE_DATA_DIRECTORY BaseRelocationTable;
|
|
|
|
[FieldOffset(160)] public IMAGE_DATA_DIRECTORY Debug;
|
|
|
|
[FieldOffset(168)] public IMAGE_DATA_DIRECTORY Architecture;
|
|
|
|
[FieldOffset(176)] public IMAGE_DATA_DIRECTORY GlobalPtr;
|
|
|
|
[FieldOffset(184)] public IMAGE_DATA_DIRECTORY TLSTable;
|
|
|
|
[FieldOffset(192)] public IMAGE_DATA_DIRECTORY LoadConfigTable;
|
|
|
|
[FieldOffset(200)] public IMAGE_DATA_DIRECTORY BoundImport;
|
|
|
|
[FieldOffset(208)] public IMAGE_DATA_DIRECTORY IAT;
|
|
|
|
[FieldOffset(216)] public IMAGE_DATA_DIRECTORY DelayImportDescriptor;
|
|
|
|
[FieldOffset(224)] public IMAGE_DATA_DIRECTORY CLRRuntimeHeader;
|
|
|
|
[FieldOffset(232)] public IMAGE_DATA_DIRECTORY Reserved;
|
|
}
|
|
|
|
|
|
[StructLayout(LayoutKind.Explicit)]
|
|
public struct IMAGE_SECTION_HEADER {
|
|
//FROM: http://www.pinvoke.net/default.aspx/Structures/IMAGE_SECTION_HEADER.html
|
|
[FieldOffset(0)] [MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]
|
|
public char[] Name;
|
|
|
|
[FieldOffset(8)] public UInt32 VirtualSize;
|
|
|
|
[FieldOffset(12)] public UInt32 VirtualAddress;
|
|
|
|
[FieldOffset(16)] public UInt32 SizeOfRawData;
|
|
|
|
[FieldOffset(20)] public UInt32 PointerToRawData;
|
|
|
|
[FieldOffset(24)] public UInt32 PointerToRelocations;
|
|
|
|
[FieldOffset(28)] public UInt32 PointerToLinenumbers;
|
|
|
|
[FieldOffset(32)] public UInt16 NumberOfRelocations;
|
|
|
|
[FieldOffset(34)] public UInt16 NumberOfLinenumbers;
|
|
|
|
[FieldOffset(36)] public DataSectionFlags Characteristics;
|
|
|
|
public string Section {
|
|
get { return new string(Name); }
|
|
}
|
|
}
|
|
|
|
[Flags]
|
|
public enum DataSectionFlags : uint {
|
|
//FROM: http://www.pinvoke.net/default.aspx/Structures/IMAGE_SECTION_HEADER.html
|
|
/// <summary>
|
|
/// Reserved for future use.
|
|
/// </summary>
|
|
TypeReg = 0x00000000,
|
|
|
|
/// <summary>
|
|
/// Reserved for future use.
|
|
/// </summary>
|
|
TypeDsect = 0x00000001,
|
|
|
|
/// <summary>
|
|
/// Reserved for future use.
|
|
/// </summary>
|
|
TypeNoLoad = 0x00000002,
|
|
|
|
/// <summary>
|
|
/// Reserved for future use.
|
|
/// </summary>
|
|
TypeGroup = 0x00000004,
|
|
|
|
/// <summary>
|
|
/// The section should not be padded to the next boundary. This flag is obsolete and is replaced by IMAGE_SCN_ALIGN_1BYTES. This is valid only for object files.
|
|
/// </summary>
|
|
TypeNoPadded = 0x00000008,
|
|
|
|
/// <summary>
|
|
/// Reserved for future use.
|
|
/// </summary>
|
|
TypeCopy = 0x00000010,
|
|
|
|
/// <summary>
|
|
/// The section contains executable code.
|
|
/// </summary>
|
|
ContentCode = 0x00000020,
|
|
|
|
/// <summary>
|
|
/// The section contains initialized data.
|
|
/// </summary>
|
|
ContentInitializedData = 0x00000040,
|
|
|
|
/// <summary>
|
|
/// The section contains uninitialized data.
|
|
/// </summary>
|
|
ContentUninitializedData = 0x00000080,
|
|
|
|
/// <summary>
|
|
/// Reserved for future use.
|
|
/// </summary>
|
|
LinkOther = 0x00000100,
|
|
|
|
/// <summary>
|
|
/// The section contains comments or other information. The .drectve section has this type. This is valid for object files only.
|
|
/// </summary>
|
|
LinkInfo = 0x00000200,
|
|
|
|
/// <summary>
|
|
/// Reserved for future use.
|
|
/// </summary>
|
|
TypeOver = 0x00000400,
|
|
|
|
/// <summary>
|
|
/// The section will not become part of the image. This is valid only for object files.
|
|
/// </summary>
|
|
LinkRemove = 0x00000800,
|
|
|
|
/// <summary>
|
|
/// The section contains COMDAT data. For more information, see section 5.5.6, COMDAT Sections (Object Only). This is valid only for object files.
|
|
/// </summary>
|
|
LinkComDat = 0x00001000,
|
|
|
|
/// <summary>
|
|
/// Reset speculative exceptions handling bits in the TLB entries for this section.
|
|
/// </summary>
|
|
NoDeferSpecExceptions = 0x00004000,
|
|
|
|
/// <summary>
|
|
/// The section contains data referenced through the global pointer (GP).
|
|
/// </summary>
|
|
RelativeGP = 0x00008000,
|
|
|
|
/// <summary>
|
|
/// Reserved for future use.
|
|
/// </summary>
|
|
MemPurgeable = 0x00020000,
|
|
|
|
/// <summary>
|
|
/// Reserved for future use.
|
|
/// </summary>
|
|
Memory16Bit = 0x00020000,
|
|
|
|
/// <summary>
|
|
/// Reserved for future use.
|
|
/// </summary>
|
|
MemoryLocked = 0x00040000,
|
|
|
|
/// <summary>
|
|
/// Reserved for future use.
|
|
/// </summary>
|
|
MemoryPreload = 0x00080000,
|
|
|
|
/// <summary>
|
|
/// Align data on a 1-byte boundary. Valid only for object files.
|
|
/// </summary>
|
|
Align1Bytes = 0x00100000,
|
|
|
|
/// <summary>
|
|
/// Align data on a 2-byte boundary. Valid only for object files.
|
|
/// </summary>
|
|
Align2Bytes = 0x00200000,
|
|
|
|
/// <summary>
|
|
/// Align data on a 4-byte boundary. Valid only for object files.
|
|
/// </summary>
|
|
Align4Bytes = 0x00300000,
|
|
|
|
/// <summary>
|
|
/// Align data on an 8-byte boundary. Valid only for object files.
|
|
/// </summary>
|
|
Align8Bytes = 0x00400000,
|
|
|
|
/// <summary>
|
|
/// Align data on a 16-byte boundary. Valid only for object files.
|
|
/// </summary>
|
|
Align16Bytes = 0x00500000,
|
|
|
|
/// <summary>
|
|
/// Align data on a 32-byte boundary. Valid only for object files.
|
|
/// </summary>
|
|
Align32Bytes = 0x00600000,
|
|
|
|
/// <summary>
|
|
/// Align data on a 64-byte boundary. Valid only for object files.
|
|
/// </summary>
|
|
Align64Bytes = 0x00700000,
|
|
|
|
/// <summary>
|
|
/// Align data on a 128-byte boundary. Valid only for object files.
|
|
/// </summary>
|
|
Align128Bytes = 0x00800000,
|
|
|
|
/// <summary>
|
|
/// Align data on a 256-byte boundary. Valid only for object files.
|
|
/// </summary>
|
|
Align256Bytes = 0x00900000,
|
|
|
|
/// <summary>
|
|
/// Align data on a 512-byte boundary. Valid only for object files.
|
|
/// </summary>
|
|
Align512Bytes = 0x00A00000,
|
|
|
|
/// <summary>
|
|
/// Align data on a 1024-byte boundary. Valid only for object files.
|
|
/// </summary>
|
|
Align1024Bytes = 0x00B00000,
|
|
|
|
/// <summary>
|
|
/// Align data on a 2048-byte boundary. Valid only for object files.
|
|
/// </summary>
|
|
Align2048Bytes = 0x00C00000,
|
|
|
|
/// <summary>
|
|
/// Align data on a 4096-byte boundary. Valid only for object files.
|
|
/// </summary>
|
|
Align4096Bytes = 0x00D00000,
|
|
|
|
/// <summary>
|
|
/// Align data on an 8192-byte boundary. Valid only for object files.
|
|
/// </summary>
|
|
Align8192Bytes = 0x00E00000,
|
|
|
|
/// <summary>
|
|
/// The section contains extended relocations.
|
|
/// </summary>
|
|
LinkExtendedRelocationOverflow = 0x01000000,
|
|
|
|
/// <summary>
|
|
/// The section can be discarded as needed.
|
|
/// </summary>
|
|
MemoryDiscardable = 0x02000000,
|
|
|
|
/// <summary>
|
|
/// The section cannot be cached.
|
|
/// </summary>
|
|
MemoryNotCached = 0x04000000,
|
|
|
|
/// <summary>
|
|
/// The section is not pageable.
|
|
/// </summary>
|
|
MemoryNotPaged = 0x08000000,
|
|
|
|
/// <summary>
|
|
/// The section can be shared in memory.
|
|
/// </summary>
|
|
MemoryShared = 0x10000000,
|
|
|
|
/// <summary>
|
|
/// The section can be executed as code.
|
|
/// </summary>
|
|
MemoryExecute = 0x20000000,
|
|
|
|
/// <summary>
|
|
/// The section can be read.
|
|
/// </summary>
|
|
MemoryRead = 0x40000000,
|
|
|
|
/// <summary>
|
|
/// The section can be written to.
|
|
/// </summary>
|
|
MemoryWrite = 0x80000000
|
|
}
|
|
|
|
|
|
public class ImageOptionalHeaderWrapper {
|
|
public IMAGE_OPTIONAL_HEADER32 h32;
|
|
public IMAGE_OPTIONAL_HEADER64 h64;
|
|
public bool IsPe;
|
|
|
|
|
|
public uint CertificateTableVirtualAddress {
|
|
get {
|
|
if (IsPe) {
|
|
return h32.CertificateTable.VirtualAddress;
|
|
} else {
|
|
return h64.CertificateTable.VirtualAddress;
|
|
}
|
|
}
|
|
}
|
|
|
|
public uint CertificateTableSize {
|
|
get {
|
|
if (IsPe) {
|
|
return h32.CertificateTable.Size;
|
|
} else {
|
|
return h64.CertificateTable.Size;
|
|
}
|
|
}
|
|
}
|
|
|
|
public uint SizeOfHeaders {
|
|
get {
|
|
if (IsPe) {
|
|
return h32.SizeOfHeaders;
|
|
} else {
|
|
return h64.SizeOfHeaders;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
} |