LIEF: Library to Instrument Executable Formats Version 0.15.0
Loading...
Searching...
No Matches
SignatureParser.hpp
1/* Copyright 2017 - 2024 R. Thomas
2 * Copyright 2017 - 2024 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_SIGNATURE_PARSER_H
17#define LIEF_PE_SIGNATURE_PARSER_H
18#include <memory>
19#include <string>
20#include <array>
21
22#include "LIEF/errors.hpp"
23
24#include "LIEF/PE/signature/Signature.hpp"
25#include "LIEF/PE/signature/OIDToString.hpp"
26
27namespace LIEF {
28class BinaryStream;
29class VectorStream;
30
31namespace PE {
32class Parser;
33class Attribute;
34class SpcIndirectData;
35class PKCS9TSTInfo;
36
37class LIEF_API SignatureParser {
38 friend class Parser;
39 struct SpcPeImageData {
40 uint32_t flags;
41 std::string file;
42 };
43
44 struct SpcSpOpusInfo {
45 std::string program_name;
46 std::string more_info;
47 };
48 struct range_t {
49 uint64_t start = 0;
50 uint64_t end = 0;
51 };
52
53 public:
54 using attributes_t = std::vector<std::unique_ptr<Attribute>>;
55 using signer_infos_t = std::vector<SignerInfo>;
56 using x509_certificates_t = std::vector<x509>;
57 using time_t = std::array<int32_t, 6>;
58
60 static result<Signature> parse(std::vector<uint8_t> data, bool skip_header = false);
61
63 static result<Signature> parse(BinaryStream& stream, bool skip_header = false);
64
66 static result<Signature> parse(const std::string& path);
67 SignatureParser(const SignatureParser&) = delete;
68 SignatureParser& operator=(const SignatureParser&) = delete;
69 private:
70
73
74 static result<Signature> parse_signature(BinaryStream& stream);
75
76 static result<ContentInfo> parse_content_info(BinaryStream& stream, range_t& range);
77 static result<x509_certificates_t> parse_certificates(BinaryStream& stream);
78 static result<signer_infos_t> parse_signer_infos(BinaryStream& stream);
79 static result<attributes_t> parse_attributes(BinaryStream& stream);
80 static result<std::unique_ptr<Attribute>> parse_content_type(BinaryStream& stream);
81
82 static result<signer_infos_t> parse_pkcs9_counter_sign(BinaryStream& stream);
83 static result<std::vector<uint8_t>> parse_pkcs9_message_digest(BinaryStream& stream);
84 static result<int32_t> parse_pkcs9_at_sequence_number(BinaryStream& stream);
85 static result<time_t> parse_pkcs9_signing_time(BinaryStream& stream);
86 static result<std::unique_ptr<PKCS9TSTInfo>> parse_pkcs9_tstinfo(BinaryStream& stream);
87
88 static result<std::unique_ptr<Attribute>> parse_ms_counter_sign(BinaryStream& stream);
89 static result<Signature> parse_ms_spc_nested_signature(BinaryStream& stream);
90 static result<oid_t> parse_ms_spc_statement_type(BinaryStream& stream);
91
92 static result<SpcSpOpusInfo> parse_spc_sp_opus_info(BinaryStream& stream);
93 static result<std::string> parse_spc_string(BinaryStream& stream);
94 static result<std::string> parse_spc_link(BinaryStream& stream);
95 static result<SpcPeImageData> parse_spc_pe_image_data(BinaryStream& stream);
96 static result<std::unique_ptr<SpcIndirectData>> parse_spc_indirect_data(BinaryStream& stream, range_t& range);
97
98};
99
100}
101}
102
103#endif
Class that is used to a read stream of data from different sources.
Definition BinaryStream.hpp:34
Main interface to parse PE binaries. In particular the static functions: Parser::parse should be used...
Definition PE/Parser.hpp:47
Definition SignatureParser.hpp:37
static result< Signature > parse(std::vector< uint8_t > data, bool skip_header=false)
Parse a PKCS #7 signature given a raw blob.
static result< Signature > parse(BinaryStream &stream, bool skip_header=false)
Parse a PKCS #7 signature given a BinaryStream.
static result< Signature > parse(const std::string &path)
Parse a PKCS #7 signature from a file path.
LIEF namespace.
Definition Abstract/Binary.hpp:32
tl::expected< T, lief_errors > result
Wrapper that contains an Object (T) or an error.
Definition errors.hpp:72