2f50b07f · cryptotaxi247/MeshCentral

@@ -94,6 +94,8 @@ function createAuthenticodeHandler(path) {

94 var derlen = forge.asn1.getBerValueLength(forge.util.createBuffer(pkcs7raw.slice(1, 5))) + 4;

95 if (derlen != pkcs7raw.length) { pkcs7raw = pkcs7raw.slice(0, derlen); }

96

97 + //console.log('pkcs7raw', Buffer.from(pkcs7raw, 'binary').toString('base64'));

98 +

99 // Decode the signature block

100 var pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(pkcs7raw));

101

@@ -114,6 +116,16 @@ function createAuthenticodeHandler(path) {

116 if (!pkcs7.verify(caStore)) { throw ('Executable file has an invalid signature.'); }

117 */

118

119 + // ucs2/ucs-2/utf16le/utf-16le

120 + obj.signingAttribs = [];

121 + for (var i in pkcs7.rawCapture.authenticatedAttributes) {

122 + if (forge.asn1.derToOid(pkcs7.rawCapture.authenticatedAttributes[i].value[0].value) == obj.Oids.SPC_SP_OPUS_INFO_OBJID) {

123 + for (var j in pkcs7.rawCapture.authenticatedAttributes[i].value[1].value[0].value) {

124 + obj.signingAttribs.push(pkcs7.rawCapture.authenticatedAttributes[i].value[1].value[0].value[j].value[0].value);

125 + }

126 + }

127 + }

128 +

129 // Set the certificate chain

130 obj.certificates = pkcs7.certificates;

131

@@ -175,7 +187,7 @@ function createAuthenticodeHandler(path) {

187 }

188

189 // Sign the file using the certificate and key. If none is specified, generate a dummy one

178 - obj.sign = function (cert, key) {

190 + obj.sign = function (cert, key, desc, url) {

191 if ((cert == null) || (key == null)) { var c = obj.createSelfSignedCert(); cert = c.cert; key = c.key; }

192 var fileHash = getHash('sha384');

193

@@ -186,20 +198,29 @@ function createAuthenticodeHandler(path) {

198 p7.contentInfo.value.push(forge.asn1.create(forge.asn1.Class.CONTEXT_SPECIFIC, 0, true, [content]));

199 p7.content = {}; // We set .contentInfo and have .content empty to bypass node-forge limitation on the type of content it can sign.

200 p7.addCertificate(cert);

201 +

202 + // Build authenticated attributes

203 + var authenticatedAttributes = [

204 + { type: forge.pki.oids.contentType, value: forge.pki.oids.data },

205 + { type: forge.pki.oids.messageDigest } // value will be auto-populated at signing time

206 + ]

207 + if ((desc != null) || (url != null)) {

208 + var codeSigningAttributes = { "tagClass": 0, "type": 16, "constructed": true, "composed": true, "value": [ ] };

209 + if (desc != null) { codeSigningAttributes.value.push({ "tagClass": 128, "type": 0, "constructed": true, "composed": true, "value": [{ "tagClass": 128, "type": 0, "constructed": false, "composed": false, "value": Buffer.from(desc, 'ucs2').toString() }] }); }

210 + if (url != null) { codeSigningAttributes.value.push({ "tagClass": 128, "type": 1, "constructed": true, "composed": true, "value": [{ "tagClass": 128, "type": 0, "constructed": false, "composed": false, "value": url }] }); }

211 + authenticatedAttributes.push({ type: obj.Oids.SPC_SP_OPUS_INFO_OBJID, value: codeSigningAttributes });

212 + }

213 +

214 + // Add the signer and sign

215 p7.addSigner({

216 key: key,

217 certificate: cert,

218 digestAlgorithm: forge.pki.oids.sha384,

193 - authenticatedAttributes:

194 - [

195 - { type: obj.Oids.SPC_INDIRECT_DATA_OBJID, },

196 - { type: forge.pki.oids.contentType, value: forge.pki.oids.data },

197 - { type: forge.pki.oids.messageDigest }, // value will be auto-populated at signing time

198 - { type: forge.pki.oids.signingTime, value: new Date() } // value can also be auto-populated at signing time

199 - ]

219 + authenticatedAttributes: authenticatedAttributes

220 });

221 p7.sign();

222 var p7signature = Buffer.from(forge.pkcs7.messageToPem(p7).split('-----BEGIN PKCS7-----')[1].split('-----END PKCS7-----')[0], 'base64');

223 + //console.log('Signature', Buffer.from(p7signature, 'binary').toString('base64'));

224

225 // Create the output filename

226 var outputFileName = this.path.split('.');

@@ -291,6 +312,7 @@ function start() {

312 console.log("Commands:");

313 console.log(" info - Show information about an executable.");

314 console.log(" sign - Sign an executable using a dummy certificate.");

315 + console.log(" sign [exepath] (description) (url)");

316 console.log(" unsign - Remove the signature from the executable.");

317 return;

318 }

@@ -316,14 +338,17 @@ function start() {

338 var command = process.argv[2].toLowerCase();

339 if (command == 'info') {

340 console.log('Header', exe.header);

319 - if (exe.fileHashAlgo != null) { console.log('fileHashMethod', exe.fileHashAlgo); }

320 - if (exe.fileHashSigned != null) { console.log('fileHashSigned', exe.fileHashSigned.toString('hex')); }

321 - if (exe.fileHashActual != null) { console.log('fileHashActual', exe.fileHashActual.toString('hex')); }

322 - if (exe.signatureBlock) { console.log('Signature', exe.signatureBlock.toString('hex')); }

341 + if (exe.fileHashAlgo != null) { console.log('fileHashMethod:', exe.fileHashAlgo); }

342 + if (exe.fileHashSigned != null) { console.log('fileHashSigned:', exe.fileHashSigned.toString('hex')); }

343 + if (exe.fileHashActual != null) { console.log('fileHashActual:', exe.fileHashActual.toString('hex')); }

344 + if (exe.signingAttribs && exe.signingAttribs.length > 0) { console.log('Signature Attributes:'); for (var i in exe.signingAttribs) { console.log(' ' + exe.signingAttribs[i]); } }

345 console.log('FileLen: ' + exe.filesize);

346 }

347 if (command == 'sign') {

326 - console.log('Signing...'); exe.sign(); console.log('Done.');

348 + var desc = null, url = null;

349 + if (process.argv.length > 4) { desc = process.argv[4]; }

350 + if (process.argv.length > 5) { url = process.argv[5]; }

351 + console.log('Signing...'); exe.sign(null, null, desc, url); console.log('Done.');

352 }

353 if (command == 'unsign') {

354 if (exe.header.signed) { console.log('Unsigning...'); exe.unsign(); console.log('Done.'); } else { console.log('Executable is not signed.'); }

Added signing attributes to authenticode.js