microsoft / microsoft/AttackSurfaceAnalyzer
PE Net exception on Google drive files
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 3k
- Forks
- 294
- PR merge metrics
- No merged PRs in 30d
Description
To reproduce: Install "Google Drive for Desktop". You should now have a virtual drive letter (e.g. G:) mapped to Google Drive.
Run: asa collect -a
Get the following error once it gets to scanning the virtual drive:
[10:16:01 INF] Scanning root G:
Fatal error. Fatal error. System.Runtime.InteropServices.SEHException (0x80004005): External component has thrown an exception.
System.Runtime.InteropServices.SEHException (0x80004005): External component has thrown an exception.
at System.IO.UnmanagedMemoryAccessor.ReadInt32(Int64)
at System.Buffer.Memmove(Byte*, Byte*, UIntPtr)
at PeNet.Header.Pe.WinCertificate.get_BCertificate()
at System.Runtime.InteropServices.SafeBuffer.ReadArray[[System.Byte, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](UInt64, Byte[], Int32, Int32)
at PeNet.Header.Authenticode.AuthenticodeInfo..ctor(PeNet.PeFile)
at System.IO.UnmanagedMemoryAccessor.ReadArray[[System.Byte, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](Int64, Byte[], Int32, Int32)
at PeNet.HeaderParser.Authenticode.AuthenticodeParser.ParseTarget()
at PeNet.FileParser.MMFile.ToArray()
at Microsoft.CST.AttackSurfaceAnalyzer.Collectors.WindowsFileSystemUtils.GetSignatureStatus(System.String)
at PeNet.Header.Authenticode.AuthenticodeInfo.ComputeAuthenticodeHashFromPeFile(System.Security.Cryptography.HashAlgorithm)
at Microsoft.CST.AttackSurfaceAnalyzer.Collectors.FileSystemCollector.FilePathToFileSystemObject(System.String)
at PeNet.Header.Authenticode.AuthenticodeInfo.VerifyHash()
at Microsoft.CST.AttackSurfaceAnalyzer.Collectors.FileSystemCollector.ParseFile(System.String)
at PeNet.Header.Authenticode.AuthenticodeInfo..ctor(PeNet.PeFile)
at System.Threading.Tasks.Parallel+<>c__DisplayClass44_02[[System.__Canon, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e],[System.__Canon, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].<PartitionerForEachWorker>b__1(System.Collections.IEnumerator ByRef, Int32, Boolean ByRef)
at PeNet.HeaderParser.Authenticode.AuthenticodeParser.ParseTarget()
at System.Threading.Tasks.TaskReplicator+Replica.Execute()
at Microsoft.CST.AttackSurfaceAnalyzer.Collectors.WindowsFileSystemUtils.GetSignatureStatus(System.String)
at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(System.Threading.Thread, System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at Microsoft.CST.AttackSurfaceAnalyzer.Collectors.FileSystemCollector.FilePathToFileSystemObject(System.String)
at System.Threading.Tasks.Task.ExecuteWithThreadLocal(System.Threading.Tasks.Task ByRef, System.Threading.Thread)
at Microsoft.CST.AttackSurfaceAnalyzer.Collectors.FileSystemCollector.ParseFile(System.String)
at System.Threading.ThreadPoolWorkQueue.Dispatch()
at System.Threading.Tasks.Parallel+<>c__DisplayClass44_02[[System.__Canon, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e],[System.__Canon, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].b__1(System.Collections.IEnumerator ByRef, Int32, Boolean ByRef)
at System.Threading.Tasks.TaskReplicator+Replica.Execute()
at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(System.Threading.Thread, System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Threading.Tasks.Task.ExecuteWithThreadLocal(System.Threading.Tasks.Task ByRef, System.Threading.Thread)
at System.Threading.ThreadPoolWorkQueue.Dispatch()
A potential workaround would be to allow specifying a list of drive letters to exclude.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure with Google Drive for Desktop and asa collect -a against its virtual drive. Start at WindowsFileSystemUtils.GetSignatureStatus and FileSystemCollector, then trace the PeNet Authenticode path shown in the stack trace. Done means scanning the virtual drive no longer terminates with the SEHException, with drive exclusion considered as the reported workaround.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100