LIEF: Library to Instrument Executable Formats Version 2.0.0
Loading...
Searching...
No Matches
SignatureParser.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2026 R. Thomas
2 * Copyright 2017 - 2026 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_SIGNATURE_PARSER_H
17#define LIEF_PE_SIGNATURE_PARSER_H
18#include <string_view>
19#include <array>
20#include <memory>
21#include <string>
22
23#include "LIEF/errors.hpp"
24#include "LIEF/path.hpp"
25
27
28namespace LIEF {
29class BinaryStream;
30class VectorStream;
31
32namespace PE {
33class Parser;
34class Attribute;
35class SpcIndirectData;
36class PKCS9TSTInfo;
37
39 friend class Parser;
40 struct SpcPeImageData {
41 uint32_t flags;
42 std::string file;
43 };
44
45 struct SpcSpOpusInfo {
46 std::string program_name;
47 std::string more_info;
48 };
49 struct range_t {
50 uint64_t start = 0;
51 uint64_t end = 0;
52 };
53
54 public:
55 using attributes_t = std::vector<std::unique_ptr<Attribute>>;
56 using signer_infos_t = std::vector<SignerInfo>;
57 using x509_certificates_t = std::vector<x509>;
58 using time_t = std::array<int32_t, 6>;
59
61 static result<Signature> parse(std::vector<uint8_t> data,
62 bool skip_header = false);
63
65 static result<Signature> parse(BinaryStream& stream, bool skip_header = false);
66
68 static result<Signature> parse(std::string_view path);
69
72 template<class PathT, enable_if_path_t<PathT> = 0>
73 static result<Signature> parse(const PathT& path) {
74 return parse(path.string());
75 }
78
79 private:
80 ~SignatureParser() = default;
81 SignatureParser() = default;
82
83 static result<Signature> parse_signature(BinaryStream& stream);
84
85 static result<ContentInfo> parse_content_info(BinaryStream& stream,
86 range_t& range);
87 static result<x509_certificates_t> parse_certificates(BinaryStream& stream);
88 static result<signer_infos_t> parse_signer_infos(BinaryStream& stream);
89 static result<attributes_t> parse_attributes(BinaryStream& stream);
91 parse_content_type(BinaryStream& stream);
92
93 static result<signer_infos_t> parse_pkcs9_counter_sign(BinaryStream& stream);
95 parse_pkcs9_message_digest(BinaryStream& stream);
96 static result<int32_t> parse_pkcs9_at_sequence_number(BinaryStream& stream);
97 static result<time_t> parse_pkcs9_signing_time(BinaryStream& stream);
99 parse_pkcs9_tstinfo(BinaryStream& stream);
100
102 parse_ms_counter_sign(BinaryStream& stream);
103 static result<Signature> parse_ms_spc_nested_signature(BinaryStream& stream);
104 static result<oid_t> parse_ms_spc_statement_type(BinaryStream& stream);
105 static result<SpcSpOpusInfo> parse_spc_sp_opus_info(BinaryStream& stream);
106 static result<std::string> parse_spc_string(BinaryStream& stream);
107 static result<std::string> parse_spc_link(BinaryStream& stream);
109 parse_spc_relaxed_pe_marker_check(BinaryStream& stream);
110 static result<SpcPeImageData> parse_spc_pe_image_data(BinaryStream& stream);
112 parse_spc_indirect_data(BinaryStream& stream, range_t& range);
114 parse_ms_platform_manifest_binary_id(BinaryStream& stream);
115
117 parse_signing_certificate_v2(BinaryStream& stream);
118};
119
120}
121}
122
123#endif
Class that is used to a read stream of data from different sources.
Definition BinaryStream.hpp:35
Interface over PKCS #7 attribute.
Definition PE/signature/Attribute.hpp:29
Interface over the structure described by the OID 1.2.840.113549.1.9.16.1.4 (PKCS #9).
Definition PKCS9TSTInfo.hpp:60
Main interface to parse PE binaries. In particular, the static Parser::parse functions should be used...
Definition PE/Parser.hpp:54
static result< Signature > parse(std::vector< uint8_t > data, bool skip_header=false)
Parse a PKCS #7 signature given a raw blob.
std::vector< x509 > x509_certificates_t
Definition SignatureParser.hpp:57
static result< Signature > parse(const PathT &path)
Same as parse(std::string_view) but the file is given as a std::filesystem::path.
Definition SignatureParser.hpp:73
static result< Signature > parse(BinaryStream &stream, bool skip_header=false)
Parse a PKCS #7 signature given a BinaryStream.
std::vector< SignerInfo > signer_infos_t
Definition SignatureParser.hpp:56
std::vector< std::unique_ptr< Attribute > > attributes_t
Definition SignatureParser.hpp:55
std::array< int32_t, 6 > time_t
Definition SignatureParser.hpp:58
SignatureParser & operator=(const SignatureParser &)=delete
SignatureParser(const SignatureParser &)=delete
static result< Signature > parse(std::string_view path)
Parse a PKCS #7 signature from a file path.
friend class Parser
Definition SignatureParser.hpp:39
Definition SpcIndirectData.hpp:32
Interface over the structure described by the OID 1.3.6.1.4.1.311.2.1.12.
Definition SpcSpOpusInfo.hpp:41
Definition VectorStream.hpp:29
Wrapper that contains an Object (T) or an error.
Definition errors.hpp:79
Namespace related to the LIEF's PE module.
Definition Abstract/Header.hpp:32
LIEF namespace.
Definition Abstract/Binary.hpp:41
Definition range.hpp:23
#define LIEF_API
Definition visibility.h:45