external/MeshCentral
1
0
Fork 0
mirror of https://github.com/Ylianst/MeshCentral.git synced 2025-02-12 11:01:52 +00:00
Code Issues Releases Wiki Activity

Fixed authenticode PS checksum calculation.

Browse source
This commit is contained in:
Ylian Saint-Hilaire 2022-06-08 14:52:50 -07:00
parent 00a7c37d5a
commit 85fc1a4d4c
2 changed files with 15 additions and 38 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

49
authenticode.js
View file

@ -744,26 +744,26 @@ function createAuthenticodeHandler(path) {
// Checksum the file loading 64k chunks // Checksum the file loading 64k chunks
function runChecksum() { function runChecksum() {
var ptr = 0, c = createChecksum(); var ptr = 0, c = createChecksum(((obj.header.peOptionalHeaderLocation + 64) / 4));
while (ptr < obj.filesize) { const buf = readFileSlice(ptr, Math.min(65536, obj.filesize - ptr)); c.update(buf); ptr += buf.length; } while (ptr < obj.filesize) { const buf = readFileSlice(ptr, Math.min(65536, obj.filesize - ptr)); c.update(buf); ptr += buf.length; }
return c.digest(); return c.digest();
} }
// Checksum the open file loading 64k chunks // Checksum the open file loading 64k chunks
function runChecksumOnFile(fd, filesize) { function runChecksumOnFile(fd, filesize, checksumLocation) {
var ptr = 0, c = createChecksum(), buf = Buffer.alloc(65536); var ptr = 0, c = createChecksum(checksumLocation), buf = Buffer.alloc(65536);
while (ptr < filesize) { var len = fs.readSync(fd, buf, 0, Math.min(65536, filesize - ptr), ptr); c.update(buf, len); ptr += len; } while (ptr < filesize) { var len = fs.readSync(fd, buf, 0, Math.min(65536, filesize - ptr), ptr); c.update(buf, len); ptr += len; }
return c.digest(); return c.digest();
} }
// Steaming checksum methods // Steaming checksum methods
// TODO: Works only with files padded to 4 byte. // TODO: Works only with files padded to 4 byte.
function createChecksum() { function createChecksum(checksumLocation) {
const obj = { checksum: 0, length: 0 }; const obj = { checksum: 0, length: 0 };
obj.update = function (data, len) { obj.update = function (data, len) {
if (!len) { len = data.length; } if (!len) { len = data.length; }
for (var i = 0; i < (len / 4) ; i++) { for (var i = 0; i < (len / 4) ; i++) {
if (((obj.length / 4) + i) == 54) continue; // Skip PE checksum location if (((obj.length / 4) + i) == checksumLocation) continue; // Skip PE checksum location
const dword = data.readUInt32LE(i * 4); const dword = data.readUInt32LE(i * 4);
var checksumlo = (obj.checksum > 4294967296) ? (obj.checksum - 4294967296) : obj.checksum; var checksumlo = (obj.checksum > 4294967296) ? (obj.checksum - 4294967296) : obj.checksum;
var checksumhi = (obj.checksum > 4294967296) ? 1 : 0; var checksumhi = (obj.checksum > 4294967296) ? 1 : 0;
@ -786,34 +786,11 @@ function createAuthenticodeHandler(path) {
return obj; return obj;
} }
// Simple checksum method that works on a complete file at once
// TODO: Works only with files padded to 4 byte.
function updateChecksum(data) {
var checksum = 0;
for (var i = 0; i < (data.length / 4) ; i++) {
if (i == 54) continue; // Skip PE checksum location
var dword = data.readUInt32LE(i * 4);
var checksumlo = (checksum > 4294967296) ? (checksum - 4294967296) : checksum;
var checksumhi = (checksum > 4294967296) ? 1 : 0;
checksum = checksumlo + dword + checksumhi;
if (checksum > 4294967296) {
checksumlo = (checksum > 4294967296) ? (checksum - 4294967296) : checksum;
checksumhi = (checksum > 4294967296) ? 1 : 0;
checksum = checksumlo + checksumhi;
}
}
checksum = (checksum & 0xffff) + (checksum >>> 16);
checksum = (checksum) + (checksum >>> 16);
checksum = checksum & 0xffff;
checksum += data.length;
return checksum;
}
// Compute the PE checksum of an entire file // Compute the PE checksum of an entire file
function getChecksum(data) { function getChecksum(data, checksumLocation) {
var checksum = 0; var checksum = 0;
for (var i = 0; i < (data.length / 4) ; i++) { for (var i = 0; i < (data.length / 4) ; i++) {
if (i == 54) continue; // Skip PE checksum location if (i == (checksumLocation / 4)) continue; // Skip PE checksum location
var dword = data.readUInt32LE(i * 4); var dword = data.readUInt32LE(i * 4);
var checksumlo = (checksum > 4294967296) ? (checksum - 4294967296) : checksum; var checksumlo = (checksum > 4294967296) ? (checksum - 4294967296) : checksum;
var checksumhi = (checksum > 4294967296) ? 1 : 0; var checksumhi = (checksum > 4294967296) ? 1 : 0;
@ -920,12 +897,12 @@ function createAuthenticodeHandler(path) {
fs.writeSync(output, win); fs.writeSync(output, win);
fs.writeSync(output, p7signature); fs.writeSync(output, p7signature);
if (padding > 0) { fs.writeSync(output, Buffer.alloc(padding, 0)); } if (padding > 0) { fs.writeSync(output, Buffer.alloc(padding, 0)); }
written += p7signature.length + padding + 8; written += (p7signature.length + padding + 8);
// Compute the checksum and write it in the PE header at position (54 * 4) // Compute the checksum and write it in the PE header checksum location
var tmp = Buffer.alloc(4); var tmp = Buffer.alloc(4);
tmp.writeUInt32LE(runChecksumOnFile(output, written)); tmp.writeUInt32LE(runChecksumOnFile(output, written, ((obj.header.peOptionalHeaderLocation + 64) / 4)));
fs.writeSync(output, tmp, 0, 4, 54 * 4); fs.writeSync(output, tmp, 0, 4, obj.header.peOptionalHeaderLocation + 64);
// Close the file // Close the file
fs.closeSync(output); fs.closeSync(output);
@ -955,10 +932,10 @@ function createAuthenticodeHandler(path) {
written += tmp.length; written += tmp.length;
} }
// Compute the checksum and write it in the PE header at position (54 * 4) // Compute the checksum and write it in the PE checksum header at position
var tmp = Buffer.alloc(4); var tmp = Buffer.alloc(4);
tmp.writeUInt32LE(runChecksumOnFile(output, written)); tmp.writeUInt32LE(runChecksumOnFile(output, written));
fs.writeSync(output, tmp, 0, 4, 54 * 4); fs.writeSync(output, tmp, 0, 4, obj.header.peOptionalHeaderLocation + 64);
fs.closeSync(output); fs.closeSync(output);
} }

4
public/translate.bat
View file

@ -1,7 +1,7 @@
@ECHO OFF @ECHO OFF
CD ..\translate CD ..\translate
%LOCALAPPDATA%\..\Roaming\nvm\v12.13.0\node translate.js minifyall %LOCALAPPDATA%\..\Roaming\nvm\v12.13.0\node translate.js minifyall
REM %LOCALAPPDATA%\..\Roaming\nvm\v12.13.0\node translate.js translateall %LOCALAPPDATA%\..\Roaming\nvm\v12.13.0\node translate.js translateall
REM %LOCALAPPDATA%\..\Roaming\nvm\v12.13.0\node translate.js extractall %LOCALAPPDATA%\..\Roaming\nvm\v12.13.0\node translate.js extractall
DEL ..\emails\translations\*-min_* DEL ..\emails\translations\*-min_*
Pause Pause