m4b / m4b/goblin

Compute Authentihash

Open
#355 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Rust
Stars
1.5k
Forks
202
PR merge metrics
No merged PRs in 30d

Description

It would be nice to be able to compute a PE binary "Authentihash" according to a hash algorithm.

This basically requires hashing the whole PE binary except: Windows checksum field, Certificate Table entry in Data Directory, Certificate Attributes entries somewhere after the sections.

I suggest proceeding by finding all the regions of interest, including the "junk at the end" (which can potentially contain other things).

I will try to hack something and submit it as a PR.

Contributor guide

No contributing guide indexed for this repository

Research direction

No file or test is named. Start by locating the PE parsing and hashing entry points, then trace the Windows checksum field, Certificate Table entry, certificate attributes after the sections, and trailing data. Done means computing the Authentihash while excluding exactly those regions, with coverage for binaries containing each region.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
reverse-engineering
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.