m4b / goblin

An impish, cross-platform binary parsing crate, written in Rust
MIT License
1.17k stars 156 forks source link

pe: add authenticode support #358

Closed baloo closed 1 year ago

baloo commented 1 year ago

Authenticode is the hashing format used to sign PE binaries. This provides the hash to be signed.

Usage:

use goblin::pe::PE;
use sha2::Sha256;
use std::{fs::File, io::Read};

fn main() {
    let mut buf = Vec::new();
    let mut f =
        File::open("/nix/store/bhsxra1hc7yhja2kzw5rdds90i3w3a54-linux-5.10.147/bzImage").unwrap();
    f.read_to_end(&mut buf).unwrap();

    let pe = PE::parse(&buf).unwrap();
    let hash = pe.authenticode_digest::<Sha256>();

    println!("hash: {:x?}", hash);
}

Fixes #355 cc @RaitoBezarius

m4b commented 1 year ago

For similar reasons I've noted in https://github.com/m4b/goblin/pull/360 it's going to take some serious convincing to add more deps to goblin.

baloo commented 1 year ago

I get the point about not adding dependencies to goblin itself. I'd be more than happy to implement those as trait and get that implemented in a dependency of both goblin and digest, but there are some data that I need goblin to emit. Namely, the sections I need to omit from the authenticode computation, I don't think I can't get that done outside goblin.

I think it would also be nice to have the "source bytes" in the PE objects, if you're alright with that.

Anyway, thanks for maintaining goblin in the first place.

baloo commented 1 year ago

(made an alternative in #362)