More authenticode work, PKCS7 decode and encode.
Ylian Saint-Hilaire committed
May 27, 2022 at 00:26 UTC
549b67555f99c03b12b8652f332d01906e082b92
1 file changed
+24
-24
authenticode.js
+24
-24
@@ -94,6 +94,8 @@ function createAuthenticodeHandler(path) {
94
var derlen = forge.asn1.getBerValueLength(forge.util.createBuffer(pkcs7raw.slice(1, 5))) + 4;
95
if (derlen != pkcs7raw.length) { pkcs7raw = pkcs7raw.slice(0, derlen); }
96
97
+ //console.log('pkcs7raw', pkcs7raw.toString('base64'));
98
+
99
// Decode the signature block
100
var pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(pkcs7raw));
101
@@ -107,11 +109,12 @@ function createAuthenticodeHandler(path) {
109
pkcs7der.value[1].value[0].value[2].value[1].value[0] = { tagClass: 0, type: 4, constructed: false, composed: false, value: pkcs7content };
110
111
// DEBUG: Print out the new DER
110
- //console.log(Buffer.from(forge.asn1.toDer(pkcs7der).data, 'binary').toString('hex'));
112
+ //console.log(Buffer.from(forge.asn1.toDer(pkcs7der).data, 'binary').toString('base64'));
113
114
// Decode the PKCS7 message
115
var pkcs7 = p7.messageFromAsn1(pkcs7der);
116
var pkcs7content = forge.asn1.fromDer(pkcs7.rawCapture.content.value[0].value);
117
+ obj.rawSignedContent = pkcs7.rawCapture.content.value[0].value;
118
119
//console.log('p7content', JSON.stringify(pkcs7content));
120
@@ -183,8 +186,7 @@ function createAuthenticodeHandler(path) {
186
if ((cert == null) || (key == null)) { var c = obj.createSelfSignedCert(); cert = c.cert; key = c.key; }
187
var fileHash = getHash('sha384');
188
var p7 = forge.pkcs7.createSignedData();
186
- p7.content = forge.util.createBuffer(fileHash, 'utf8'); // DEBUG: NOT CORRRECT
187
- //p7.content = { "tagClass": 0, "type": 16, "constructed": true, "composed": true, "value": [{ "tagClass": 0, "type": 16, "constructed": true, "composed": true, "value": [{ "tagClass": 0, "type": 6, "constructed": false, "composed": false, "value": forge.asn1.oidToDer("1.3.6.1.4.1.311.2.1.15") }, { "tagClass": 0, "type": 16, "constructed": true, "composed": true, "value": [{ "tagClass": 0, "type": 3, "constructed": false, "composed": false, "value": "\u0000", "bitStringContents": "\u0000", "original": { "tagClass": 0, "type": 3, "constructed": false, "composed": false, "value": "\u0000" } }, { "tagClass": 128, "type": 0, "constructed": true, "composed": true, "value": [{ "tagClass": 128, "type": 2, "constructed": true, "composed": true, "value": [{ "tagClass": 128, "type": 0, "constructed": false, "composed": false, "value": "" }] }] }] }] }, { "tagClass": 0, "type": 16, "constructed": true, "composed": true, "value": [{ "tagClass": 0, "type": 16, "constructed": true, "composed": true, "value": [{ "tagClass": 0, "type": 6, "constructed": false, "composed": false, "value": forge.asn1.oidToDer(forge.pki.oids.sha384).data }, { "tagClass": 0, "type": 5, "constructed": false, "composed": false, "value": "" }] }, { "tagClass": 0, "type": 4, "constructed": false, "composed": false, "value": fileHash.toString('binary') }] }] };
189
+ p7.content = forge.asn1.toDer({ "tagClass": 0, "type": 16, "constructed": true, "composed": true, "value": [{ "tagClass": 0, "type": 16, "constructed": true, "composed": true, "value": [{ "tagClass": 0, "type": 6, "constructed": false, "composed": false, "value": forge.asn1.oidToDer("1.3.6.1.4.1.311.2.1.15").data }, { "tagClass": 0, "type": 16, "constructed": true, "composed": true, "value": [{ "tagClass": 0, "type": 3, "constructed": false, "composed": false, "value": "\u0000", "bitStringContents": "\u0000", "original": { "tagClass": 0, "type": 3, "constructed": false, "composed": false, "value": "\u0000" } }, { "tagClass": 128, "type": 0, "constructed": true, "composed": true, "value": [{ "tagClass": 128, "type": 2, "constructed": true, "composed": true, "value": [{ "tagClass": 128, "type": 0, "constructed": false, "composed": false, "value": "" }] }] }] }] }, { "tagClass": 0, "type": 16, "constructed": true, "composed": true, "value": [{ "tagClass": 0, "type": 16, "constructed": true, "composed": true, "value": [{ "tagClass": 0, "type": 6, "constructed": false, "composed": false, "value": forge.asn1.oidToDer(forge.pki.oids.sha384).data }, { "tagClass": 0, "type": 5, "constructed": false, "composed": false, "value": "" }] }, { "tagClass": 0, "type": 4, "constructed": false, "composed": false, "value": fileHash.toString('binary') }] }] });
190
p7.addCertificate(cert);
191
p7.addSigner({
192
key: key,
@@ -192,27 +194,27 @@ function createAuthenticodeHandler(path) {
194
digestAlgorithm: forge.pki.oids.sha384,
195
authenticatedAttributes:
196
[
195
- {
196
- type: obj.Oids.SPC_INDIRECT_DATA_OBJID,
197
- },
198
- {
199
- type: forge.pki.oids.contentType,
200
- value: forge.pki.oids.data
201
- },
202
- {
203
- type: forge.pki.oids.messageDigest
204
- // value will be auto-populated at signing time
205
- },
206
- {
207
- type: forge.pki.oids.signingTime,
208
- // value can also be auto-populated at signing time
209
- value: new Date()
210
- }
197
+ { type: obj.Oids.SPC_INDIRECT_DATA_OBJID, },
198
+ { type: forge.pki.oids.contentType, value: forge.pki.oids.data },
199
+ { type: forge.pki.oids.messageDigest }, // value will be auto-populated at signing time
200
+ { type: forge.pki.oids.signingTime, value: new Date() } // value can also be auto-populated at signing time
201
]
202
});
203
p7.sign();
204
var p7signature = Buffer.from(forge.pkcs7.messageToPem(p7).split('-----BEGIN PKCS7-----')[1].split('-----END PKCS7-----')[0], 'base64');
215
- console.log('p7signature', p7signature.toString('base64'));
205
+
206
+ // Correct the signed data type
207
+ // Decode the signature block
208
+ var pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(p7signature.toString('binary')));
209
+
210
+ // To work around ForgeJS PKCS#7 limitation
211
+ // Switch content type from 1.2.840.113549.1.7.1 to forge.pki.oids.data (1.3.6.1.4.1.311.2.1.4)
212
+ pkcs7der.value[1].value[0].value[2].value[0].value = forge.asn1.oidToDer('1.3.6.1.4.1.311.2.1.4').data;
213
+
214
+ // Convert the ASN1 content data into binary and place back
215
+ var pkcs7content = forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(pkcs7der.value[1].value[0].value[2].value[1].value[0].value, 'binary').toString('binary')));
216
+ pkcs7der.value[1].value[0].value[2].value[1].value = [ pkcs7content ];
217
+ p7signature = Buffer.from(forge.asn1.toDer(pkcs7der).data, 'binary');
218
219
// Create the output filename
220
var outputFileName = this.path.split('.');
@@ -236,8 +238,6 @@ function createAuthenticodeHandler(path) {
238
239
// Write the signature header
240
var addresstable = Buffer.alloc(8);
239
- console.log('executableSize', executableSize);
240
- console.log('signLength', p7signature.length, padding);
241
addresstable.writeUInt32LE(executableSize);
242
addresstable.writeUInt32LE(8 + p7signature.length + padding, 4);
243
fs.writeSync(output, addresstable);
@@ -338,10 +338,10 @@ function start() {
338
console.log('FileLen: ' + exe.filesize);
339
}
340
if (command == 'sign') {
341
- console.log('Signing...'); exe.sign();
341
+ console.log('Signing...'); exe.sign(); console.log('Done.');
342
}
343
if (command == 'unsign') {
344
- if (exe.header.signed) { console.log('Unsigning...'); exe.unsign(); } else { console.log('Executable is not signed.'); }
344
+ if (exe.header.signed) { console.log('Unsigning...'); exe.unsign(); console.log('Done.'); } else { console.log('Executable is not signed.'); }
345
}
346
347
// Close the file