google / google/authenticode-rs

Cannot retrieve signature when it contains duplicates

Open
#255 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
36
Forks
17
PR merge metrics
No merged PRs in 30d

Description

Hello,

It seems that there is no way of retrieving authenticode signatures when the signature contains duplicates.
Duplicates doesn't make the signature invalid per Windows terms.

From what I understood, signatures are parsed from the `AuthenticodeSignature::from_bytes`:

https://github.com/google/authenticode-rs/blob/4af7f9b734666db361ddadef1cdbf79da9ebd6d4/authenticode/src/signature.rs#L124-L229

This method, when parsing the file `004fb2c36532c00d3c3eb041c12fba99d26eb900880a361cb664f76e4d022a26` (which you can download [here](https://bazaar.abuse.ch/sample/004fb2c36532c00d3c3eb041c12fba99d26eb900880a361cb664f76e4d022a26/), **CAUTION: THIS IS A MALWARE, do not execute**) throws a der::Error of kind `SetDuplicate`.

The signature still is valid authenticode.

I have no idea how to approach this issue.

Any idea how this could be improved ?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.