yara icon indicating copy to clipboard operation
yara copied to clipboard

Add signatures details in PE module when using Wincrypt

Open vthib opened this issue 2 years ago • 0 comments

The PE signatures fields depends on OpenSSL, which means they are completely missing when using any other crypto API. This PR aims to introduce some support of those fields when using the Windows API (wincrypt).

This support is only done for the 4.2 fields, before the addition of the authenticode dependency. This allows basic support which covers all the existing rules, and support for the newly added fields can be added in the future.

The code is fairly straightforward and not too complex. The only major issues are that three fields are dependent on OpenSSL specifics, which are:

  • algorithm, which is a human-readable string for the algorithm_oid.
  • issuer and subject, which depends on how OpenSSL converts a X509 name into a human readable string. X509_NAME_oneline is used, which is documented as being non standard. The wincrypt API generates another format, which can be seen in the documentation update included in this PR.

For algorithm, I have handled a special case for "sha1WithRSAEncryption" and "sha256WithRSAEncryption" so that those names are the same. For the rest, i'm using the wincrypt name. I don't think this is a big issue, as I'm not sure anything other than the previous two algorithms can really happen in authenticode, and the field is already documented as being subject to change, and algorithm_oid should be used instead.

For issuer and subject, in all of the rules that i have found, the matching is done on the content of one component and are not subject to changes on the separation of those components, so afaict the differences should be OK as well.

I have tried to match the existing coding style, If I made any mistakes please tell me and I will correct them.

Let me know if such a feature addition sounds OK for you, it would be a great help for us as we try to avoid depending on OpenSSL.

vthib avatar Oct 03 '22 16:10 vthib