Open tklengyel opened 6 years ago
When examining EFI PE files, it is very useful to calculate the Authenticode hash, which is used by the UEFI firmware to record measurements into the TPM. Currently pehash does not produce this hash.
pehash
More info: https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547(v=vs.85).aspx#appendix_a__calculating_authenticode_pe_image_hash
When examining EFI PE files, it is very useful to calculate the Authenticode hash, which is used by the UEFI firmware to record measurements into the TPM. Currently
pehashdoes not produce this hash.More info: https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547(v=vs.85).aspx#appendix_a__calculating_authenticode_pe_image_hash