Add cryptographic verification to authenticode_transplant.py #326
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit adds comprehensive cryptographic validation to the Authenticode signature combining tool, bringing the same verification capabilities from auth_var_tool.py to PE file signature operations. Key changes: - Added cryptographic signature verification using the 'cryptography' library - Implemented SpcIndirectDataContent parsing to extract embedded PE hashes - Added certificate extraction and display from PKCS#7 signatures - Compute Authenticode hashes using the algorithm specified in the signature - Verify signatures mathematically using signer's public key (RSA/ECDSA) - Validate that computed PE hash matches the hash in SpcIndirectDataContent New functions: - _get_hash_algorithm_from_oid(): Maps OID strings to hash algorithms - _extract_pe_hash_from_spc_indirect_data(): Parses SPC structure for hash - _extract_certificates_from_pkcs7(): Extracts X.509 certificates - _verify_pkcs7_signature(): Performs full cryptographic verification - compute_authenticode_hash(): Flexible hash computation with configurable algorithm Enhanced functions: - validate_pkcs7_signatures(): Now performs cryptographic verification - main_verify(): Displays certificate details and verification status - main_combine(): Validates signatures cryptographically before combining Bug fixes: - Removed incorrect 8-byte padding from Authenticode hash calculation (padding only applies to WIN_CERTIFICATE structure alignment, not hash data) - Consolidated duplicate hash functions into single implementation Code improvements: - Named constants for all magic numbers in SPC parsing - Better documentation and inline comments - Proper type annotations with Optional types - Enhanced logging with ✓/✗ symbols for verification results Testing: - Verified against Microsoft-signed bootmgfw.efi files - Hash computation now matches Windows AppLocker and UEFI firmware - Both multi-signature and nested signature modes validated - All test cases pass with cryptographic verification Follows Microsoft Authenticode PE specification v1.1
There was a problem hiding this comment.
Pull request overview
This PR adds comprehensive cryptographic verification capabilities to the Authenticode signature tool, enabling validation of PE file signatures using the cryptography library. The changes introduce hash extraction from SPC structures, certificate parsing, and full signature verification against PE files.
Key changes:
- Added cryptographic signature verification using new helper functions for OID mapping, certificate extraction, and PKCS7 verification
- Enhanced
compute_authenticode_hash()to support multiple hash algorithms (SHA1/256/384/512) and removed incorrect padding logic - Updated
validate_pkcs7_signatures()and verification commands to perform cryptographic validation before accepting signatures
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Flickdm
force-pushed
the
feature/auth_transplant/cryptographic_validation
branch
from
91c807c to
d8166a7
Compare
Fix ruff linting errors by adding the missing OID constants: - OID_SHA384_DER and OID_SHA384_STRING for SHA-384 hash algorithm - OID_SHA512_DER and OID_SHA512_STRING for SHA-512 hash algorithm These constants are referenced in the hash extraction logic but were not defined.
Flickdm
force-pushed
the
feature/auth_transplant/cryptographic_validation
branch
from
d8166a7 to
0cee114
Compare
- Add try-finally block in compute_authenticode_hash to ensure PE object is properly closed - Add cryptography==43.0.0 to pip-requirements.txt (missing dependency) - Improve type annotations: change dict to Dict[str, Any] for _verify_pkcs7_signature - Enhance docstring to document return dictionary structure
Javagedes
reviewed
Jan 21, 2026
| return None, None | ||
|
|
||
| except Exception as e: | ||
| logger.debug(f"Failed to parse SpcIndirectDataContent: {e}") |
Contributor
There was a problem hiding this comment.
nit: probably an error log.
Javagedes
reviewed
Jan 21, 2026
| return hash_bytes, algorithm_oid | ||
| i += 1 | ||
|
|
||
| logger.debug("No hash found in SpcIndirectDataContent") |
Contributor
There was a problem hiding this comment.
nit; maybe a warning is more appropriate? or info?
Javagedes
reviewed
Jan 21, 2026
| certificates.append(cert) | ||
|
|
||
| except Exception as e: | ||
| logger.debug(f"Failed to extract certificates: {e}") |
Contributor
There was a problem hiding this comment.
nit: maybe info or warn?
Javagedes
approved these changes
Jan 21, 2026
apop5
approved these changes
Jan 28, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit adds comprehensive cryptographic validation to the Authenticode signature combining tool, bringing the same verification capabilities from auth_var_tool.py to PE file signature operations.
Key changes:
New functions:
Enhanced functions:
Bug fixes:
Code improvements:
Testing:
Follows Microsoft Authenticode PE specification v1.1
Description
How This Was Tested
Ran it against copies of bootmgfw.efi and hellouefi.efi that were both singly signed and
Integration Instructions
N/A