mirror of
https://github.com/openziti/desktop-edge-win.git
synced 2026-10-15 09:01:27 +00:00
dovholuknf
608 lines
33 KiB
C#
608 lines
33 KiB
C#
using System;
|
||
using System.Collections.Generic;
|
||
using System.IO;
|
||
using System.Net.Http;
|
||
using System.Runtime.InteropServices;
|
||
using System.Security.Cryptography;
|
||
using System.Security.Cryptography.Pkcs;
|
||
using System.Security.Cryptography.X509Certificates;
|
||
using System.Text;
|
||
using System.Threading.Tasks;
|
||
using NLog;
|
||
using VerifyingFiles.PInvoke;
|
||
|
||
namespace ZitiUpdateService.Checkers.PeFile {
|
||
public class SignedFileValidator {
|
||
private static readonly Logger Logger = LogManager.GetCurrentClassLogger();
|
||
|
||
public const int LengthOfChecksum = 4; //the checksum is 4 bytes
|
||
public const int LengthCertificateTable = 8; //the Certificate Table is 8 bytes
|
||
|
||
public HashPositions ImportantHashPositions { get; private set; }
|
||
public string FilePath { get; private set; }
|
||
public PeType Type { get; private set; }
|
||
public IMAGE_FILE_HEADER CoffHeader { get; private set; }
|
||
public IMAGE_OPTIONAL_HEADER32 StandardFieldsPe32 { get; private set; }
|
||
public IMAGE_OPTIONAL_HEADER64 StandardFieldsPe32Plus { get; private set; }
|
||
|
||
private readonly X509Certificate2 expectedRootCa = null;
|
||
private readonly X509Store empty = new X509Store();
|
||
private X509Store SystemCAs = new X509Store();
|
||
private const string oldKnownThumbprint = "39636E9F5E80308DE370C914CE8112876ECF4E0C";
|
||
|
||
public SignedFileValidator(string pathToFile) {
|
||
X509Store store = new X509Store("MY", StoreLocation.CurrentUser);
|
||
store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);
|
||
SystemCAs.Open(OpenFlags.ReadWrite);
|
||
SystemCAs.AddRange(store.Certificates);
|
||
|
||
expectedRootCa = certFromResource("ZitiUpdateService.checkers.PeFile.openziti.rootCA.rsa.pem.txt");
|
||
FilePath = pathToFile;
|
||
ImportantHashPositions = new HashPositions();
|
||
|
||
parse();
|
||
if (ImportantHashPositions.reorderNeeded) {
|
||
ImportantHashPositions.SectionTableHeaders.Sort((x, y) => x.PointerToRawData.CompareTo(y.PointerToRawData));
|
||
}
|
||
}
|
||
|
||
private X509Certificate2 certFromResource(string resourceName) {
|
||
var assembly = this.GetType().Assembly;
|
||
using (Stream stream = assembly.GetManifestResourceStream(resourceName))
|
||
using (BinaryReader reader = new BinaryReader(stream)) {
|
||
byte[] bytes = new byte[stream.Length];
|
||
stream.Read(bytes, 0, bytes.Length);
|
||
return new X509Certificate2(bytes);
|
||
}
|
||
}
|
||
|
||
// ReSharper disable once InconsistentNaming
|
||
private void parse() {
|
||
using (FileStream stream = new FileStream(FilePath, System.IO.FileMode.Open, System.IO.FileAccess.Read))
|
||
using (BinaryReader reader = new BinaryReader(stream)) {
|
||
|
||
//seek to 0x3c to get right to the PE header location...
|
||
stream.Seek(0x3c, SeekOrigin.Begin);
|
||
uint startCoffHeader = BitConverter.ToUInt32(reader.ReadBytes(4), 0);
|
||
ImportantHashPositions.SetStartCoffHeader(startCoffHeader);
|
||
stream.Seek(startCoffHeader, SeekOrigin.Begin);
|
||
|
||
//parse COFF Header (28 or 24 bytes): https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#coff-file-header-object-and-image
|
||
byte[] coffHeaderBytes = reader.ReadBytes(24);
|
||
CoffHeader = StructHelper.FromBytes<IMAGE_FILE_HEADER>(coffHeaderBytes);
|
||
|
||
byte[] magicNumberBytes = reader.ReadBytes(2);
|
||
int magicNumber = BitConverter.ToInt16(magicNumberBytes, 0);
|
||
Type = magicNumber == 0x10b ? PeType.Pe32 : PeType.Pe32Plus;
|
||
stream.Seek(-2, SeekOrigin.Current); //skip back to before the magic number so the struct below is created properly
|
||
|
||
//parse Optional Header Standard and Windows-Specific fields (66 or 88 bytes)
|
||
//see: https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#optional-header-standard-fields-image-only
|
||
if (Type == PeType.Pe32) {
|
||
byte[] headerBytes = reader.ReadBytes(Marshal.SizeOf(typeof(IMAGE_OPTIONAL_HEADER32)));
|
||
StandardFieldsPe32 = StructHelper.FromBytes<IMAGE_OPTIONAL_HEADER32>(headerBytes);
|
||
} else {
|
||
byte[] headerBytes = reader.ReadBytes(Marshal.SizeOf(typeof(IMAGE_OPTIONAL_HEADER64)));
|
||
StandardFieldsPe32Plus = StructHelper.FromBytes<IMAGE_OPTIONAL_HEADER64>(headerBytes);
|
||
}
|
||
|
||
ImageOptionalHeaderWrapper wrapper = new ImageOptionalHeaderWrapper() {
|
||
h32 = StandardFieldsPe32,
|
||
h64 = StandardFieldsPe32Plus,
|
||
IsPe = Type == PeType.Pe32
|
||
};
|
||
ImportantHashPositions.SetCertificateDetails(Type, wrapper.SizeOfHeaders, wrapper.CertificateTableVirtualAddress, wrapper.CertificateTableSize);
|
||
|
||
for (int i = 0; i < CoffHeader.NumberOfSections; i++) {
|
||
byte[] nextSection = reader.ReadBytes(Marshal.SizeOf(typeof(IMAGE_SECTION_HEADER))); //should be 40 bytes...
|
||
IMAGE_SECTION_HEADER sectionTableHeader = StructHelper.FromBytes<IMAGE_SECTION_HEADER>(nextSection);
|
||
ImportantHashPositions.AddSectionTableHeader(sectionTableHeader);
|
||
}
|
||
}
|
||
}
|
||
|
||
private void addCertToList(SignerInfo si, List<X509Certificate2> list) {
|
||
|
||
X509Certificate2 cert = si.Certificate;
|
||
if (list.Find(x => x.Thumbprint == cert.Thumbprint) == null) {
|
||
list.Add(cert);
|
||
} else {
|
||
Logger.Debug("Certificate with Thumbprint {0} already in list. skipping.", cert.Thumbprint);
|
||
}
|
||
}
|
||
|
||
public List<X509Certificate2> ExtractVerifiedSignatureCertificates() {
|
||
List<X509Certificate2> list = new List<X509Certificate2>();
|
||
using (FileStream stream = new FileStream(FilePath, FileMode.Open, FileAccess.Read))
|
||
using (BinaryReader reader = new BinaryReader(stream)) {
|
||
//verify all the embedded signatures
|
||
stream.Seek(this.ImportantHashPositions.CertificateTableStart, SeekOrigin.Begin);
|
||
int readCertLen = reader.ReadInt32();
|
||
int readRevision = reader.ReadInt16();
|
||
int readCertType = reader.ReadInt16();
|
||
byte[] pkcs7 = reader.ReadBytes(readCertLen);
|
||
|
||
SignedCms cms = new SignedCms();
|
||
cms.Decode(pkcs7);
|
||
cms.CheckHash();
|
||
|
||
//shout out to Scott MG: https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/655f5c27-b049-4275-a8b3-cc1c0be2b4f2/retrieve-certificate-info-for-dualsigned-sha1sha256
|
||
//for indicating that the unsigned attributes contain the other SignerInfos
|
||
foreach (var cmsSi in cms.SignerInfos) {
|
||
cmsSi.CheckSignature(true);
|
||
if (VerifyTrust(SystemCAs, expectedRootCa, cmsSi.Certificate).Result) {
|
||
VerifyFileHash(cms, cmsSi);
|
||
addCertToList(cmsSi, list);
|
||
}
|
||
if (cmsSi.UnsignedAttributes.Count > 0) {
|
||
foreach (var unsignedAttr in cmsSi.UnsignedAttributes) {
|
||
foreach (AsnEncodedData asn in unsignedAttr.Values) {
|
||
SignedCms innerCms = new SignedCms();
|
||
innerCms.Decode(asn.RawData);
|
||
innerCms.CheckHash();
|
||
if (innerCms.SignerInfos.Count > 0) {
|
||
SignerInfo innerSignerInfo = innerCms.SignerInfos[0];
|
||
try {
|
||
innerSignerInfo.CheckSignature(false);
|
||
}
|
||
catch (CryptographicException) {
|
||
if (innerSignerInfo.Certificate.Thumbprint == oldKnownThumbprint) {
|
||
//special handling for the known 'old' NetFoundry signing certificate, now expired...
|
||
//TODO: remove this code after 2021
|
||
//just allow this one error
|
||
Logger.Warn("Ignoring timestamp validity issue for the existing code signing certificate. Subject: {0}, Thumbprint: {1}", innerSignerInfo.Certificate.Subject, innerSignerInfo.Certificate.Thumbprint);
|
||
} else {
|
||
if (IsCertificateOpenZitiVerifies(innerSignerInfo.Certificate)) {
|
||
Logger.Debug("Signature could not be verified. This is expected for the certificates issued by openziti/netfoundry.");
|
||
} else {
|
||
throw;
|
||
}
|
||
}
|
||
}
|
||
|
||
if (VerifyTrust(SystemCAs, expectedRootCa, innerSignerInfo.Certificate).Result) {
|
||
VerifyFileHash(innerCms, innerSignerInfo);
|
||
addCertToList(innerSignerInfo, list);
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
return list;
|
||
}
|
||
|
||
public bool IsCertificateOpenZitiVerifies(X509Certificate2 cert) {
|
||
bool yesOrNo = cert.Subject.ToLower().Contains("netfoundry") || cert.Subject.ToLower().Contains("openziti");
|
||
if (yesOrNo) {
|
||
Logger.Debug("Certificate does need verification: {0}", cert.Subject);
|
||
} else {
|
||
Logger.Debug("Certificate does not need verification: {0}", cert.Subject);
|
||
}
|
||
return yesOrNo;
|
||
}
|
||
|
||
public void Verify() {
|
||
Logger.Debug("extracting certificates from file: {0}", FilePath);
|
||
List<X509Certificate2> list = ExtractVerifiedSignatureCertificates();
|
||
Logger.Info("Certificates extracted: {0}", list.Count);
|
||
foreach (X509Certificate2 cert in list) {
|
||
Logger.Info("Checking certificate: [{0}] {1}", cert.Thumbprint, cert);
|
||
if (IsCertificateOpenZitiVerifies(cert)) {
|
||
//verify this certificate was issued from the known CA
|
||
try {
|
||
Logger.Info("Verifying trust of certificate: [{0}] {1}", cert, cert.Thumbprint);
|
||
VerifyTrust(empty, expectedRootCa, cert, true).Wait();
|
||
Logger.Info("Certificate [{0}] {1} was verified signed by [{2}] {3}", cert.Thumbprint, cert.Subject, expectedRootCa.Thumbprint, expectedRootCa.Subject);
|
||
return; //yes!
|
||
}
|
||
catch {
|
||
//empty on purpose. keep checking...
|
||
}
|
||
}
|
||
}
|
||
|
||
throw new CryptographicException("Executable not signed by an appropriate certificate");
|
||
}
|
||
|
||
public void VerifyFileHash(SignedCms cms, SignerInfo signerInfo) {
|
||
if (!IsCertificateOpenZitiVerifies(signerInfo.Certificate)) {
|
||
return;
|
||
}
|
||
|
||
//calculate the hash using the first signed info
|
||
var hashAlg = IncrementalHash.CreateHash(new HashAlgorithmName(signerInfo.DigestAlgorithm.FriendlyName.ToUpper()));
|
||
byte[] calculatedHash = CalculatePeHashStreaming(hashAlg);
|
||
string hash = BitConverter.ToString(calculatedHash).Replace("-", "");
|
||
|
||
string content = BitConverter.ToString(cms.ContentInfo.Content).Replace("-", "");
|
||
if (!content.Contains(hash)) {
|
||
throw new CryptographicException("The expected hash and the actual hash did not match!");
|
||
}
|
||
}
|
||
|
||
public async static Task<bool> VerifyTrust(X509Store cas, X509Certificate2 trustedRootCertificateAuthority, X509Certificate2 certificate) {
|
||
return await VerifyTrust(cas, trustedRootCertificateAuthority, certificate, false);
|
||
}
|
||
|
||
public async static Task<bool> VerifyTrust(X509Store cas, X509Certificate2 trustedRootCertificateAuthority, X509Certificate2 certificate, bool verifyTrustedRoot) {
|
||
X509Chain chain = new X509Chain();
|
||
chain.ChainPolicy.ExtraStore.Add(trustedRootCertificateAuthority);
|
||
chain.ChainPolicy.ExtraStore.AddRange(cas.Certificates);
|
||
chain.ChainPolicy.VerificationFlags = X509VerificationFlags.NoFlag;
|
||
chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
|
||
chain.Build(new X509Certificate2(certificate));
|
||
List<Exception> exceptions = new List<Exception>();
|
||
foreach (X509ChainStatus status in chain.ChainStatus) {
|
||
if (status.Status == X509ChainStatusFlags.NoError || status.Status == X509ChainStatusFlags.UntrustedRoot) {
|
||
//X509ChainStatusFlags.UntrustedRoot simply means it was not found in the computer/user's trust store.... that's fine...
|
||
} else {
|
||
if (status.Status == X509ChainStatusFlags.NotTimeValid && certificate.Thumbprint == oldKnownThumbprint) {
|
||
//X509ChainStatusFlags.NotTimeValid means the certificate has expired - we're allowing this for now (summer 2021) to allow older clients to update
|
||
Logger.Warn("Executable is signed using the old signing certificate. Allowing this certificate to report as expired");
|
||
} else {
|
||
exceptions.Add(new CryptographicException("Could not verify trust: " + status.StatusInformation));
|
||
}
|
||
}
|
||
}
|
||
|
||
//final check - make sure the last certificate matches the expected thumbprint
|
||
if (verifyTrustedRoot && chain.ChainElements[chain.ChainElements.Count - 1].Certificate.Thumbprint != trustedRootCertificateAuthority.Thumbprint) {
|
||
exceptions.Add(new Exception("Could not verify trust. The expected thumbprint was not found!"));
|
||
}
|
||
|
||
foreach (var e in certificate.Extensions) {
|
||
if (e.Oid.Value == "2.5.29.31") { //2.5.29.31 == CRL Distribution Points
|
||
try {
|
||
CrlDistributionPointParser t = new CrlDistributionPointParser(e.RawData);
|
||
|
||
if (t != null) {
|
||
foreach (string url in t.urls) {
|
||
try {
|
||
//good - things are going the way we want... keep going
|
||
//fetch the CRL from the url provided and parse it...
|
||
byte[] crlBytes = await new HttpClient().GetByteArrayAsync(url);
|
||
|
||
if (crlBytes != null && crlBytes.Length > 0) {
|
||
//fetch the crl
|
||
Win32Crypto.CrlInfo info = Win32Crypto.FromBlob(crlBytes);
|
||
if (info.RevokedSerialNumbers.Contains(certificate.SerialNumber)) {
|
||
exceptions.Add(new CryptographicException("Serial number " + certificate.SerialNumber + " has been revoked."));
|
||
}
|
||
} else {
|
||
exceptions.Add(new CryptographicException("Could not retrieve revocation list from " + url + "- cannot verify trust"));
|
||
}
|
||
}
|
||
catch (Exception innerException) {
|
||
exceptions.Add(new CryptographicException("crl at " + url + " could not be used", innerException));
|
||
}
|
||
}
|
||
}
|
||
}
|
||
catch (Exception ex) {
|
||
exceptions.Add(ex);
|
||
}
|
||
}
|
||
}
|
||
|
||
if (exceptions.Count > 0) {
|
||
throw new AggregateException(exceptions);
|
||
}
|
||
|
||
return true;
|
||
}
|
||
|
||
public byte[] CalculatePeHashStreaming(IncrementalHash alg) {
|
||
using (FileStream stream = new FileStream(FilePath, System.IO.FileMode.Open, System.IO.FileAccess.Read))
|
||
using (BinaryReader reader = new BinaryReader(stream)) {
|
||
stream.Seek(ImportantHashPositions.Chunk1.Start, SeekOrigin.Begin);
|
||
alg.AppendData(reader.ReadBytes(ImportantHashPositions.Chunk1.Length));
|
||
|
||
stream.Seek(ImportantHashPositions.Chunk2.Start, SeekOrigin.Begin);
|
||
alg.AppendData(reader.ReadBytes(ImportantHashPositions.Chunk2.Length));
|
||
|
||
stream.Seek(ImportantHashPositions.Chunk3.Start, SeekOrigin.Begin);
|
||
alg.AppendData(reader.ReadBytes(ImportantHashPositions.Chunk3.Length));
|
||
|
||
int blockSize = 8192;
|
||
int read = 0;
|
||
byte[] buf = new byte[blockSize];
|
||
|
||
foreach (IMAGE_SECTION_HEADER h in ImportantHashPositions.SectionTableHeaders) {
|
||
stream.Seek(h.PointerToRawData, SeekOrigin.Begin);
|
||
if (h.SizeOfRawData <= blockSize) {
|
||
//just read the full block as one
|
||
alg.AppendData(reader.ReadBytes((int)h.SizeOfRawData));
|
||
} else {
|
||
long pos = stream.Position;
|
||
long end = h.PointerToRawData + h.SizeOfRawData - blockSize;
|
||
//process the data into blocks
|
||
while (pos < end) {
|
||
read = stream.Read(buf, 0, blockSize);
|
||
alg.AppendData(buf, 0, read);
|
||
pos += blockSize;
|
||
}
|
||
|
||
int remaining = (int)(end - pos + blockSize);
|
||
if (remaining > 0) {
|
||
read = stream.Read(buf, 0, remaining);
|
||
alg.AppendData(buf, 0, read);
|
||
}
|
||
}
|
||
}
|
||
|
||
/*
|
||
14. Create a value called FILE_SIZE, which is not part of the signature. Set this value to the
|
||
image’s file size, acquired from the underlying file system. If FILE_SIZE is greater than
|
||
SUM_OF_BYTES_HASHED, the file contains extra data that must be added to the hash. This data
|
||
begins at the SUM_OF_BYTES_HASHED file offset, and its length is:
|
||
(File Size) – ((Size of AttributeCertificateTable) + SUM_OF_BYTES_HASHED)
|
||
Note: The size of Attribute Certificate Table is specified in the second ULONG value in the
|
||
Certificate Table entry (32 bit: offset 132, 64 bit: offset 148) in Optional Header Data
|
||
Directories.
|
||
*/
|
||
long FILE_SIZE = new FileInfo(FilePath).Length;
|
||
|
||
long leftoverBytesToHash = FILE_SIZE - ImportantHashPositions.SumOfBytesHashed - ImportantHashPositions.CertificateTableSize;
|
||
|
||
if (leftoverBytesToHash > 0) {
|
||
//HashBlock(alg, reader, SUM_OF_BYTES_HASHED + certTableSize, FILE_SIZE);
|
||
stream.Seek(ImportantHashPositions.SumOfBytesHashed, SeekOrigin.Begin);
|
||
byte[] leftoverBytes = reader.ReadBytes((int)leftoverBytesToHash);
|
||
alg.AppendData(leftoverBytes);
|
||
} else {
|
||
//no more bytes to hash...
|
||
}
|
||
//alg.TransformFinalBlock(new byte[0], 0, 0);
|
||
|
||
byte[] result = alg.GetHashAndReset();
|
||
|
||
return result;
|
||
}
|
||
}
|
||
|
||
public class HashPositions {
|
||
internal HashPositions() {
|
||
Chunk1 = new Range();
|
||
Chunk2 = new Range();
|
||
Chunk3 = new Range();
|
||
SectionTableHeaders = new List<IMAGE_SECTION_HEADER>();
|
||
}
|
||
/*
|
||
* These functions are all based from the document linked to from the bottom of:
|
||
* https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#optional-header-standard-fields-image-only
|
||
*
|
||
* Link to the document:
|
||
* https://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/Authenticode_PE.docx
|
||
*
|
||
* Relevant section copied from that document:
|
||
* To calculate the hash value:
|
||
1. Load the image header into memory.
|
||
2. Initialize a hash algorithm context.
|
||
3. Hash the image header from its base to immediately before the start of the
|
||
checksum address, as specified in Optional Header Windows-Specific Fields.
|
||
4. Skip over the checksum, which is a 4-byte field.
|
||
5. Hash everything from the end of the checksum field to immediately before the start of
|
||
the Certificate Table entry, as specified in Optional Header Data Directories.
|
||
6. Get the Attribute Certificate Table address and size from the Certificate Table entry.
|
||
For details, see section 5.7 of the PE/COFF specification.
|
||
7. Exclude the Certificate Table entry from the calculation and hash everything from the
|
||
end of the Certificate Table entry to the end of image header, including Section Table
|
||
(headers).The Certificate Table entry is 8 bytes long, as specified in Optional Header
|
||
Data Directories.
|
||
8. Create a counter called SUM_OF_BYTES_HASHED, which is not part of the signature. Set
|
||
this counter to the SizeOfHeaders field, as specified in Optional Header Windows-Specific
|
||
Field.
|
||
9. Build a temporary table of pointers to all of the section headers in the image. The
|
||
NumberOfSections field of COFF File Header indicates how big the table should be. Do not
|
||
include any section headers in the table whose SizeOfRawData field is zero.
|
||
10. Using the PointerToRawData field (offset 20) in the referenced SectionHeader structure as
|
||
a key, arrange the table's elements in ascending order. In other words, sort the section
|
||
headers in ascending order according to the disk-file offset of the sections.
|
||
11. Walk through the sorted table, load the corresponding section into memory, and hash the entire
|
||
section. Use the SizeOfRawData field in the SectionHeader structure to determine the amount
|
||
of data to hash.
|
||
12. Add the section’s SizeOfRawData value to SUM_OF_BYTES_HASHED.
|
||
13. Repeat steps 11 and 12 for all of the sections in the sorted table.
|
||
14. Create a value called FILE_SIZE, which is not part of the signature. Set this value to the
|
||
image’s file size, acquired from the underlying file system. If FILE_SIZE is greater than
|
||
SUM_OF_BYTES_HASHED, the file contains extra data that must be added to the hash. This data
|
||
begins at the SUM_OF_BYTES_HASHED file offset, and its length is:
|
||
(File Size) – ((Size of AttributeCertificateTable) + SUM_OF_BYTES_HASHED)
|
||
Note: The size of Attribute Certificate Table is specified in the second ULONG value in the
|
||
Certificate Table entry (32 bit: offset 132, 64 bit: offset 148) in Optional Header Data
|
||
Directories.
|
||
15. Finalize the hash algorithm context.
|
||
Note: This procedure uses offset values from the PE/COFF specification, version 8.1 .
|
||
For authoritative offset values, refer to the most recent version of the PE/COFF specification.
|
||
*/
|
||
|
||
public List<IMAGE_SECTION_HEADER> SectionTableHeaders { get; private set; }
|
||
|
||
/// <summary>
|
||
/// Chunk1 Start will set the position in the file which the hashing of the file should begin from
|
||
/// This is always the start of the file and thus is hardcoded to 0 and takes no parameters
|
||
///
|
||
/// Chunk1 End is defined to be: "immediately before the start of the checksum address"
|
||
///
|
||
/// Relevant step:
|
||
/// 3. Hash the image header from its base to immediately before the start of the
|
||
/// checksum address, as specified in Optional Header Windows-Specific Fields.
|
||
/// </summary>
|
||
public Range Chunk1 { get; private set; }
|
||
|
||
/// <summary>
|
||
/// Chunk2 Start is defined to be: "end of the checksum field"
|
||
/// Chunk2 End is defined to be: "immediately before the start of the Certificate Table entry"
|
||
///
|
||
/// Relevant step:
|
||
/// 5. Hash everything from the end of the checksum field to immediately before the start of
|
||
/// the Certificate Table entry, as specified in Optional Header Data Directories.
|
||
/// </summary>
|
||
public Range Chunk2 { get; private set; }
|
||
|
||
/// <summary>
|
||
/// Chunk3 Start is defined to be: "the end of the Certificate Table entry"
|
||
/// Chunk3 End is defined to be: "the end of image header"
|
||
/// When testing/developing this solution - this was found to be the position specified by
|
||
/// the SizeOfHeaders field
|
||
///
|
||
/// Relevant step:
|
||
/// 7. Exclude the Certificate Table entry from the calculation and hash everything from the
|
||
/// end of the Certificate Table entry to the end of image header, including Section Table
|
||
/// (headers).The Certificate Table entry is 8 bytes long, as specified in Optional Header
|
||
/// Data Directories.
|
||
/// </summary>
|
||
public Range Chunk3 { get; private set; }
|
||
|
||
public uint SizeOfHeaders { get; private set; }
|
||
public uint SumOfBytesHashed { get; private set; }
|
||
public long CertificateTableStart { get; private set; }
|
||
public long CertificateTableSize { get; private set; }
|
||
|
||
internal bool reorderNeeded = false;
|
||
private uint lastAddress = 0;
|
||
public void AddSectionTableHeader(IMAGE_SECTION_HEADER sectionTableHeader) {
|
||
|
||
if (sectionTableHeader.SizeOfRawData > 0) {
|
||
SectionTableHeaders.Add(sectionTableHeader);
|
||
}
|
||
|
||
if (lastAddress < sectionTableHeader.PointerToRawData) {
|
||
//good - it's in order...
|
||
} else {
|
||
reorderNeeded = true;
|
||
}
|
||
lastAddress = sectionTableHeader.PointerToRawData;
|
||
SumOfBytesHashed += sectionTableHeader.SizeOfRawData;
|
||
}
|
||
|
||
public void SetStartCoffHeader(uint peHeaderStart) {
|
||
Chunk1.Start = 0;
|
||
uint checksumStart = peHeaderStart + 88; //88 is the size of the COFF Header (24) + Standard Headers + Windows-Specific Fields up to checksum (offset 64)
|
||
Chunk1.End = checksumStart;
|
||
Chunk2.Start = checksumStart + LengthOfChecksum;
|
||
|
||
//and the four tables before the Certificate Table
|
||
//(ExportTable, ImportTable, ResourceTable, ExceptionTable)
|
||
uint certHeaderTableOffset = checksumStart + 64;
|
||
|
||
Chunk2.End = certHeaderTableOffset;
|
||
Chunk3.Start = certHeaderTableOffset + LengthCertificateTable;
|
||
}
|
||
|
||
public void SetCertificateDetails(PeType type, uint sizeOfHeaders, uint certificateTableStart,
|
||
uint certificateTableSize) {
|
||
if (type == PeType.Pe32Plus) {
|
||
uint winSpecificExtraBytes = 16; //need to account for the extra bytes in the Windows-Specific Fields (each field has 4 extra bytes)
|
||
Chunk2.End += winSpecificExtraBytes;
|
||
Chunk3.Start += winSpecificExtraBytes;
|
||
}
|
||
|
||
Chunk3.End = sizeOfHeaders;
|
||
SizeOfHeaders = sizeOfHeaders;
|
||
SumOfBytesHashed = sizeOfHeaders;
|
||
CertificateTableStart = certificateTableStart;
|
||
CertificateTableSize = certificateTableSize;
|
||
}
|
||
}
|
||
|
||
public class Range {
|
||
public long Start { get; internal set; }
|
||
public long End { get; internal set; }
|
||
|
||
public int Length => (int)(End - Start);
|
||
}
|
||
}
|
||
|
||
public enum PeType {
|
||
Pe32,
|
||
Pe32Plus
|
||
}
|
||
|
||
internal class CrlDistributionPointParser {
|
||
internal int offset;
|
||
internal int length;
|
||
internal List<CrlDistributionPointParser> tags = new List<CrlDistributionPointParser>();
|
||
private CrlDistributionPointParser parent = null;
|
||
private AsnTagType type = AsnTagType.NONE;
|
||
internal List<string> urls = new List<string>();
|
||
private int consumedBytes = 0;
|
||
|
||
internal CrlDistributionPointParser(byte[] asn1Data) : this(new MemoryStream(asn1Data)) {
|
||
|
||
}
|
||
|
||
internal CrlDistributionPointParser(MemoryStream asn1Data) : this(null, asn1Data/*new BinaryReader(asn1Data)*/, 0) {
|
||
|
||
}
|
||
|
||
internal CrlDistributionPointParser(CrlDistributionPointParser parent, MemoryStream memoryStream, /*BinaryReader asn1Reader,*/ int offset) {
|
||
BinaryReader asn1Reader = new BinaryReader(memoryStream);
|
||
this.offset = offset;
|
||
type = readTag(asn1Reader);
|
||
length = readTagLen(asn1Reader);
|
||
this.parent = parent;
|
||
int headerBytes = consumedBytes;
|
||
while (this.consumedBytes < length + headerBytes) {
|
||
switch (type) {
|
||
case AsnTagType.SEQUENCE:
|
||
case AsnTagType.ARRAY_ELEMENT:
|
||
var t = new CrlDistributionPointParser(this, memoryStream, (int) memoryStream.Position);
|
||
consumedBytes += t.consumedBytes;
|
||
tags.Add(t);
|
||
this.urls.AddRange(t.urls);
|
||
break;
|
||
case AsnTagType.STRING:
|
||
consumedBytes += length;
|
||
urls.Add(System.Text.Encoding.UTF8.GetString(asn1Reader.ReadBytes(length)));
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
|
||
internal AsnTagType readTag(BinaryReader asn1Data) {
|
||
byte tagByte = asn1Data.ReadByte();
|
||
if (tagByte != 0x30 && tagByte != 0xA0 && tagByte != 0x86) {
|
||
throw new CryptographicException("Could not parse CRL Distribution Points. First byte not asn SEQUENCE|ARRAY|STRING marker");
|
||
}
|
||
|
||
consumedBytes++;
|
||
if (tagByte == 0x30) return AsnTagType.SEQUENCE;
|
||
if (tagByte == 0xA0) return AsnTagType.ARRAY_ELEMENT;
|
||
if (tagByte == 0x86) return AsnTagType.STRING;
|
||
return AsnTagType.NONE;
|
||
}
|
||
|
||
internal int readTagLen(BinaryReader asn1Data) {
|
||
int tagLen = asn1Data.ReadByte();
|
||
consumedBytes++;
|
||
if (tagLen > 128) {
|
||
//means there's more bytes to read that control the overall length of the next section
|
||
int moreBytes = tagLen - 128;
|
||
byte[] lenBytes = new byte[4];
|
||
byte[] d = asn1Data.ReadBytes(moreBytes);
|
||
|
||
int pos = 0;
|
||
for (int i = d.Length - 1; i >= 0; i--) {
|
||
lenBytes[pos++] = d[i];
|
||
}
|
||
|
||
tagLen = BitConverter.ToInt32(lenBytes, 0);
|
||
consumedBytes += moreBytes;
|
||
}
|
||
|
||
return tagLen;
|
||
}
|
||
}
|
||
|
||
internal enum AsnTagType {
|
||
SEQUENCE = 0x30,
|
||
ARRAY_ELEMENT = 0xA0,
|
||
STRING = 0x86,
|
||
NONE = 0,
|
||
}
|
||
}
|