google / google/authenticode-rs
Cannot retrieve signature when it contains duplicates
- Dominant language
- Rust
- Stars
- 36
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
It seems that there is no way of retrieving authenticode signatures when the signature contains duplicates.
Duplicates doesn't make the signature invalid per Windows terms.
From what I understood, signatures are parsed from the `AuthenticodeSignature::from_bytes`:
https://github.com/google/authenticode-rs/blob/4af7f9b734666db361ddadef1cdbf79da9ebd6d4/authenticode/src/signature.rs#L124-L229
This method, when parsing the file `004fb2c36532c00d3c3eb041c12fba99d26eb900880a361cb664f76e4d022a26` (which you can download [here](https://bazaar.abuse.ch/sample/004fb2c36532c00d3c3eb041c12fba99d26eb900880a361cb664f76e4d022a26/), **CAUTION: THIS IS A MALWARE, do not execute**) throws a der::Error of kind `SetDuplicate`.
The signature still is valid authenticode.
I have no idea how to approach this issue.
Any idea how this could be improved ?
Contributor guide
Assessment
This issue has not been assessed yet.