search

wisk / medusa

An open source interactive disassembler
Other
1.04k stars 92 forks source link

Qestion: PE File certificate #25

Closed saeschdivara closed 8 years ago

saeschdivara commented 9 years ago

Hi, How can I find out where the section lies in which the certificate is stored? I found IMAGE_DIRECTORY_ENTRY_CERTIFICATE which didn't help me much: https://github.com/libvmi/libvmi/blob/master/libvmi/peparse.h

wisk commented 9 years ago

Hello,

I'm going to assume to want to access this information from medusa. The real define is IMAGE_DIRECTORY_ENTRY_SECURITY and this feature is called Authenticode for further information, take a look at this link

It might be a little bit tricky to retrieve it since it should not be mapped on memory, and unmapped data are discarded by the PE loader (_ldrpe), so if you wanna retrieve this field, get the badly named RVA value from the data directories[PE_DIRECTORY_ENTRY_SECURITY] (in pe.hpp IMAGE_ is replaced with PE_ to avoid conflict) and its size to read it using the BinaryStream.

saeschdivara commented 9 years ago

Ok, thanks I will try to do that and will give you feedback as soon as I've tried it

wisk commented 8 years ago

Hi,

Since this feature is not really useful for a disassembler and there's no news since 2015, I close the issue. Feel free to re-open it if needed.

Thanks.