MyFavMirrors
/
MeshCentral
mirror of https://github.com/Ylianst/MeshCentral.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixed authenticode PS checksum calculation.

This commit is contained in:
Ylian Saint-Hilaire 2022-06-08 14:52:50 -07:00
parent 00a7c37d5a
commit 85fc1a4d4c
2 changed files with 15 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
authenticode.js
View File

@ -744,26 +744,26 @@ function createAuthenticodeHandler(path) {
// Checksum the file loading 64k chunks
function runChecksum() {
var ptr = 0, c = createChecksum();
var ptr = 0, c = createChecksum(((obj.header.peOptionalHeaderLocation + 64) / 4));
while (ptr < obj.filesize) { const buf = readFileSlice(ptr, Math.min(65536, obj.filesize - ptr)); c.update(buf); ptr += buf.length; }
return c.digest();
}
// Checksum the open file loading 64k chunks
function runChecksumOnFile(fd, filesize) {
var ptr = 0, c = createChecksum(), buf = Buffer.alloc(65536);
function runChecksumOnFile(fd, filesize, checksumLocation) {
var ptr = 0, c = createChecksum(checksumLocation), buf = Buffer.alloc(65536);
while (ptr < filesize) { var len = fs.readSync(fd, buf, 0, Math.min(65536, filesize - ptr), ptr); c.update(buf, len); ptr += len; }
return c.digest();
}
// Steaming checksum methods
// TODO: Works only with files padded to 4 byte.
function createChecksum() {
function createChecksum(checksumLocation) {
const obj = { checksum: 0, length: 0 };
obj.update = function (data, len) {
if (!len) { len = data.length; }
for (var i = 0; i < (len / 4) ; i++) {
if (((obj.length / 4) + i) == 54) continue; // Skip PE checksum location
if (((obj.length / 4) + i) == checksumLocation) continue; // Skip PE checksum location
const dword = data.readUInt32LE(i * 4);
var checksumlo = (obj.checksum > 4294967296) ? (obj.checksum - 4294967296) : obj.checksum;
var checksumhi = (obj.checksum > 4294967296) ? 1 : 0;
@ -786,34 +786,11 @@ function createAuthenticodeHandler(path) {
return obj;
}
// Simple checksum method that works on a complete file at once
// TODO: Works only with files padded to 4 byte.
function updateChecksum(data) {
var checksum = 0;
for (var i = 0; i < (data.length / 4) ; i++) {
if (i == 54) continue; // Skip PE checksum location
var dword = data.readUInt32LE(i * 4);
var checksumlo = (checksum > 4294967296) ? (checksum - 4294967296) : checksum;
var checksumhi = (checksum > 4294967296) ? 1 : 0;
checksum = checksumlo + dword + checksumhi;
if (checksum > 4294967296) {
checksumlo = (checksum > 4294967296) ? (checksum - 4294967296) : checksum;
checksumhi = (checksum > 4294967296) ? 1 : 0;
checksum = checksumlo + checksumhi;
}
}
checksum = (checksum & 0xffff) + (checksum >>> 16);
checksum = (checksum) + (checksum >>> 16);
checksum = checksum & 0xffff;
checksum += data.length;
return checksum;
}
// Compute the PE checksum of an entire file
function getChecksum(data) {
function getChecksum(data, checksumLocation) {
var checksum = 0;
for (var i = 0; i < (data.length / 4) ; i++) {
if (i == 54) continue; // Skip PE checksum location
if (i == (checksumLocation / 4)) continue; // Skip PE checksum location
var dword = data.readUInt32LE(i * 4);
var checksumlo = (checksum > 4294967296) ? (checksum - 4294967296) : checksum;
var checksumhi = (checksum > 4294967296) ? 1 : 0;
@ -920,12 +897,12 @@ function createAuthenticodeHandler(path) {
fs.writeSync(output, win);
fs.writeSync(output, p7signature);
if (padding > 0) { fs.writeSync(output, Buffer.alloc(padding, 0)); }
written += p7signature.length + padding + 8;
written += (p7signature.length + padding + 8);
// Compute the checksum and write it in the PE header at position (54 * 4)
// Compute the checksum and write it in the PE header checksum location
var tmp = Buffer.alloc(4);
tmp.writeUInt32LE(runChecksumOnFile(output, written));
fs.writeSync(output, tmp, 0, 4, 54 * 4);
tmp.writeUInt32LE(runChecksumOnFile(output, written, ((obj.header.peOptionalHeaderLocation + 64) / 4)));
fs.writeSync(output, tmp, 0, 4, obj.header.peOptionalHeaderLocation + 64);
// Close the file
fs.closeSync(output);
@ -955,10 +932,10 @@ function createAuthenticodeHandler(path) {
written += tmp.length;
}
// Compute the checksum and write it in the PE header at position (54 * 4)
// Compute the checksum and write it in the PE checksum header at position
var tmp = Buffer.alloc(4);
tmp.writeUInt32LE(runChecksumOnFile(output, written));
fs.writeSync(output, tmp, 0, 4, 54 * 4);
fs.writeSync(output, tmp, 0, 4, obj.header.peOptionalHeaderLocation + 64);
fs.closeSync(output);
}

4
public/translate.bat
View File

@ -1,7 +1,7 @@
@ECHO OFF
CD ..\translate
%LOCALAPPDATA%\..\Roaming\nvm\v12.13.0\node translate.js minifyall
REM %LOCALAPPDATA%\..\Roaming\nvm\v12.13.0\node translate.js translateall
REM %LOCALAPPDATA%\..\Roaming\nvm\v12.13.0\node translate.js extractall
%LOCALAPPDATA%\..\Roaming\nvm\v12.13.0\node translate.js translateall
%LOCALAPPDATA%\..\Roaming\nvm\v12.13.0\node translate.js extractall
DEL ..\emails\translations\*-min_*
Pause