RTSignTool.cpp@ 88823

Last change on this file since 88823 was 88588, checked in by vboxsync, 4 years ago
RTSignTool: Shut up assertion on deprecated digest.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 113.3 KB

Line
1	/* $Id: RTSignTool.cpp 88588 2021-04-19 23:02:54Z vboxsync $ */
2	/** @file
3	* IPRT - Signing Tool.
4	*/
5
6	/*
7	* Copyright (C) 2006-2020 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#include <iprt/assert.h>
32	#include <iprt/buildconfig.h>
33	#include <iprt/err.h>
34	#include <iprt/getopt.h>
35	#include <iprt/file.h>
36	#include <iprt/initterm.h>
37	#include <iprt/ldr.h>
38	#include <iprt/message.h>
39	#include <iprt/mem.h>
40	#include <iprt/path.h>
41	#include <iprt/stream.h>
42	#include <iprt/string.h>
43	#include <iprt/uuid.h>
44	#include <iprt/zero.h>
45	#ifndef RT_OS_WINDOWS
46	# include <iprt/formats/pecoff.h>
47	#endif
48	#include <iprt/crypto/applecodesign.h>
49	#include <iprt/crypto/digest.h>
50	#include <iprt/crypto/x509.h>
51	#include <iprt/crypto/pkcs7.h>
52	#include <iprt/crypto/store.h>
53	#include <iprt/crypto/spc.h>
54	#ifdef VBOX
55	# include <VBox/sup.h> /* Certificates */
56	#endif
57	#ifdef RT_OS_WINDOWS
58	# include <iprt/win/windows.h>
59	# include <iprt/win/imagehlp.h>
60	#endif
61
62
63	/*********************************************************************************************************************************
64	* Structures and Typedefs *
65	*********************************************************************************************************************************/
66	/** Help detail levels. */
67	typedef enum RTSIGNTOOLHELP
68	{
69	RTSIGNTOOLHELP_USAGE,
70	RTSIGNTOOLHELP_FULL
71	} RTSIGNTOOLHELP;
72
73
74	/**
75	* PKCS\#7 signature data.
76	*/
77	typedef struct SIGNTOOLPKCS7
78	{
79	/** The raw signature. */
80	uint8_t *pbBuf;
81	/** Size of the raw signature. */
82	size_t cbBuf;
83	/** The filename. */
84	const char *pszFilename;
85	/** The outer content info wrapper. */
86	RTCRPKCS7CONTENTINFO ContentInfo;
87	/** Pointer to the decoded SignedData inside the ContentInfo member. */
88	PRTCRPKCS7SIGNEDDATA pSignedData;
89
90	/** Newly encoded raw signature.
91	* @sa SignToolPkcs7_Encode() */
92	uint8_t *pbNewBuf;
93	/** Size of newly encoded raw signature. */
94	size_t cbNewBuf;
95
96	} SIGNTOOLPKCS7;
97	typedef SIGNTOOLPKCS7 *PSIGNTOOLPKCS7;
98
99
100	/**
101	* PKCS\#7 signature data for executable.
102	*/
103	typedef struct SIGNTOOLPKCS7EXE : public SIGNTOOLPKCS7
104	{
105	/** The module handle. */
106	RTLDRMOD hLdrMod;
107	} SIGNTOOLPKCS7EXE;
108	typedef SIGNTOOLPKCS7EXE *PSIGNTOOLPKCS7EXE;
109
110
111	/**
112	* Data for the show exe (signature) command.
113	*/
114	typedef struct SHOWEXEPKCS7 : public SIGNTOOLPKCS7EXE
115	{
116	/** The verbosity. */
117	unsigned cVerbosity;
118	/** The prefix buffer. */
119	char szPrefix[256];
120	/** Temporary buffer. */
121	char szTmp[4096];
122	} SHOWEXEPKCS7;
123	typedef SHOWEXEPKCS7 *PSHOWEXEPKCS7;
124
125
126	/*********************************************************************************************************************************
127	* Internal Functions *
128	*********************************************************************************************************************************/
129	static RTEXITCODE HandleHelp(int cArgs, char **papszArgs);
130	static RTEXITCODE HelpHelp(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel);
131	static RTEXITCODE HandleVersion(int cArgs, char **papszArgs);
132	static int HandleShowExeWorkerPkcs7Display(PSHOWEXEPKCS7 pThis, PRTCRPKCS7SIGNEDDATA pSignedData, size_t offPrefix,
133	PCRTCRPKCS7CONTENTINFO pContentInfo);
134
135
136	/**
137	* Deletes the structure.
138	*
139	* @param pThis The structure to initialize.
140	*/
141	static void SignToolPkcs7_Delete(PSIGNTOOLPKCS7 pThis)
142	{
143	RTCrPkcs7ContentInfo_Delete(&pThis->ContentInfo);
144	pThis->pSignedData = NULL;
145	RTMemFree(pThis->pbBuf);
146	pThis->pbBuf = NULL;
147	pThis->cbBuf = 0;
148	RTMemFree(pThis->pbNewBuf);
149	pThis->pbNewBuf = NULL;
150	pThis->cbNewBuf = 0;
151	}
152
153
154	/**
155	* Deletes the structure.
156	*
157	* @param pThis The structure to initialize.
158	*/
159	static void SignToolPkcs7Exe_Delete(PSIGNTOOLPKCS7EXE pThis)
160	{
161	if (pThis->hLdrMod != NIL_RTLDRMOD)
162	{
163	int rc2 = RTLdrClose(pThis->hLdrMod);
164	if (RT_FAILURE(rc2))
165	RTMsgError("RTLdrClose failed: %Rrc\n", rc2);
166	pThis->hLdrMod = NIL_RTLDRMOD;
167	}
168	SignToolPkcs7_Delete(pThis);
169	}
170
171
172	/**
173	* Decodes the PKCS #7 blob pointed to by pThis->pbBuf.
174	*
175	* @returns IPRT status code (error message already shown on failure).
176	* @param pThis The PKCS\#7 signature to decode.
177	* @param fCatalog Set if catalog file, clear if executable.
178	*/
179	static int SignToolPkcs7_Decode(PSIGNTOOLPKCS7 pThis, bool fCatalog)
180	{
181	RTERRINFOSTATIC ErrInfo;
182	RTASN1CURSORPRIMARY PrimaryCursor;
183	RTAsn1CursorInitPrimary(&PrimaryCursor, pThis->pbBuf, (uint32_t)pThis->cbBuf, RTErrInfoInitStatic(&ErrInfo),
184	&g_RTAsn1DefaultAllocator, 0, "WinCert");
185
186	int rc = RTCrPkcs7ContentInfo_DecodeAsn1(&PrimaryCursor.Cursor, 0, &pThis->ContentInfo, "CI");
187	if (RT_SUCCESS(rc))
188	{
189	if (RTCrPkcs7ContentInfo_IsSignedData(&pThis->ContentInfo))
190	{
191	pThis->pSignedData = pThis->ContentInfo.u.pSignedData;
192
193	/*
194	* Decode the authenticode bits.
195	*/
196	if (!strcmp(pThis->pSignedData->ContentInfo.ContentType.szObjId, RTCRSPCINDIRECTDATACONTENT_OID))
197	{
198	PRTCRSPCINDIRECTDATACONTENT pIndData = pThis->pSignedData->ContentInfo.u.pIndirectDataContent;
199	Assert(pIndData);
200
201	/*
202	* Check that things add up.
203	*/
204	rc = RTCrPkcs7SignedData_CheckSanity(pThis->pSignedData,
205	RTCRPKCS7SIGNEDDATA_SANITY_F_AUTHENTICODE
206	\| RTCRPKCS7SIGNEDDATA_SANITY_F_ONLY_KNOWN_HASH
207	\| RTCRPKCS7SIGNEDDATA_SANITY_F_SIGNING_CERT_PRESENT,
208	RTErrInfoInitStatic(&ErrInfo), "SD");
209	if (RT_SUCCESS(rc))
210	{
211	rc = RTCrSpcIndirectDataContent_CheckSanityEx(pIndData,
212	pThis->pSignedData,
213	RTCRSPCINDIRECTDATACONTENT_SANITY_F_ONLY_KNOWN_HASH,
214	RTErrInfoInitStatic(&ErrInfo));
215	if (RT_FAILURE(rc))
216	RTMsgError("SPC indirect data content sanity check failed for '%s': %Rrc - %s\n",
217	pThis->pszFilename, rc, ErrInfo.szMsg);
218	}
219	else
220	RTMsgError("PKCS#7 sanity check failed for '%s': %Rrc - %s\n", pThis->pszFilename, rc, ErrInfo.szMsg);
221	}
222	else if (!strcmp(pThis->pSignedData->ContentInfo.ContentType.szObjId, RTCR_PKCS7_DATA_OID))
223	{ /* apple code signing */ }
224	else if (!fCatalog)
225	RTMsgError("Unexpected the signed content in '%s': %s (expected %s)", pThis->pszFilename,
226	pThis->pSignedData->ContentInfo.ContentType.szObjId, RTCRSPCINDIRECTDATACONTENT_OID);
227	}
228	else
229	rc = RTMsgErrorRc(VERR_CR_PKCS7_NOT_SIGNED_DATA,
230	"PKCS#7 content is inside '%s' is not 'signedData': %s\n",
231	pThis->pszFilename, pThis->ContentInfo.ContentType.szObjId);
232	}
233	else
234	RTMsgError("RTCrPkcs7ContentInfo_DecodeAsn1 failed on '%s': %Rrc - %s\n", pThis->pszFilename, rc, ErrInfo.szMsg);
235	return rc;
236	}
237
238
239	/**
240	* Reads and decodes PKCS\#7 signature from the given cat file.
241	*
242	* @returns RTEXITCODE_SUCCESS on success, RTEXITCODE_FAILURE with error message
243	* on failure.
244	* @param pThis The structure to initialize.
245	* @param pszFilename The catalog (or any other DER PKCS\#7) filename.
246	* @param cVerbosity The verbosity.
247	*/
248	static RTEXITCODE SignToolPkcs7_InitFromFile(PSIGNTOOLPKCS7 pThis, const char *pszFilename, unsigned cVerbosity)
249	{
250	/*
251	* Init the return structure.
252	*/
253	RT_ZERO(*pThis);
254	pThis->pszFilename = pszFilename;
255
256	/*
257	* Lazy bird uses RTFileReadAll and duplicates the allocation.
258	*/
259	void *pvFile;
260	int rc = RTFileReadAll(pszFilename, &pvFile, &pThis->cbBuf);
261	if (RT_SUCCESS(rc))
262	{
263	pThis->pbBuf = (uint8_t *)RTMemDup(pvFile, pThis->cbBuf);
264	RTFileReadAllFree(pvFile, pThis->cbBuf);
265	if (pThis->pbBuf)
266	{
267	if (cVerbosity > 2)
268	RTPrintf("PKCS#7 signature: %u bytes\n", pThis->cbBuf);
269
270	/*
271	* Decode it.
272	*/
273	rc = SignToolPkcs7_Decode(pThis, true /fCatalog/);
274	if (RT_SUCCESS(rc))
275	return RTEXITCODE_SUCCESS;
276	}
277	else
278	RTMsgError("Out of memory!");
279	}
280	else
281	RTMsgError("Error reading '%s' into memory: %Rrc", pszFilename, rc);
282
283	SignToolPkcs7_Delete(pThis);
284	return RTEXITCODE_FAILURE;
285	}
286
287
288	/**
289	* Encodes the signature into the SIGNTOOLPKCS7::pbNewBuf and
290	* SIGNTOOLPKCS7::cbNewBuf members.
291	*
292	* @returns RTEXITCODE_SUCCESS on success, RTEXITCODE_FAILURE with error message
293	* on failure.
294	* @param pThis The signature to encode.
295	* @param cVerbosity The verbosity.
296	*/
297	static RTEXITCODE SignToolPkcs7_Encode(PSIGNTOOLPKCS7 pThis, unsigned cVerbosity)
298	{
299	RTERRINFOSTATIC StaticErrInfo;
300	PRTASN1CORE pRoot = RTCrPkcs7ContentInfo_GetAsn1Core(&pThis->ContentInfo);
301	uint32_t cbEncoded;
302	int rc = RTAsn1EncodePrepare(pRoot, RTASN1ENCODE_F_DER, &cbEncoded, RTErrInfoInitStatic(&StaticErrInfo));
303	if (RT_SUCCESS(rc))
304	{
305	if (cVerbosity >= 4)
306	RTAsn1Dump(pRoot, 0, 0, RTStrmDumpPrintfV, g_pStdOut);
307
308	RTMemFree(pThis->pbNewBuf);
309	pThis->cbNewBuf = cbEncoded;
310	pThis->pbNewBuf = (uint8_t *)RTMemAllocZ(cbEncoded);
311	if (pThis->pbNewBuf)
312	{
313	rc = RTAsn1EncodeToBuffer(pRoot, RTASN1ENCODE_F_DER, pThis->pbNewBuf, pThis->cbNewBuf,
314	RTErrInfoInitStatic(&StaticErrInfo));
315	if (RT_SUCCESS(rc))
316	{
317	if (cVerbosity > 1)
318	RTMsgInfo("Encoded signature to %u bytes", cbEncoded);
319	return RTEXITCODE_SUCCESS;
320	}
321	RTMsgError("RTAsn1EncodeToBuffer failed: %Rrc", rc);
322
323	RTMemFree(pThis->pbNewBuf);
324	pThis->pbNewBuf = NULL;
325	}
326	else
327	RTMsgError("Failed to allocate %u bytes!", cbEncoded);
328	}
329	else
330	RTMsgError("RTAsn1EncodePrepare failed: %Rrc - %s", rc, StaticErrInfo.szMsg);
331	return RTEXITCODE_FAILURE;
332	}
333
334
335	/**
336	* Adds the @a pSrc signature as a nested signature.
337	*
338	* @returns RTEXITCODE_SUCCESS on success, RTEXITCODE_FAILURE with error message
339	* on failure.
340	* @param pThis The signature to modify.
341	* @param pSrc The signature to add as nested.
342	* @param cVerbosity The verbosity.
343	* @param fPrepend Whether to prepend (true) or append (false) the
344	* source signature to the nested attribute.
345	*/
346	static RTEXITCODE SignToolPkcs7_AddNestedSignature(PSIGNTOOLPKCS7 pThis, PSIGNTOOLPKCS7 pSrc,
347	unsigned cVerbosity, bool fPrepend)
348	{
349	PRTCRPKCS7SIGNERINFO pSignerInfo = pThis->pSignedData->SignerInfos.papItems[0];
350	int rc;
351
352	/*
353	* Deal with UnauthenticatedAttributes being absent before trying to append to the array.
354	*/
355	if (pSignerInfo->UnauthenticatedAttributes.cItems == 0)
356	{
357	/* HACK ALERT! Invent ASN.1 setters/whatever for members to replace this mess. */
358
359	if (pSignerInfo->AuthenticatedAttributes.cItems == 0)
360	return RTMsgErrorExit(RTEXITCODE_FAILURE, "No authenticated or unauthenticated attributes! Sorry, no can do.");
361
362	Assert(pSignerInfo->UnauthenticatedAttributes.SetCore.Asn1Core.uTag == 0);
363	rc = RTAsn1SetCore_Init(&pSignerInfo->UnauthenticatedAttributes.SetCore,
364	pSignerInfo->AuthenticatedAttributes.SetCore.Asn1Core.pOps);
365	if (RT_FAILURE(rc))
366	return RTMsgErrorExit(RTEXITCODE_FAILURE, "RTAsn1SetCore_Init failed: %Rrc", rc);
367	pSignerInfo->UnauthenticatedAttributes.SetCore.Asn1Core.uTag = 1;
368	pSignerInfo->UnauthenticatedAttributes.SetCore.Asn1Core.fClass = ASN1_TAGCLASS_CONTEXT \| ASN1_TAGFLAG_CONSTRUCTED;
369	RTAsn1MemInitArrayAllocation(&pSignerInfo->UnauthenticatedAttributes.Allocation,
370	pSignerInfo->AuthenticatedAttributes.Allocation.pAllocator,
371	sizeof(**pSignerInfo->UnauthenticatedAttributes.papItems));
372	}
373
374	/*
375	* Find or add an unauthenticated attribute for nested signatures.
376	*/
377	rc = VERR_NOT_FOUND;
378	PRTCRPKCS7ATTRIBUTE pAttr = NULL;
379	int32_t iPos = pSignerInfo->UnauthenticatedAttributes.cItems;
380	while (iPos-- > 0)
381	if (pSignerInfo->UnauthenticatedAttributes.papItems[iPos]->enmType == RTCRPKCS7ATTRIBUTETYPE_MS_NESTED_SIGNATURE)
382	{
383	pAttr = pSignerInfo->UnauthenticatedAttributes.papItems[iPos];
384	rc = VINF_SUCCESS;
385	break;
386	}
387	if (iPos < 0)
388	{
389	iPos = RTCrPkcs7Attributes_Append(&pSignerInfo->UnauthenticatedAttributes);
390	if (iPos >= 0)
391	{
392	if (cVerbosity >= 3)
393	RTMsgInfo("Adding UnauthenticatedAttribute #%u...", iPos);
394	Assert((uint32_t)iPos < pSignerInfo->UnauthenticatedAttributes.cItems);
395
396	pAttr = pSignerInfo->UnauthenticatedAttributes.papItems[iPos];
397	rc = RTAsn1ObjId_InitFromString(&pAttr->Type, RTCR_PKCS9_ID_MS_NESTED_SIGNATURE, pAttr->Allocation.pAllocator);
398	if (RT_SUCCESS(rc))
399	{
400	/** @todo Generalize the Type + enmType DYN stuff and generate setters. */
401	Assert(pAttr->enmType == RTCRPKCS7ATTRIBUTETYPE_NOT_PRESENT);
402	Assert(pAttr->uValues.pContentInfos == NULL);
403	pAttr->enmType = RTCRPKCS7ATTRIBUTETYPE_MS_NESTED_SIGNATURE;
404	rc = RTAsn1MemAllocZ(&pAttr->Allocation, (void **)&pAttr->uValues.pContentInfos,
405	sizeof(*pAttr->uValues.pContentInfos));
406	if (RT_SUCCESS(rc))
407	{
408	rc = RTCrPkcs7SetOfContentInfos_Init(pAttr->uValues.pContentInfos, pAttr->Allocation.pAllocator);
409	if (!RT_SUCCESS(rc))
410	RTMsgError("RTCrPkcs7ContentInfos_Init failed: %Rrc", rc);
411	}
412	else
413	RTMsgError("RTAsn1MemAllocZ failed: %Rrc", rc);
414	}
415	else
416	RTMsgError("RTAsn1ObjId_InitFromString failed: %Rrc", rc);
417	}
418	else
419	RTMsgError("RTCrPkcs7Attributes_Append failed: %Rrc", iPos);
420	}
421	else if (cVerbosity >= 2)
422	RTMsgInfo("Found UnauthenticatedAttribute #%u...", iPos);
423	if (RT_SUCCESS(rc))
424	{
425	/*
426	* Append/prepend the signature.
427	*/
428	uint32_t iActualPos = UINT32_MAX;
429	iPos = fPrepend ? 0 : pAttr->uValues.pContentInfos->cItems;
430	rc = RTCrPkcs7SetOfContentInfos_InsertEx(pAttr->uValues.pContentInfos, iPos, &pSrc->ContentInfo,
431	pAttr->Allocation.pAllocator, &iActualPos);
432	if (RT_SUCCESS(rc))
433	{
434	if (cVerbosity > 0)
435	RTMsgInfo("Added nested signature (#%u)", iActualPos);
436	if (cVerbosity >= 3)
437	{
438	RTMsgInfo("SingerInfo dump after change:");
439	RTAsn1Dump(RTCrPkcs7SignerInfo_GetAsn1Core(pSignerInfo), 0, 2, RTStrmDumpPrintfV, g_pStdOut);
440	}
441	return RTEXITCODE_SUCCESS;
442	}
443
444	RTMsgError("RTCrPkcs7ContentInfos_InsertEx failed: %Rrc", rc);
445	}
446	return RTEXITCODE_FAILURE;
447	}
448
449
450	/**
451	* Writes the signature to the file.
452	*
453	* Caller must have called SignToolPkcs7_Encode() prior to this function.
454	*
455	* @returns RTEXITCODE_SUCCESS on success, RTEXITCODE_FAILURE with error
456	* message on failure.
457	* @param pThis The file which to write.
458	* @param cVerbosity The verbosity.
459	*/
460	static RTEXITCODE SignToolPkcs7_WriteSignatureToFile(PSIGNTOOLPKCS7 pThis, const char *pszFilename, unsigned cVerbosity)
461	{
462	AssertReturn(pThis->cbNewBuf && pThis->pbNewBuf, RTEXITCODE_FAILURE);
463
464	/*
465	* Open+truncate file, write new signature, close. Simple.
466	*/
467	RTFILE hFile;
468	int rc = RTFileOpen(&hFile, pszFilename, RTFILE_O_WRITE \| RTFILE_O_OPEN_CREATE \| RTFILE_O_TRUNCATE \| RTFILE_O_DENY_WRITE);
469	if (RT_SUCCESS(rc))
470	{
471	rc = RTFileWrite(hFile, pThis->pbNewBuf, pThis->cbNewBuf, NULL);
472	if (RT_SUCCESS(rc))
473	{
474	rc = RTFileClose(hFile);
475	if (RT_SUCCESS(rc))
476	{
477	if (cVerbosity > 0)
478	RTMsgInfo("Wrote %u bytes to %s", pThis->cbNewBuf, pszFilename);
479	return RTEXITCODE_SUCCESS;
480	}
481
482	RTMsgError("RTFileClose failed on %s: %Rrc", pszFilename, rc);
483	}
484	else
485	RTMsgError("Write error on %s: %Rrc", pszFilename, rc);
486	}
487	else
488	RTMsgError("Failed to open %s for writing: %Rrc", pszFilename, rc);
489	return RTEXITCODE_FAILURE;
490	}
491
492
493
494	/**
495	* Worker for recursively searching for MS nested signatures and signer infos.
496	*
497	* @returns Pointer to the signer info corresponding to @a iSignature. NULL if
498	* not found.
499	* @param pSignedData The signature to search.
500	* @param piNextSignature Pointer to the variable keeping track of the next
501	* signature number.
502	* @param iReqSignature The request signature number.
503	* @param ppSignedData Where to return the signature data structure.
504	*/
505	static PRTCRPKCS7SIGNERINFO SignToolPkcs7_FindNestedSignatureByIndexWorker(PRTCRPKCS7SIGNEDDATA pSignedData,
506	uint32_t *piNextSignature,
507	uint32_t iReqSignature,
508	PRTCRPKCS7SIGNEDDATA *ppSignedData)
509	{
510	for (uint32_t iSignerInfo = 0; iSignerInfo < pSignedData->SignerInfos.cItems; iSignerInfo++)
511	{
512	/* Match?*/
513	PRTCRPKCS7SIGNERINFO pSignerInfo = pSignedData->SignerInfos.papItems[iSignerInfo];
514	if (*piNextSignature == iReqSignature)
515	{
516	*ppSignedData = pSignedData;
517	return pSignerInfo;
518	}
519	*piNextSignature += 1;
520
521	/* Look for nested signatures. */
522	for (uint32_t iAttrib = 0; iAttrib < pSignerInfo->UnauthenticatedAttributes.cItems; iAttrib++)
523	if (pSignerInfo->UnauthenticatedAttributes.papItems[iAttrib]->enmType == RTCRPKCS7ATTRIBUTETYPE_MS_NESTED_SIGNATURE)
524	{
525	PRTCRPKCS7SETOFCONTENTINFOS pCntInfos;
526	pCntInfos = pSignerInfo->UnauthenticatedAttributes.papItems[iAttrib]->uValues.pContentInfos;
527	for (uint32_t iCntInfo = 0; iCntInfo < pCntInfos->cItems; iCntInfo++)
528	{
529	PRTCRPKCS7CONTENTINFO pCntInfo = pCntInfos->papItems[iCntInfo];
530	if (RTCrPkcs7ContentInfo_IsSignedData(pCntInfo))
531	{
532	PRTCRPKCS7SIGNERINFO pRet;
533	pRet = SignToolPkcs7_FindNestedSignatureByIndexWorker(pCntInfo->u.pSignedData, piNextSignature,
534	iReqSignature, ppSignedData);
535	if (pRet)
536	return pRet;
537	}
538	}
539	}
540	}
541	return NULL;
542	}
543
544
545	/**
546	* Locates the given nested signature.
547	*
548	* @returns Pointer to the signer info corresponding to @a iSignature. NULL if
549	* not found.
550	* @param pThis The PKCS\#7 structure to search.
551	* @param iReqSignature The requested signature number.
552	* @param ppSignedData Where to return the pointer to the signed data that
553	* the returned signer info belongs to.
554	*
555	* @todo Move into SPC or PKCS\#7.
556	*/
557	static PRTCRPKCS7SIGNERINFO SignToolPkcs7_FindNestedSignatureByIndex(PSIGNTOOLPKCS7 pThis, uint32_t iReqSignature,
558	PRTCRPKCS7SIGNEDDATA *ppSignedData)
559	{
560	uint32_t iNextSignature = 0;
561	return SignToolPkcs7_FindNestedSignatureByIndexWorker(pThis->pSignedData, &iNextSignature, iReqSignature, ppSignedData);
562	}
563
564
565
566	/**
567	* Reads and decodes PKCS\#7 signature from the given executable.
568	*
569	* @returns RTEXITCODE_SUCCESS on success, RTEXITCODE_FAILURE with error message
570	* on failure.
571	* @param pThis The structure to initialize.
572	* @param pszFilename The executable filename.
573	* @param cVerbosity The verbosity.
574	* @param enmLdrArch For FAT binaries.
575	*/
576	static RTEXITCODE SignToolPkcs7Exe_InitFromFile(PSIGNTOOLPKCS7EXE pThis, const char *pszFilename,
577	unsigned cVerbosity, RTLDRARCH enmLdrArch = RTLDRARCH_WHATEVER)
578	{
579	/*
580	* Init the return structure.
581	*/
582	RT_ZERO(*pThis);
583	pThis->hLdrMod = NIL_RTLDRMOD;
584	pThis->pszFilename = pszFilename;
585
586	/*
587	* Open the image and check if it's signed.
588	*/
589	int rc = RTLdrOpen(pszFilename, RTLDR_O_FOR_VALIDATION, enmLdrArch, &pThis->hLdrMod);
590	if (RT_SUCCESS(rc))
591	{
592	bool fIsSigned = false;
593	rc = RTLdrQueryProp(pThis->hLdrMod, RTLDRPROP_IS_SIGNED, &fIsSigned, sizeof(fIsSigned));
594	if (RT_SUCCESS(rc) && fIsSigned)
595	{
596	/*
597	* Query the PKCS#7 data (assuming M$ style signing) and hand it to a worker.
598	*/
599	size_t cbActual = 0;
600	#ifdef DEBUG
601	size_t cbBuf = 64;
602	#else
603	size_t cbBuf = _512K;
604	#endif
605	void *pvBuf = RTMemAllocZ(cbBuf);
606	if (pvBuf)
607	{
608	rc = RTLdrQueryPropEx(pThis->hLdrMod, RTLDRPROP_PKCS7_SIGNED_DATA, NULL /pvBits/, pvBuf, cbBuf, &cbActual);
609	if (rc == VERR_BUFFER_OVERFLOW)
610	{
611	RTMemFree(pvBuf);
612	cbBuf = cbActual;
613	pvBuf = RTMemAllocZ(cbActual);
614	if (pvBuf)
615	rc = RTLdrQueryPropEx(pThis->hLdrMod, RTLDRPROP_PKCS7_SIGNED_DATA, NULL /pvBits/,
616	pvBuf, cbBuf, &cbActual);
617	else
618	rc = VERR_NO_MEMORY;
619	}
620	}
621	else
622	rc = VERR_NO_MEMORY;
623
624	pThis->pbBuf = (uint8_t *)pvBuf;
625	pThis->cbBuf = cbActual;
626	if (RT_SUCCESS(rc))
627	{
628	if (cVerbosity > 2)
629	RTPrintf("PKCS#7 signature: %u bytes\n", cbActual);
630	if (cVerbosity > 3)
631	RTPrintf("%.*Rhxd\n", cbActual, pvBuf);
632
633	/*
634	* Decode it.
635	*/
636	rc = SignToolPkcs7_Decode(pThis, false /fCatalog/);
637	if (RT_SUCCESS(rc))
638	return RTEXITCODE_SUCCESS;
639	}
640	else
641	RTMsgError("RTLdrQueryPropEx/RTLDRPROP_PKCS7_SIGNED_DATA failed on '%s': %Rrc\n", pszFilename, rc);
642	}
643	else if (RT_SUCCESS(rc))
644	RTMsgInfo("'%s': not signed\n", pszFilename);
645	else
646	RTMsgError("RTLdrQueryProp/RTLDRPROP_IS_SIGNED failed on '%s': %Rrc\n", pszFilename, rc);
647	}
648	else
649	RTMsgError("Error opening executable image '%s': %Rrc", pszFilename, rc);
650
651	SignToolPkcs7Exe_Delete(pThis);
652	return RTEXITCODE_FAILURE;
653	}
654
655
656	/**
657	* Calculates the checksum of an executable.
658	*
659	* @returns Success indicator (errors are reported)
660	* @param pThis The exe file to checksum.
661	* @param hFile The file handle.
662	* @param puCheckSum Where to return the checksum.
663	*/
664	static bool SignToolPkcs7Exe_CalcPeCheckSum(PSIGNTOOLPKCS7EXE pThis, RTFILE hFile, uint32_t *puCheckSum)
665	{
666	#ifdef RT_OS_WINDOWS
667	/*
668	* Try use IMAGEHLP!MapFileAndCheckSumW first.
669	*/
670	PRTUTF16 pwszPath;
671	int rc = RTStrToUtf16(pThis->pszFilename, &pwszPath);
672	if (RT_SUCCESS(rc))
673	{
674	decltype(MapFileAndCheckSumW) *pfnMapFileAndCheckSumW;
675	pfnMapFileAndCheckSumW = (decltype(MapFileAndCheckSumW) *)RTLdrGetSystemSymbol("IMAGEHLP.DLL", "MapFileAndCheckSumW");
676	if (pfnMapFileAndCheckSumW)
677	{
678	DWORD uHeaderSum = UINT32_MAX;
679	DWORD uCheckSum = UINT32_MAX;
680	DWORD dwRc = pfnMapFileAndCheckSumW(pwszPath, &uHeaderSum, &uCheckSum);
681	if (dwRc == CHECKSUM_SUCCESS)
682	{
683	*puCheckSum = uCheckSum;
684	return true;
685	}
686	}
687	}
688	#endif
689
690	RT_NOREF(pThis, hFile, puCheckSum);
691	RTMsgError("Implement check sum calcuation fallback!");
692	return false;
693	}
694
695
696	/**
697	* Writes the signature to the file.
698	*
699	* This has the side-effect of closing the hLdrMod member. So, it can only be
700	* called once!
701	*
702	* Caller must have called SignToolPkcs7_Encode() prior to this function.
703	*
704	* @returns RTEXITCODE_SUCCESS on success, RTEXITCODE_FAILURE with error
705	* message on failure.
706	* @param pThis The file which to write.
707	* @param cVerbosity The verbosity.
708	*/
709	static RTEXITCODE SignToolPkcs7Exe_WriteSignatureToFile(PSIGNTOOLPKCS7EXE pThis, unsigned cVerbosity)
710	{
711	AssertReturn(pThis->cbNewBuf && pThis->pbNewBuf, RTEXITCODE_FAILURE);
712
713	/*
714	* Get the file header offset and arch before closing the destination handle.
715	*/
716	uint32_t offNtHdrs;
717	int rc = RTLdrQueryProp(pThis->hLdrMod, RTLDRPROP_FILE_OFF_HEADER, &offNtHdrs, sizeof(offNtHdrs));
718	if (RT_SUCCESS(rc))
719	{
720	RTLDRARCH enmLdrArch = RTLdrGetArch(pThis->hLdrMod);
721	if (enmLdrArch != RTLDRARCH_INVALID)
722	{
723	RTLdrClose(pThis->hLdrMod);
724	pThis->hLdrMod = NIL_RTLDRMOD;
725	unsigned cbNtHdrs = 0;
726	switch (enmLdrArch)
727	{
728	case RTLDRARCH_AMD64:
729	cbNtHdrs = sizeof(IMAGE_NT_HEADERS64);
730	break;
731	case RTLDRARCH_X86_32:
732	cbNtHdrs = sizeof(IMAGE_NT_HEADERS32);
733	break;
734	default:
735	RTMsgError("Unknown image arch: %d", enmLdrArch);
736	}
737	if (cbNtHdrs > 0)
738	{
739	if (cVerbosity > 0)
740	RTMsgInfo("offNtHdrs=%#x cbNtHdrs=%u\n", offNtHdrs, cbNtHdrs);
741
742	/*
743	* Open the executable file for writing.
744	*/
745	RTFILE hFile;
746	rc = RTFileOpen(&hFile, pThis->pszFilename, RTFILE_O_READWRITE \| RTFILE_O_OPEN \| RTFILE_O_DENY_WRITE);
747	if (RT_SUCCESS(rc))
748	{
749	/* Read the file header and locate the security directory entry. */
750	union
751	{
752	IMAGE_NT_HEADERS32 NtHdrs32;
753	IMAGE_NT_HEADERS64 NtHdrs64;
754	} uBuf;
755	PIMAGE_DATA_DIRECTORY pSecDir = cbNtHdrs == sizeof(IMAGE_NT_HEADERS64)
756	? &uBuf.NtHdrs64.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY]
757	: &uBuf.NtHdrs32.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY];
758
759	rc = RTFileReadAt(hFile, offNtHdrs, &uBuf, cbNtHdrs, NULL);
760	if ( RT_SUCCESS(rc)
761	&& uBuf.NtHdrs32.Signature == IMAGE_NT_SIGNATURE)
762	{
763	/*
764	* Drop any old signature by truncating the file.
765	*/
766	if ( pSecDir->Size > 8
767	&& pSecDir->VirtualAddress > offNtHdrs + sizeof(IMAGE_NT_HEADERS32))
768	{
769	rc = RTFileSetSize(hFile, pSecDir->VirtualAddress);
770	if (RT_FAILURE(rc))
771	RTMsgError("Error truncating file to %#x bytes: %Rrc", pSecDir->VirtualAddress, rc);
772	}
773	else
774	rc = RTMsgErrorRc(VERR_BAD_EXE_FORMAT, "Bad security directory entry: VA=%#x Size=%#x",
775	pSecDir->VirtualAddress, pSecDir->Size);
776	if (RT_SUCCESS(rc))
777	{
778	/*
779	* Sector align the signature portion.
780	*/
781	uint32_t const cbWinCert = RT_UOFFSETOF(WIN_CERTIFICATE, bCertificate);
782	uint64_t offCur = 0;
783	rc = RTFileQuerySize(hFile, &offCur);
784	if ( RT_SUCCESS(rc)
785	&& offCur < _2G)
786	{
787	if (offCur & 0x1ff)
788	{
789	uint32_t cbNeeded = 0x200 - ((uint32_t)offCur & 0x1ff);
790	rc = RTFileWriteAt(hFile, offCur, g_abRTZero4K, cbNeeded, NULL);
791	if (RT_SUCCESS(rc))
792	offCur += cbNeeded;
793	}
794	if (RT_SUCCESS(rc))
795	{
796	/*
797	* Write the header followed by the signature data.
798	*/
799	uint32_t const cbZeroPad = (uint32_t)(RT_ALIGN_Z(pThis->cbNewBuf, 8) - pThis->cbNewBuf);
800	pSecDir->VirtualAddress = (uint32_t)offCur;
801	pSecDir->Size = cbWinCert + (uint32_t)pThis->cbNewBuf + cbZeroPad;
802	if (cVerbosity >= 2)
803	RTMsgInfo("Writing %u (%#x) bytes of signature at %#x (%u).\n",
804	pSecDir->Size, pSecDir->Size, pSecDir->VirtualAddress, pSecDir->VirtualAddress);
805
806	WIN_CERTIFICATE WinCert;
807	WinCert.dwLength = pSecDir->Size;
808	WinCert.wRevision = WIN_CERT_REVISION_2_0;
809	WinCert.wCertificateType = WIN_CERT_TYPE_PKCS_SIGNED_DATA;
810
811	rc = RTFileWriteAt(hFile, offCur, &WinCert, cbWinCert, NULL);
812	if (RT_SUCCESS(rc))
813	{
814	offCur += cbWinCert;
815	rc = RTFileWriteAt(hFile, offCur, pThis->pbNewBuf, pThis->cbNewBuf, NULL);
816	}
817	if (RT_SUCCESS(rc) && cbZeroPad)
818	{
819	offCur += pThis->cbNewBuf;
820	rc = RTFileWriteAt(hFile, offCur, g_abRTZero4K, cbZeroPad, NULL);
821	}
822	if (RT_SUCCESS(rc))
823	{
824	/*
825	* Reset the checksum (sec dir updated already) and rewrite the header.
826	*/
827	uBuf.NtHdrs32.OptionalHeader.CheckSum = 0;
828	offCur = offNtHdrs;
829	rc = RTFileWriteAt(hFile, offNtHdrs, &uBuf, cbNtHdrs, NULL);
830	if (RT_SUCCESS(rc))
831	rc = RTFileFlush(hFile);
832	if (RT_SUCCESS(rc))
833	{
834	/*
835	* Calc checksum and write out the header again.
836	*/
837	uint32_t uCheckSum = UINT32_MAX;
838	if (SignToolPkcs7Exe_CalcPeCheckSum(pThis, hFile, &uCheckSum))
839	{
840	uBuf.NtHdrs32.OptionalHeader.CheckSum = uCheckSum;
841	rc = RTFileWriteAt(hFile, offNtHdrs, &uBuf, cbNtHdrs, NULL);
842	if (RT_SUCCESS(rc))
843	rc = RTFileFlush(hFile);
844	if (RT_SUCCESS(rc))
845	{
846	rc = RTFileClose(hFile);
847	if (RT_SUCCESS(rc))
848	return RTEXITCODE_SUCCESS;
849	RTMsgError("RTFileClose failed: %Rrc\n", rc);
850	return RTEXITCODE_FAILURE;
851	}
852	}
853	}
854	}
855	}
856	if (RT_FAILURE(rc))
857	RTMsgError("Write error at %#RX64: %Rrc", offCur, rc);
858	}
859	else if (RT_SUCCESS(rc))
860	RTMsgError("File to big: %'RU64 bytes", offCur);
861	else
862	RTMsgError("RTFileQuerySize failed: %Rrc", rc);
863	}
864	}
865	else if (RT_SUCCESS(rc))
866	RTMsgError("Not NT executable header!");
867	else
868	RTMsgError("Error reading NT headers (%#x bytes) at %#x: %Rrc", cbNtHdrs, offNtHdrs, rc);
869	RTFileClose(hFile);
870	}
871	else
872	RTMsgError("Failed to open '%s' for writing: %Rrc", pThis->pszFilename, rc);
873	}
874	}
875	else
876	RTMsgError("RTLdrGetArch failed!");
877	}
878	else
879	RTMsgError("RTLdrQueryProp/RTLDRPROP_FILE_OFF_HEADER failed: %Rrc", rc);
880	return RTEXITCODE_FAILURE;
881	}
882
883
884
885	/*
886	* The 'extract-exe-signer-cert' command.
887	*/
888	static RTEXITCODE HelpExtractExeSignerCert(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel)
889	{
890	RT_NOREF_PV(enmLevel);
891	RTStrmPrintf(pStrm, "extract-exe-signer-cert [--ber\|--cer\|--der] [--signature-index\|-i <num>] [--exe\|-e] <exe> [--output\|-o] <outfile.cer>\n");
892	return RTEXITCODE_SUCCESS;
893	}
894
895	static RTEXITCODE HandleExtractExeSignerCert(int cArgs, char **papszArgs)
896	{
897	/*
898	* Parse arguments.
899	*/
900	static const RTGETOPTDEF s_aOptions[] =
901	{
902	{ "--ber", 'b', RTGETOPT_REQ_NOTHING },
903	{ "--cer", 'c', RTGETOPT_REQ_NOTHING },
904	{ "--der", 'd', RTGETOPT_REQ_NOTHING },
905	{ "--exe", 'e', RTGETOPT_REQ_STRING },
906	{ "--output", 'o', RTGETOPT_REQ_STRING },
907	{ "--signature-index", 'i', RTGETOPT_REQ_UINT32 },
908	};
909
910	const char *pszExe = NULL;
911	const char *pszOut = NULL;
912	RTLDRARCH enmLdrArch = RTLDRARCH_WHATEVER;
913	unsigned cVerbosity = 0;
914	uint32_t fCursorFlags = RTASN1CURSOR_FLAGS_DER;
915	uint32_t iSignature = 0;
916
917	RTGETOPTSTATE GetState;
918	int rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1, RTGETOPTINIT_FLAGS_OPTS_FIRST);
919	AssertRCReturn(rc, RTEXITCODE_FAILURE);
920	RTGETOPTUNION ValueUnion;
921	int ch;
922	while ((ch = RTGetOpt(&GetState, &ValueUnion)))
923	{
924	switch (ch)
925	{
926	case 'e': pszExe = ValueUnion.psz; break;
927	case 'o': pszOut = ValueUnion.psz; break;
928	case 'b': fCursorFlags = 0; break;
929	case 'c': fCursorFlags = RTASN1CURSOR_FLAGS_CER; break;
930	case 'd': fCursorFlags = RTASN1CURSOR_FLAGS_DER; break;
931	case 'i': iSignature = ValueUnion.u32; break;
932	case 'V': return HandleVersion(cArgs, papszArgs);
933	case 'h': return HelpExtractExeSignerCert(g_pStdOut, RTSIGNTOOLHELP_FULL);
934
935	case VINF_GETOPT_NOT_OPTION:
936	if (!pszExe)
937	pszExe = ValueUnion.psz;
938	else if (!pszOut)
939	pszOut = ValueUnion.psz;
940	else
941	return RTMsgErrorExit(RTEXITCODE_FAILURE, "Too many file arguments: %s", ValueUnion.psz);
942	break;
943
944	default:
945	return RTGetOptPrintError(ch, &ValueUnion);
946	}
947	}
948	if (!pszExe)
949	return RTMsgErrorExit(RTEXITCODE_FAILURE, "No executable given.");
950	if (!pszOut)
951	return RTMsgErrorExit(RTEXITCODE_FAILURE, "No output file given.");
952	if (RTPathExists(pszOut))
953	return RTMsgErrorExit(RTEXITCODE_FAILURE, "The output file '%s' exists.", pszOut);
954
955	/*
956	* Do it.
957	*/
958	/* Read & decode the PKCS#7 signature. */
959	SIGNTOOLPKCS7EXE This;
960	RTEXITCODE rcExit = SignToolPkcs7Exe_InitFromFile(&This, pszExe, cVerbosity, enmLdrArch);
961	if (rcExit == RTEXITCODE_SUCCESS)
962	{
963	/* Find the signing certificate (ASSUMING that the certificate used is shipped in the set of certificates). */
964	PRTCRPKCS7SIGNEDDATA pSignedData;
965	PCRTCRPKCS7SIGNERINFO pSignerInfo = SignToolPkcs7_FindNestedSignatureByIndex(&This, iSignature, &pSignedData);
966	rcExit = RTEXITCODE_FAILURE;
967	if (pSignerInfo)
968	{
969	PCRTCRPKCS7ISSUERANDSERIALNUMBER pISN = &pSignedData->SignerInfos.papItems[0]->IssuerAndSerialNumber;
970	PCRTCRX509CERTIFICATE pCert;
971	pCert = RTCrPkcs7SetOfCerts_FindX509ByIssuerAndSerialNumber(&pSignedData->Certificates,
972	&pISN->Name, &pISN->SerialNumber);
973	if (pCert)
974	{
975	/*
976	* Write it out.
977	*/
978	RTFILE hFile;
979	rc = RTFileOpen(&hFile, pszOut, RTFILE_O_WRITE \| RTFILE_O_DENY_WRITE \| RTFILE_O_CREATE);
980	if (RT_SUCCESS(rc))
981	{
982	uint32_t cbCert = pCert->SeqCore.Asn1Core.cbHdr + pCert->SeqCore.Asn1Core.cb;
983	rc = RTFileWrite(hFile, pCert->SeqCore.Asn1Core.uData.pu8 - pCert->SeqCore.Asn1Core.cbHdr,
984	cbCert, NULL);
985	if (RT_SUCCESS(rc))
986	{
987	rc = RTFileClose(hFile);
988	if (RT_SUCCESS(rc))
989	{
990	hFile = NIL_RTFILE;
991	rcExit = RTEXITCODE_SUCCESS;
992	RTMsgInfo("Successfully wrote %u bytes to '%s'", cbCert, pszOut);
993	}
994	else
995	RTMsgError("RTFileClose failed: %Rrc", rc);
996	}
997	else
998	RTMsgError("RTFileWrite failed: %Rrc", rc);
999	RTFileClose(hFile);
1000	}
1001	else
1002	RTMsgError("Error opening '%s' for writing: %Rrc", pszOut, rc);
1003	}
1004	else
1005	RTMsgError("Certificate not found.");
1006	}
1007	else
1008	RTMsgError("Could not locate signature #%u!", iSignature);
1009
1010	/* Delete the signature data. */
1011	SignToolPkcs7Exe_Delete(&This);
1012	}
1013	return rcExit;
1014	}
1015
1016
1017	/*
1018	* The 'add-nested-exe-signature' command.
1019	*/
1020	static RTEXITCODE HelpAddNestedExeSignature(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel)
1021	{
1022	RT_NOREF_PV(enmLevel);
1023	RTStrmPrintf(pStrm, "add-nested-exe-signature [-v\|--verbose] [-d\|--debug] [-p\|--prepend] <destination-exe> <source-exe>\n");
1024	if (enmLevel == RTSIGNTOOLHELP_FULL)
1025	RTStrmPrintf(pStrm,
1026	"\n"
1027	"The --debug option allows the source-exe to be omitted in order to test the\n"
1028	"encoding and PE file modification.\n"
1029	"\n"
1030	"The --prepend option puts the nested signature first rather than appending it\n"
1031	"to the end of of the nested signature set. Windows reads nested signatures in\n"
1032	"reverse order, so --prepend will logically putting it last.\n"
1033	);
1034	return RTEXITCODE_SUCCESS;
1035	}
1036
1037
1038	static RTEXITCODE HandleAddNestedExeSignature(int cArgs, char **papszArgs)
1039	{
1040	/*
1041	* Parse arguments.
1042	*/
1043	static const RTGETOPTDEF s_aOptions[] =
1044	{
1045	{ "--prepend", 'p', RTGETOPT_REQ_NOTHING },
1046	{ "--verbose", 'v', RTGETOPT_REQ_NOTHING },
1047	{ "--debug", 'd', RTGETOPT_REQ_NOTHING },
1048	};
1049
1050	const char *pszDst = NULL;
1051	const char *pszSrc = NULL;
1052	unsigned cVerbosity = 0;
1053	bool fDebug = false;
1054	bool fPrepend = false;
1055
1056	RTGETOPTSTATE GetState;
1057	int rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1, RTGETOPTINIT_FLAGS_OPTS_FIRST);
1058	AssertRCReturn(rc, RTEXITCODE_FAILURE);
1059	RTGETOPTUNION ValueUnion;
1060	int ch;
1061	while ((ch = RTGetOpt(&GetState, &ValueUnion)))
1062	{
1063	switch (ch)
1064	{
1065	case 'v': cVerbosity++; break;
1066	case 'd': fDebug = pszSrc == NULL; break;
1067	case 'p': fPrepend = true; break;
1068	case 'V': return HandleVersion(cArgs, papszArgs);
1069	case 'h': return HelpAddNestedExeSignature(g_pStdOut, RTSIGNTOOLHELP_FULL);
1070
1071	case VINF_GETOPT_NOT_OPTION:
1072	if (!pszDst)
1073	pszDst = ValueUnion.psz;
1074	else if (!pszSrc)
1075	{
1076	pszSrc = ValueUnion.psz;
1077	fDebug = false;
1078	}
1079	else
1080	return RTMsgErrorExit(RTEXITCODE_FAILURE, "Too many file arguments: %s", ValueUnion.psz);
1081	break;
1082
1083	default:
1084	return RTGetOptPrintError(ch, &ValueUnion);
1085	}
1086	}
1087	if (!pszDst)
1088	return RTMsgErrorExit(RTEXITCODE_FAILURE, "No destination executable given.");
1089	if (!pszSrc && !fDebug)
1090	return RTMsgErrorExit(RTEXITCODE_FAILURE, "No source executable file given.");
1091
1092	/*
1093	* Do it.
1094	*/
1095	/* Read & decode the source PKCS#7 signature. */
1096	SIGNTOOLPKCS7EXE Src;
1097	RTEXITCODE rcExit = pszSrc ? SignToolPkcs7Exe_InitFromFile(&Src, pszSrc, cVerbosity) : RTEXITCODE_SUCCESS;
1098	if (rcExit == RTEXITCODE_SUCCESS)
1099	{
1100	/* Ditto for the destination PKCS#7 signature. */
1101	SIGNTOOLPKCS7EXE Dst;
1102	rcExit = SignToolPkcs7Exe_InitFromFile(&Dst, pszDst, cVerbosity);
1103	if (rcExit == RTEXITCODE_SUCCESS)
1104	{
1105	/* Do the signature manipulation. */
1106	if (pszSrc)
1107	rcExit = SignToolPkcs7_AddNestedSignature(&Dst, &Src, cVerbosity, fPrepend);
1108	if (rcExit == RTEXITCODE_SUCCESS)
1109	rcExit = SignToolPkcs7_Encode(&Dst, cVerbosity);
1110
1111	/* Update the destination executable file. */
1112	if (rcExit == RTEXITCODE_SUCCESS)
1113	rcExit = SignToolPkcs7Exe_WriteSignatureToFile(&Dst, cVerbosity);
1114
1115	SignToolPkcs7Exe_Delete(&Dst);
1116	}
1117	if (pszSrc)
1118	SignToolPkcs7Exe_Delete(&Src);
1119	}
1120
1121	return rcExit;
1122	}
1123
1124
1125	/*
1126	* The 'add-nested-cat-signature' command.
1127	*/
1128	static RTEXITCODE HelpAddNestedCatSignature(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel)
1129	{
1130	RT_NOREF_PV(enmLevel);
1131	RTStrmPrintf(pStrm, "add-nested-cat-signature [-v\|--verbose] [-d\|--debug] [-p\|--prepend] <destination-cat> <source-cat>\n");
1132	if (enmLevel == RTSIGNTOOLHELP_FULL)
1133	RTStrmPrintf(pStrm,
1134	"\n"
1135	"The --debug option allows the source-cat to be omitted in order to test the\n"
1136	"ASN.1 re-encoding of the destination catalog file.\n"
1137	"\n"
1138	"The --prepend option puts the nested signature first rather than appending it\n"
1139	"to the end of of the nested signature set. Windows reads nested signatures in\n"
1140	"reverse order, so --prepend will logically putting it last.\n"
1141	);
1142	return RTEXITCODE_SUCCESS;
1143	}
1144
1145
1146	static RTEXITCODE HandleAddNestedCatSignature(int cArgs, char **papszArgs)
1147	{
1148	/*
1149	* Parse arguments.
1150	*/
1151	static const RTGETOPTDEF s_aOptions[] =
1152	{
1153	{ "--prepend", 'p', RTGETOPT_REQ_NOTHING },
1154	{ "--verbose", 'v', RTGETOPT_REQ_NOTHING },
1155	{ "--debug", 'd', RTGETOPT_REQ_NOTHING },
1156	};
1157
1158	const char *pszDst = NULL;
1159	const char *pszSrc = NULL;
1160	unsigned cVerbosity = 0;
1161	bool fDebug = false;
1162	bool fPrepend = false;
1163
1164	RTGETOPTSTATE GetState;
1165	int rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1, RTGETOPTINIT_FLAGS_OPTS_FIRST);
1166	AssertRCReturn(rc, RTEXITCODE_FAILURE);
1167	RTGETOPTUNION ValueUnion;
1168	int ch;
1169	while ((ch = RTGetOpt(&GetState, &ValueUnion)))
1170	{
1171	switch (ch)
1172	{
1173	case 'v': cVerbosity++; break;
1174	case 'd': fDebug = pszSrc == NULL; break;
1175	case 'p': fPrepend = true; break;
1176	case 'V': return HandleVersion(cArgs, papszArgs);
1177	case 'h': return HelpAddNestedCatSignature(g_pStdOut, RTSIGNTOOLHELP_FULL);
1178
1179	case VINF_GETOPT_NOT_OPTION:
1180	if (!pszDst)
1181	pszDst = ValueUnion.psz;
1182	else if (!pszSrc)
1183	{
1184	pszSrc = ValueUnion.psz;
1185	fDebug = false;
1186	}
1187	else
1188	return RTMsgErrorExit(RTEXITCODE_FAILURE, "Too many file arguments: %s", ValueUnion.psz);
1189	break;
1190
1191	default:
1192	return RTGetOptPrintError(ch, &ValueUnion);
1193	}
1194	}
1195	if (!pszDst)
1196	return RTMsgErrorExit(RTEXITCODE_FAILURE, "No destination catalog file given.");
1197	if (!pszSrc && !fDebug)
1198	return RTMsgErrorExit(RTEXITCODE_FAILURE, "No source catalog file given.");
1199
1200	/*
1201	* Do it.
1202	*/
1203	/* Read & decode the source PKCS#7 signature. */
1204	SIGNTOOLPKCS7 Src;
1205	RTEXITCODE rcExit = pszSrc ? SignToolPkcs7_InitFromFile(&Src, pszSrc, cVerbosity) : RTEXITCODE_SUCCESS;
1206	if (rcExit == RTEXITCODE_SUCCESS)
1207	{
1208	/* Ditto for the destination PKCS#7 signature. */
1209	SIGNTOOLPKCS7EXE Dst;
1210	rcExit = SignToolPkcs7_InitFromFile(&Dst, pszDst, cVerbosity);
1211	if (rcExit == RTEXITCODE_SUCCESS)
1212	{
1213	/* Do the signature manipulation. */
1214	if (pszSrc)
1215	rcExit = SignToolPkcs7_AddNestedSignature(&Dst, &Src, cVerbosity, fPrepend);
1216	if (rcExit == RTEXITCODE_SUCCESS)
1217	rcExit = SignToolPkcs7_Encode(&Dst, cVerbosity);
1218
1219	/* Update the destination executable file. */
1220	if (rcExit == RTEXITCODE_SUCCESS)
1221	rcExit = SignToolPkcs7_WriteSignatureToFile(&Dst, pszDst, cVerbosity);
1222
1223	SignToolPkcs7_Delete(&Dst);
1224	}
1225	if (pszSrc)
1226	SignToolPkcs7_Delete(&Src);
1227	}
1228
1229	return rcExit;
1230	}
1231
1232	#ifndef IPRT_IN_BUILD_TOOL
1233
1234	/*
1235	* The 'verify-exe' command.
1236	*/
1237	static RTEXITCODE HelpVerifyExe(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel)
1238	{
1239	RT_NOREF_PV(enmLevel);
1240	RTStrmPrintf(pStrm,
1241	"verify-exe [--verbose\|--quiet] [--kernel] [--root <root-cert.der>] [--additional <supp-cert.der>]\n"
1242	" [--type <win\|osx>] <exe1> [exe2 [..]]\n");
1243	return RTEXITCODE_SUCCESS;
1244	}
1245
1246	typedef struct VERIFYEXESTATE
1247	{
1248	RTCRSTORE hRootStore;
1249	RTCRSTORE hKernelRootStore;
1250	RTCRSTORE hAdditionalStore;
1251	bool fKernel;
1252	int cVerbose;
1253	enum { kSignType_Windows, kSignType_OSX } enmSignType;
1254	RTLDRARCH enmLdrArch;
1255	uint32_t cBad;
1256	uint32_t cOkay;
1257	const char *pszFilename;
1258	} VERIFYEXESTATE;
1259
1260	# ifdef VBOX
1261	/** Certificate store load set.
1262	* Declared outside HandleVerifyExe because of braindead gcc visibility crap. */
1263	struct STSTORESET
1264	{
1265	RTCRSTORE hStore;
1266	PCSUPTAENTRY paTAs;
1267	unsigned cTAs;
1268	};
1269	# endif
1270
1271	/**
1272	* @callback_method_impl{FNRTCRPKCS7VERIFYCERTCALLBACK,
1273	* Standard code signing. Use this for Microsoft SPC.}
1274	*/
1275	static DECLCALLBACK(int) VerifyExecCertVerifyCallback(PCRTCRX509CERTIFICATE pCert, RTCRX509CERTPATHS hCertPaths, uint32_t fFlags,
1276	void *pvUser, PRTERRINFO pErrInfo)
1277	{
1278	VERIFYEXESTATE pState = (VERIFYEXESTATE )pvUser;
1279	uint32_t cPaths = RTCrX509CertPathsGetPathCount(hCertPaths);
1280
1281	/*
1282	* Dump all the paths.
1283	*/
1284	if (pState->cVerbose > 0)
1285	{
1286	for (uint32_t iPath = 0; iPath < cPaths; iPath++)
1287	{
1288	RTPrintf("---\n");
1289	RTCrX509CertPathsDumpOne(hCertPaths, iPath, pState->cVerbose, RTStrmDumpPrintfV, g_pStdOut);
1290	*pErrInfo->pszMsg = '\0';
1291	}
1292	RTPrintf("---\n");
1293	}
1294
1295	/*
1296	* Test signing certificates normally doesn't have all the necessary
1297	* features required below. So, treat them as special cases.
1298	*/
1299	if ( hCertPaths == NIL_RTCRX509CERTPATHS
1300	&& RTCrX509Name_Compare(&pCert->TbsCertificate.Issuer, &pCert->TbsCertificate.Subject) == 0)
1301	{
1302	RTMsgInfo("Test signed.\n");
1303	return VINF_SUCCESS;
1304	}
1305
1306	if (hCertPaths == NIL_RTCRX509CERTPATHS)
1307	RTMsgInfo("Signed by trusted certificate.\n");
1308
1309	/*
1310	* Standard code signing capabilites required.
1311	*/
1312	int rc = RTCrPkcs7VerifyCertCallbackCodeSigning(pCert, hCertPaths, fFlags, NULL, pErrInfo);
1313	if ( RT_SUCCESS(rc)
1314	&& (fFlags & RTCRPKCS7VCC_F_SIGNED_DATA))
1315	{
1316	/*
1317	* If windows kernel signing, a valid certificate path must be anchored
1318	* by the microsoft kernel signing root certificate. The only
1319	* alternative is test signing.
1320	*/
1321	if ( pState->fKernel
1322	&& hCertPaths != NIL_RTCRX509CERTPATHS
1323	&& pState->enmSignType == VERIFYEXESTATE::kSignType_Windows)
1324	{
1325	uint32_t cFound = 0;
1326	uint32_t cValid = 0;
1327	for (uint32_t iPath = 0; iPath < cPaths; iPath++)
1328	{
1329	bool fTrusted;
1330	PCRTCRX509NAME pSubject;
1331	PCRTCRX509SUBJECTPUBLICKEYINFO pPublicKeyInfo;
1332	int rcVerify;
1333	rc = RTCrX509CertPathsQueryPathInfo(hCertPaths, iPath, &fTrusted, NULL /pcNodes/, &pSubject, &pPublicKeyInfo,
1334	NULL, NULL /pCertCtx/, &rcVerify);
1335	AssertRCBreak(rc);
1336
1337	if (RT_SUCCESS(rcVerify))
1338	{
1339	Assert(fTrusted);
1340	cValid++;
1341
1342	/* Search the kernel signing root store for a matching anchor. */
1343	RTCRSTORECERTSEARCH Search;
1344	rc = RTCrStoreCertFindBySubjectOrAltSubjectByRfc5280(pState->hKernelRootStore, pSubject, &Search);
1345	AssertRCBreak(rc);
1346	PCRTCRCERTCTX pCertCtx;
1347	while ((pCertCtx = RTCrStoreCertSearchNext(pState->hKernelRootStore, &Search)) != NULL)
1348	{
1349	PCRTCRX509SUBJECTPUBLICKEYINFO pPubKeyInfo;
1350	if (pCertCtx->pCert)
1351	pPubKeyInfo = &pCertCtx->pCert->TbsCertificate.SubjectPublicKeyInfo;
1352	else if (pCertCtx->pTaInfo)
1353	pPubKeyInfo = &pCertCtx->pTaInfo->PubKey;
1354	else
1355	pPubKeyInfo = NULL;
1356	if (RTCrX509SubjectPublicKeyInfo_Compare(pPubKeyInfo, pPublicKeyInfo) == 0)
1357	cFound++;
1358	RTCrCertCtxRelease(pCertCtx);
1359	}
1360
1361	int rc2 = RTCrStoreCertSearchDestroy(pState->hKernelRootStore, &Search); AssertRC(rc2);
1362	}
1363	}
1364	if (RT_SUCCESS(rc) && cFound == 0)
1365	rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE, "Not valid kernel code signature.");
1366	if (RT_SUCCESS(rc) && cValid != 2)
1367	RTMsgWarning("%u valid paths, expected 2", cValid);
1368	}
1369	/*
1370	* For Mac OS X signing, check for special developer ID attributes.
1371	*/
1372	else if (pState->enmSignType == VERIFYEXESTATE::kSignType_OSX)
1373	{
1374	uint32_t cDevIdApp = 0;
1375	uint32_t cDevIdKext = 0;
1376	for (uint32_t i = 0; i < pCert->TbsCertificate.T3.Extensions.cItems; i++)
1377	{
1378	PCRTCRX509EXTENSION pExt = pCert->TbsCertificate.T3.Extensions.papItems[i];
1379	if (RTAsn1ObjId_CompareWithString(&pExt->ExtnId, RTCR_APPLE_CS_DEVID_APPLICATION_OID) == 0)
1380	{
1381	cDevIdApp++;
1382	if (!pExt->Critical.fValue)
1383	rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
1384	"Dev ID Application certificate extension is not flagged critical");
1385	}
1386	else if (RTAsn1ObjId_CompareWithString(&pExt->ExtnId, RTCR_APPLE_CS_DEVID_KEXT_OID) == 0)
1387	{
1388	cDevIdKext++;
1389	if (!pExt->Critical.fValue)
1390	rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
1391	"Dev ID kext certificate extension is not flagged critical");
1392	}
1393	}
1394	if (cDevIdApp == 0)
1395	rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
1396	"Certificate is missing the 'Dev ID Application' extension");
1397	if (cDevIdKext == 0 && pState->fKernel)
1398	rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
1399	"Certificate is missing the 'Dev ID kext' extension");
1400	}
1401	}
1402
1403	return rc;
1404	}
1405
1406	/** @callback_method_impl{FNRTLDRVALIDATESIGNEDDATA} */
1407	static DECLCALLBACK(int) VerifyExeCallback(RTLDRMOD hLdrMod, PCRTLDRSIGNATUREINFO pInfo, PRTERRINFO pErrInfo, void *pvUser)
1408	{
1409	VERIFYEXESTATE pState = (VERIFYEXESTATE )pvUser;
1410	RT_NOREF_PV(hLdrMod);
1411
1412	switch (pInfo->enmType)
1413	{
1414	case RTLDRSIGNATURETYPE_PKCS7_SIGNED_DATA:
1415	{
1416	PCRTCRPKCS7CONTENTINFO pContentInfo = (PCRTCRPKCS7CONTENTINFO)pInfo->pvSignature;
1417
1418	/*
1419	* Dump the signed data if so requested and it's the first one, assuming that
1420	* additional signatures in contained wihtin the same ContentInfo structure.
1421	*/
1422	if (pState->cVerbose && pInfo->iSignature == 0)
1423	RTAsn1Dump(&pContentInfo->SeqCore.Asn1Core, 0, 0, RTStrmDumpPrintfV, g_pStdOut);
1424
1425	/*
1426	* We'll try different alternative timestamps here.
1427	*/
1428	struct { RTTIMESPEC TimeSpec; const char *pszDesc; } aTimes[2];
1429	unsigned cTimes = 0;
1430
1431	/* Linking timestamp: */
1432	uint64_t uLinkingTime = 0;
1433	int rc = RTLdrQueryProp(hLdrMod, RTLDRPROP_TIMESTAMP_SECONDS, &uLinkingTime, sizeof(uLinkingTime));
1434	if (RT_SUCCESS(rc))
1435	{
1436	RTTimeSpecSetSeconds(&aTimes[0].TimeSpec, uLinkingTime);
1437	aTimes[0].pszDesc = "at link time";
1438	cTimes++;
1439	}
1440	else if (rc != VERR_NOT_FOUND)
1441	RTMsgError("RTLdrQueryProp/RTLDRPROP_TIMESTAMP_SECONDS failed on '%s': %Rrc\n", pState->pszFilename, rc);
1442
1443	/* Now: */
1444	RTTimeNow(&aTimes[cTimes].TimeSpec);
1445	aTimes[cTimes].pszDesc = "now";
1446	cTimes++;
1447
1448	/*
1449	* Do the actual verification.
1450	*/
1451	for (unsigned iTime = 0; iTime < cTimes; iTime++)
1452	{
1453	if (pInfo->pvExternalData)
1454	rc = RTCrPkcs7VerifySignedDataWithExternalData(pContentInfo,
1455	RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY
1456	\| RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT
1457	\| RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT
1458	\| RTCRPKCS7VERIFY_SD_F_CHECK_TRUST_ANCHORS,
1459	pState->hAdditionalStore, pState->hRootStore,
1460	&aTimes[iTime].TimeSpec,
1461	VerifyExecCertVerifyCallback, pState,
1462	pInfo->pvExternalData, pInfo->cbExternalData, pErrInfo);
1463	else
1464	rc = RTCrPkcs7VerifySignedData(pContentInfo,
1465	RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY
1466	\| RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT
1467	\| RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT
1468	\| RTCRPKCS7VERIFY_SD_F_CHECK_TRUST_ANCHORS,
1469	pState->hAdditionalStore, pState->hRootStore,
1470	&aTimes[iTime].TimeSpec,
1471	VerifyExecCertVerifyCallback, pState, pErrInfo);
1472	if (RT_SUCCESS(rc))
1473	{
1474	Assert(rc == VINF_SUCCESS \|\| rc == VINF_CR_DIGEST_DEPRECATED);
1475	const char *pszNote = rc == VINF_CR_DIGEST_DEPRECATED ? " (deprecated digest)" : "";
1476	if (pInfo->cSignatures == 1)
1477	RTMsgInfo("'%s' is valid %s%s.\n", pState->pszFilename, aTimes[iTime].pszDesc, pszNote);
1478	else
1479	RTMsgInfo("'%s' signature #%u is valid %s%s.\n",
1480	pState->pszFilename, pInfo->iSignature + 1, aTimes[iTime].pszDesc, pszNote);
1481	pState->cOkay++;
1482	return VINF_SUCCESS;
1483	}
1484	if (rc != VERR_CR_X509_CPV_NOT_VALID_AT_TIME)
1485	{
1486	if (pInfo->cSignatures == 1)
1487	RTMsgError("%s: Failed to verify signature: %Rrc%#RTeim\n", pState->pszFilename, rc, pErrInfo);
1488	else
1489	RTMsgError("%s: Failed to verify signature #%u: %Rrc%#RTeim\n",
1490	pState->pszFilename, pInfo->iSignature + 1, rc, pErrInfo);
1491	pState->cBad++;
1492	return VINF_SUCCESS;
1493	}
1494	}
1495
1496	if (pInfo->cSignatures == 1)
1497	RTMsgError("%s: Signature is not valid at present or link time.\n", pState->pszFilename);
1498	else
1499	RTMsgError("%s: Signature #%u is not valid at present or link time.\n",
1500	pState->pszFilename, pInfo->iSignature + 1);
1501	pState->cBad++;
1502	return VINF_SUCCESS;
1503	}
1504
1505	default:
1506	return RTErrInfoSetF(pErrInfo, VERR_NOT_SUPPORTED, "Unsupported signature type: %d", pInfo->enmType);
1507	}
1508	}
1509
1510	/**
1511	* Worker for HandleVerifyExe.
1512	*/
1513	static RTEXITCODE HandleVerifyExeWorker(VERIFYEXESTATE pState, const char pszFilename, PRTERRINFOSTATIC pStaticErrInfo)
1514	{
1515	/*
1516	* Open the executable image and verify it.
1517	*/
1518	RTLDRMOD hLdrMod;
1519	int rc = RTLdrOpen(pszFilename, RTLDR_O_FOR_VALIDATION, pState->enmLdrArch, &hLdrMod);
1520	if (RT_FAILURE(rc))
1521	return RTMsgErrorExit(RTEXITCODE_FAILURE, "Error opening executable image '%s': %Rrc", pszFilename, rc);
1522
1523	/* Reset the state. */
1524	pState->cBad = 0;
1525	pState->cOkay = 0;
1526	pState->pszFilename = pszFilename;
1527
1528	rc = RTLdrVerifySignature(hLdrMod, VerifyExeCallback, pState, RTErrInfoInitStatic(pStaticErrInfo));
1529	if (RT_FAILURE(rc))
1530	RTMsgError("RTLdrVerifySignature failed on '%s': %Rrc - %s\n", pszFilename, rc, pStaticErrInfo->szMsg);
1531
1532	int rc2 = RTLdrClose(hLdrMod);
1533	if (RT_FAILURE(rc2))
1534	return RTMsgErrorExit(RTEXITCODE_FAILURE, "RTLdrClose failed: %Rrc\n", rc2);
1535	if (RT_FAILURE(rc))
1536	return rc != VERR_LDRVI_NOT_SIGNED ? RTEXITCODE_FAILURE : RTEXITCODE_SKIPPED;
1537
1538	return pState->cOkay > 0 ? RTEXITCODE_SUCCESS : RTEXITCODE_FAILURE;
1539	}
1540
1541
1542	static RTEXITCODE HandleVerifyExe(int cArgs, char **papszArgs)
1543	{
1544	RTERRINFOSTATIC StaticErrInfo;
1545
1546	/* Note! This code does not try to clean up the crypto stores on failure.
1547	This is intentional as the code is only expected to be used in a
1548	one-command-per-process environment where we do exit() upon
1549	returning from this function. */
1550
1551	/*
1552	* Parse arguments.
1553	*/
1554	static const RTGETOPTDEF s_aOptions[] =
1555	{
1556	{ "--kernel", 'k', RTGETOPT_REQ_NOTHING },
1557	{ "--root", 'r', RTGETOPT_REQ_STRING },
1558	{ "--additional", 'a', RTGETOPT_REQ_STRING },
1559	{ "--add", 'a', RTGETOPT_REQ_STRING },
1560	{ "--type", 't', RTGETOPT_REQ_STRING },
1561	{ "--verbose", 'v', RTGETOPT_REQ_NOTHING },
1562	{ "--quiet", 'q', RTGETOPT_REQ_NOTHING },
1563	};
1564
1565	VERIFYEXESTATE State =
1566	{
1567	NIL_RTCRSTORE, NIL_RTCRSTORE, NIL_RTCRSTORE, false, 0,
1568	VERIFYEXESTATE::kSignType_Windows, RTLDRARCH_WHATEVER,
1569	0, 0, NULL
1570	};
1571	int rc = RTCrStoreCreateInMem(&State.hRootStore, 0);
1572	if (RT_SUCCESS(rc))
1573	rc = RTCrStoreCreateInMem(&State.hKernelRootStore, 0);
1574	if (RT_SUCCESS(rc))
1575	rc = RTCrStoreCreateInMem(&State.hAdditionalStore, 0);
1576	if (RT_FAILURE(rc))
1577	return RTMsgErrorExit(RTEXITCODE_FAILURE, "Error creating in-memory certificate store: %Rrc", rc);
1578
1579	RTGETOPTSTATE GetState;
1580	rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1, RTGETOPTINIT_FLAGS_OPTS_FIRST);
1581	AssertRCReturn(rc, RTEXITCODE_FAILURE);
1582	RTGETOPTUNION ValueUnion;
1583	int ch;
1584	while ((ch = RTGetOpt(&GetState, &ValueUnion)) && ch != VINF_GETOPT_NOT_OPTION)
1585	{
1586	switch (ch)
1587	{
1588	case 'r': case 'a':
1589	rc = RTCrStoreCertAddFromFile(ch == 'r' ? State.hRootStore : State.hAdditionalStore,
1590	RTCRCERTCTX_F_ADD_IF_NOT_FOUND \| RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR,
1591	ValueUnion.psz, RTErrInfoInitStatic(&StaticErrInfo));
1592	if (RT_FAILURE(rc))
1593	return RTMsgErrorExit(RTEXITCODE_FAILURE, "Error loading certificate '%s': %Rrc - %s",
1594	ValueUnion.psz, rc, StaticErrInfo.szMsg);
1595	if (RTErrInfoIsSet(&StaticErrInfo.Core))
1596	RTMsgWarning("Warnings loading certificate '%s': %s", ValueUnion.psz, StaticErrInfo.szMsg);
1597	break;
1598
1599	case 't':
1600	if (!strcmp(ValueUnion.psz, "win") \|\| !strcmp(ValueUnion.psz, "windows"))
1601	State.enmSignType = VERIFYEXESTATE::kSignType_Windows;
1602	else if (!strcmp(ValueUnion.psz, "osx") \|\| !strcmp(ValueUnion.psz, "apple"))
1603	State.enmSignType = VERIFYEXESTATE::kSignType_OSX;
1604	else
1605	return RTMsgErrorExit(RTEXITCODE_SYNTAX, "Unknown signing type: '%s'", ValueUnion.psz);
1606	break;
1607
1608	case 'k': State.fKernel = true; break;
1609	case 'v': State.cVerbose++; break;
1610	case 'q': State.cVerbose = 0; break;
1611	case 'V': return HandleVersion(cArgs, papszArgs);
1612	case 'h': return HelpVerifyExe(g_pStdOut, RTSIGNTOOLHELP_FULL);
1613	default: return RTGetOptPrintError(ch, &ValueUnion);
1614	}
1615	}
1616	if (ch != VINF_GETOPT_NOT_OPTION)
1617	return RTMsgErrorExit(RTEXITCODE_FAILURE, "No executable given.");
1618
1619	/*
1620	* Populate the certificate stores according to the signing type.
1621	*/
1622	# ifdef VBOX
1623	unsigned cSets = 0;
1624	struct STSTORESET aSets[6];
1625	switch (State.enmSignType)
1626	{
1627	case VERIFYEXESTATE::kSignType_Windows:
1628	aSets[cSets].hStore = State.hRootStore;
1629	aSets[cSets].paTAs = g_aSUPTimestampTAs;
1630	aSets[cSets].cTAs = g_cSUPTimestampTAs;
1631	cSets++;
1632	aSets[cSets].hStore = State.hRootStore;
1633	aSets[cSets].paTAs = g_aSUPSpcRootTAs;
1634	aSets[cSets].cTAs = g_cSUPSpcRootTAs;
1635	cSets++;
1636	aSets[cSets].hStore = State.hRootStore;
1637	aSets[cSets].paTAs = g_aSUPNtKernelRootTAs;
1638	aSets[cSets].cTAs = g_cSUPNtKernelRootTAs;
1639	cSets++;
1640	aSets[cSets].hStore = State.hKernelRootStore;
1641	aSets[cSets].paTAs = g_aSUPNtKernelRootTAs;
1642	aSets[cSets].cTAs = g_cSUPNtKernelRootTAs;
1643	cSets++;
1644	break;
1645
1646	case VERIFYEXESTATE::kSignType_OSX:
1647	aSets[cSets].hStore = State.hRootStore;
1648	aSets[cSets].paTAs = g_aSUPAppleRootTAs;
1649	aSets[cSets].cTAs = g_cSUPAppleRootTAs;
1650	cSets++;
1651	break;
1652	}
1653	for (unsigned i = 0; i < cSets; i++)
1654	for (unsigned j = 0; j < aSets[i].cTAs; j++)
1655	{
1656	rc = RTCrStoreCertAddEncoded(aSets[i].hStore, RTCRCERTCTX_F_ENC_TAF_DER, aSets[i].paTAs[j].pch,
1657	aSets[i].paTAs[j].cb, RTErrInfoInitStatic(&StaticErrInfo));
1658	if (RT_FAILURE(rc))
1659	return RTMsgErrorExit(RTEXITCODE_FAILURE, "RTCrStoreCertAddEncoded failed (%u/%u): %s",
1660	i, j, StaticErrInfo.szMsg);
1661	}
1662	# endif /* VBOX */
1663
1664	/*
1665	* Do it.
1666	*/
1667	RTEXITCODE rcExit;
1668	for (;;)
1669	{
1670	rcExit = HandleVerifyExeWorker(&State, ValueUnion.psz, &StaticErrInfo);
1671	if (rcExit != RTEXITCODE_SUCCESS)
1672	break;
1673
1674	/*
1675	* Next file
1676	*/
1677	ch = RTGetOpt(&GetState, &ValueUnion);
1678	if (ch == 0)
1679	break;
1680	if (ch != VINF_GETOPT_NOT_OPTION)
1681	{
1682	rcExit = RTGetOptPrintError(ch, &ValueUnion);
1683	break;
1684	}
1685	}
1686
1687	/*
1688	* Clean up.
1689	*/
1690	uint32_t cRefs;
1691	cRefs = RTCrStoreRelease(State.hRootStore); Assert(cRefs == 0);
1692	cRefs = RTCrStoreRelease(State.hKernelRootStore); Assert(cRefs == 0);
1693	cRefs = RTCrStoreRelease(State.hAdditionalStore); Assert(cRefs == 0);
1694
1695	return rcExit;
1696	}
1697
1698	#endif /* !IPRT_IN_BUILD_TOOL */
1699
1700	/*
1701	* common code for show-exe and show-cat:
1702	*/
1703
1704	/**
1705	* Display an object ID.
1706	*
1707	* @returns IPRT status code.
1708	* @param pThis The show exe instance data.
1709	* @param pObjId The object ID to display.
1710	* @param pszLabel The field label (prefixed by szPrefix).
1711	* @param pszPost What to print after the ID (typically newline).
1712	*/
1713	static void HandleShowExeWorkerDisplayObjId(PSHOWEXEPKCS7 pThis, PCRTASN1OBJID pObjId, const char pszLabel, const char pszPost)
1714	{
1715	int rc = RTAsn1QueryObjIdName(pObjId, pThis->szTmp, sizeof(pThis->szTmp));
1716	if (RT_SUCCESS(rc))
1717	{
1718	if (pThis->cVerbosity > 1)
1719	RTPrintf("%s%s%s (%s)%s", pThis->szPrefix, pszLabel, pThis->szTmp, pObjId->szObjId, pszPost);
1720	else
1721	RTPrintf("%s%s%s%s", pThis->szPrefix, pszLabel, pThis->szTmp, pszPost);
1722	}
1723	else
1724	RTPrintf("%s%s%s%s", pThis->szPrefix, pszLabel, pObjId->szObjId, pszPost);
1725	}
1726
1727
1728	/**
1729	* Display an object ID, without prefix and label
1730	*
1731	* @returns IPRT status code.
1732	* @param pThis The show exe instance data.
1733	* @param pObjId The object ID to display.
1734	* @param pszPost What to print after the ID (typically newline).
1735	*/
1736	static void HandleShowExeWorkerDisplayObjIdSimple(PSHOWEXEPKCS7 pThis, PCRTASN1OBJID pObjId, const char *pszPost)
1737	{
1738	int rc = RTAsn1QueryObjIdName(pObjId, pThis->szTmp, sizeof(pThis->szTmp));
1739	if (RT_SUCCESS(rc))
1740	{
1741	if (pThis->cVerbosity > 1)
1742	RTPrintf("%s (%s)%s", pThis->szTmp, pObjId->szObjId, pszPost);
1743	else
1744	RTPrintf("%s%s", pThis->szTmp, pszPost);
1745	}
1746	else
1747	RTPrintf("%s%s", pObjId->szObjId, pszPost);
1748	}
1749
1750
1751	/**
1752	* Display a signer info attribute.
1753	*
1754	* @returns IPRT status code.
1755	* @param pThis The show exe instance data.
1756	* @param offPrefix The current prefix offset.
1757	* @param pAttr The attribute to display.
1758	*/
1759	static int HandleShowExeWorkerPkcs7DisplayAttrib(PSHOWEXEPKCS7 pThis, size_t offPrefix, PCRTCRPKCS7ATTRIBUTE pAttr)
1760	{
1761	HandleShowExeWorkerDisplayObjId(pThis, &pAttr->Type, "", ":\n");
1762
1763	int rc = VINF_SUCCESS;
1764	switch (pAttr->enmType)
1765	{
1766	case RTCRPKCS7ATTRIBUTETYPE_UNKNOWN:
1767	if (pAttr->uValues.pCores->cItems <= 1)
1768	RTPrintf("%s %u bytes\n", pThis->szPrefix,pAttr->uValues.pCores->SetCore.Asn1Core.cb);
1769	else
1770	RTPrintf("%s %u bytes divided by %u items\n", pThis->szPrefix, pAttr->uValues.pCores->SetCore.Asn1Core.cb, pAttr->uValues.pCores->cItems);
1771	break;
1772
1773	/* Object IDs, use pObjIds. */
1774	case RTCRPKCS7ATTRIBUTETYPE_OBJ_IDS:
1775	if (pAttr->uValues.pObjIds->cItems != 1)
1776	RTPrintf("%s%u object IDs:", pThis->szPrefix, pAttr->uValues.pObjIds->cItems);
1777	for (unsigned i = 0; i < pAttr->uValues.pObjIds->cItems; i++)
1778	{
1779	if (pAttr->uValues.pObjIds->cItems == 1)
1780	RTPrintf("%s ", pThis->szPrefix);
1781	else
1782	RTPrintf("%s ObjId[%u]: ", pThis->szPrefix, i);
1783	HandleShowExeWorkerDisplayObjIdSimple(pThis, pAttr->uValues.pObjIds->papItems[i], "\n");
1784	}
1785	break;
1786
1787	/* Sequence of object IDs, use pObjIdSeqs. */
1788	case RTCRPKCS7ATTRIBUTETYPE_MS_STATEMENT_TYPE:
1789	if (pAttr->uValues.pObjIdSeqs->cItems != 1)
1790	RTPrintf("%s%u object IDs:", pThis->szPrefix, pAttr->uValues.pObjIdSeqs->cItems);
1791	for (unsigned i = 0; i < pAttr->uValues.pObjIdSeqs->cItems; i++)
1792	{
1793	uint32_t const cObjIds = pAttr->uValues.pObjIdSeqs->papItems[i]->cItems;
1794	for (unsigned j = 0; j < cObjIds; j++)
1795	{
1796	if (pAttr->uValues.pObjIdSeqs->cItems == 1)
1797	RTPrintf("%s ", pThis->szPrefix);
1798	else
1799	RTPrintf("%s ObjIdSeq[%u]: ", pThis->szPrefix, i);
1800	if (cObjIds != 1)
1801	RTPrintf(" ObjId[%u]: ", j);
1802	HandleShowExeWorkerDisplayObjIdSimple(pThis, pAttr->uValues.pObjIdSeqs->papItems[i]->papItems[i], "\n");
1803	}
1804	}
1805	break;
1806
1807	/* Octet strings, use pOctetStrings. */
1808	case RTCRPKCS7ATTRIBUTETYPE_OCTET_STRINGS:
1809	if (pAttr->uValues.pOctetStrings->cItems != 1)
1810	RTPrintf("%s%u octet strings:", pThis->szPrefix, pAttr->uValues.pOctetStrings->cItems);
1811	for (unsigned i = 0; i < pAttr->uValues.pOctetStrings->cItems; i++)
1812	{
1813	PCRTASN1OCTETSTRING pOctetString = pAttr->uValues.pOctetStrings->papItems[i];
1814	uint32_t cbContent = pOctetString->Asn1Core.cb;
1815	if (cbContent > 0 && (cbContent <= 128 \|\| pThis->cVerbosity >= 2))
1816	{
1817	uint8_t const *pbContent = pOctetString->Asn1Core.uData.pu8;
1818	uint32_t off = 0;
1819	while (off < cbContent)
1820	{
1821	uint32_t cbNow = RT_MIN(cbContent - off, 16);
1822	if (pAttr->uValues.pOctetStrings->cItems == 1)
1823	RTPrintf("%s %#06x: %.*Rhxs\n", pThis->szPrefix, off, cbNow, &pbContent[off]);
1824	else
1825	RTPrintf("%s OctetString[%u]: %#06x: %.*Rhxs\n", pThis->szPrefix, i, off, cbNow, &pbContent[off]);
1826	off += cbNow;
1827	}
1828	}
1829	else
1830	RTPrintf("%s: OctetString[%u]: %u bytes\n", pThis->szPrefix, i, pOctetString->Asn1Core.cb);
1831	}
1832	break;
1833
1834	/* Counter signatures (PKCS \#9), use pCounterSignatures. */
1835	case RTCRPKCS7ATTRIBUTETYPE_COUNTER_SIGNATURES:
1836	RTPrintf("%sTODO: RTCRPKCS7ATTRIBUTETYPE_COUNTER_SIGNATURES! %u bytes\n",
1837	pThis->szPrefix, pAttr->uValues.pCounterSignatures->SetCore.Asn1Core.cb);
1838	break;
1839
1840	/* Signing time (PKCS \#9), use pSigningTime. */
1841	case RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME:
1842	for (uint32_t i = 0; i < pAttr->uValues.pSigningTime->cItems; i++)
1843	{
1844	PCRTASN1TIME pTime = pAttr->uValues.pSigningTime->papItems[i];
1845	char szTS[RTTIME_STR_LEN];
1846	RTTimeToString(&pTime->Time, szTS, sizeof(szTS));
1847	if (pAttr->uValues.pSigningTime->cItems == 1)
1848	RTPrintf("%s %s (%.*s)\n", pThis->szPrefix, szTS, pTime->Asn1Core.cb, pTime->Asn1Core.uData.pch);
1849	else
1850	RTPrintf("%s #%u: %s (%.*s)\n", pThis->szPrefix, i, szTS, pTime->Asn1Core.cb, pTime->Asn1Core.uData.pch);
1851	}
1852	break;
1853
1854	/* Microsoft timestamp info (RFC-3161) signed data, use pContentInfo. */
1855	case RTCRPKCS7ATTRIBUTETYPE_MS_TIMESTAMP:
1856	case RTCRPKCS7ATTRIBUTETYPE_MS_NESTED_SIGNATURE:
1857	if (pAttr->uValues.pContentInfos->cItems > 1)
1858	RTPrintf("%s%u nested signatures, %u bytes in total\n", pThis->szPrefix,
1859	pAttr->uValues.pContentInfos->cItems, pAttr->uValues.pContentInfos->SetCore.Asn1Core.cb);
1860	for (unsigned i = 0; i < pAttr->uValues.pContentInfos->cItems; i++)
1861	{
1862	size_t offPrefix2 = offPrefix;
1863	if (pAttr->uValues.pContentInfos->cItems > 1)
1864	offPrefix2 += RTStrPrintf(&pThis->szPrefix[offPrefix], sizeof(pThis->szPrefix) - offPrefix, "NestedSig[%u]: ", i);
1865	else
1866	offPrefix2 += RTStrPrintf(&pThis->szPrefix[offPrefix], sizeof(pThis->szPrefix) - offPrefix, " ");
1867	// offPrefix2 += RTStrPrintf(&pThis->szPrefix[offPrefix], sizeof(pThis->szPrefix) - offPrefix, "NestedSig: ", i);
1868	PCRTCRPKCS7CONTENTINFO pContentInfo = pAttr->uValues.pContentInfos->papItems[i];
1869	int rc2;
1870	if (RTCrPkcs7ContentInfo_IsSignedData(pContentInfo))
1871	rc2 = HandleShowExeWorkerPkcs7Display(pThis, pContentInfo->u.pSignedData, offPrefix2, pContentInfo);
1872	else
1873	rc2 = RTMsgErrorRc(VERR_ASN1_UNEXPECTED_OBJ_ID, "%sPKCS#7 content in nested signature is not 'signedData': %s",
1874	pThis->szPrefix, pContentInfo->ContentType.szObjId);
1875	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
1876	rc = rc2;
1877	}
1878	break;
1879
1880	case RTCRPKCS7ATTRIBUTETYPE_APPLE_MULTI_CD_PLIST:
1881	if (pAttr->uValues.pContentInfos->cItems != 1)
1882	RTPrintf("%s%u plists, expected only 1.\n", pThis->szPrefix, pAttr->uValues.pOctetStrings->cItems);
1883	for (unsigned i = 0; i < pAttr->uValues.pOctetStrings->cItems; i++)
1884	{
1885	PCRTASN1OCTETSTRING pOctetString = pAttr->uValues.pOctetStrings->papItems[i];
1886	size_t cbContent = pOctetString->Asn1Core.cb;
1887	char const *pchContent = pOctetString->Asn1Core.uData.pch;
1888	rc = RTStrValidateEncodingEx(pchContent, cbContent, RTSTR_VALIDATE_ENCODING_EXACT_LENGTH);
1889	if (RT_SUCCESS(rc))
1890	{
1891	while (cbContent > 0)
1892	{
1893	const char pchNewLine = (const char )memchr(pchContent, '\n', cbContent);
1894	size_t cchToWrite = pchNewLine ? pchNewLine - pchContent : cbContent;
1895	if (pAttr->uValues.pOctetStrings->cItems == 1)
1896	RTPrintf("%s %.*s\n", pThis->szPrefix, cchToWrite, pchContent);
1897	else
1898	RTPrintf("%s plist[%u]: %.*s\n", pThis->szPrefix, i, cchToWrite, pchContent);
1899	if (!pchNewLine)
1900	break;
1901	pchContent = pchNewLine + 1;
1902	cbContent -= cchToWrite + 1;
1903	}
1904	}
1905	else
1906	{
1907	if (pAttr->uValues.pContentInfos->cItems != 1)
1908	RTPrintf("%s: plist[%u]: Invalid UTF-8: %Rrc\n", pThis->szPrefix, i, rc);
1909	else
1910	RTPrintf("%s: Invalid UTF-8: %Rrc\n", pThis->szPrefix, rc);
1911	for (uint32_t off = 0; off < cbContent; off += 16)
1912	{
1913	size_t cbNow = RT_MIN(cbContent - off, 16);
1914	if (pAttr->uValues.pOctetStrings->cItems == 1)
1915	RTPrintf("%s %#06x: %.*Rhxs\n", pThis->szPrefix, off, cbNow, &pchContent[off]);
1916	else
1917	RTPrintf("%s plist[%u]: %#06x: %.*Rhxs\n", pThis->szPrefix, i, off, cbNow, &pchContent[off]);
1918	}
1919	}
1920	}
1921	break;
1922
1923	case RTCRPKCS7ATTRIBUTETYPE_INVALID:
1924	RTPrintf("%sINVALID!\n", pThis->szPrefix);
1925	break;
1926	case RTCRPKCS7ATTRIBUTETYPE_NOT_PRESENT:
1927	RTPrintf("%sNOT PRESENT!\n", pThis->szPrefix);
1928	break;
1929	default:
1930	RTPrintf("%senmType=%d!\n", pThis->szPrefix, pAttr->enmType);
1931	break;
1932	}
1933	return rc;
1934	}
1935
1936
1937	/**
1938	* Displays a Microsoft SPC indirect data structure.
1939	*
1940	* @returns IPRT status code.
1941	* @param pThis The show exe instance data.
1942	* @param offPrefix The current prefix offset.
1943	* @param pIndData The indirect data to display.
1944	*/
1945	static int HandleShowExeWorkerPkcs7DisplaySpcIdirectDataContent(PSHOWEXEPKCS7 pThis, size_t offPrefix,
1946	PCRTCRSPCINDIRECTDATACONTENT pIndData)
1947	{
1948	/*
1949	* The image hash.
1950	*/
1951	RTDIGESTTYPE const enmDigestType = RTCrX509AlgorithmIdentifier_QueryDigestType(&pIndData->DigestInfo.DigestAlgorithm);
1952	const char *pszDigestType = RTCrDigestTypeToName(enmDigestType);
1953	RTPrintf("%s Digest Type: %s", pThis->szPrefix, pszDigestType);
1954	if (pThis->cVerbosity > 1)
1955	RTPrintf(" (%s)\n", pIndData->DigestInfo.DigestAlgorithm.Algorithm.szObjId);
1956	else
1957	RTPrintf("\n");
1958	RTPrintf("%s Digest: %.*Rhxs\n",
1959	pThis->szPrefix, pIndData->DigestInfo.Digest.Asn1Core.cb, pIndData->DigestInfo.Digest.Asn1Core.uData.pu8);
1960
1961	/*
1962	* The data/file/url.
1963	*/
1964	switch (pIndData->Data.enmType)
1965	{
1966	case RTCRSPCAAOVTYPE_PE_IMAGE_DATA:
1967	{
1968	RTPrintf("%s Data Type: PE Image Data\n", pThis->szPrefix);
1969	PRTCRSPCPEIMAGEDATA pPeImage = pIndData->Data.uValue.pPeImage;
1970	/** @todo display "Flags". */
1971
1972	switch (pPeImage->T0.File.enmChoice)
1973	{
1974	case RTCRSPCLINKCHOICE_MONIKER:
1975	{
1976	PRTCRSPCSERIALIZEDOBJECT pMoniker = pPeImage->T0.File.u.pMoniker;
1977	if (RTCrSpcSerializedObject_IsPresent(pMoniker))
1978	{
1979	if (RTUuidCompareStr(pMoniker->Uuid.Asn1Core.uData.pUuid, RTCRSPCSERIALIZEDOBJECT_UUID_STR) == 0)
1980	{
1981	RTPrintf("%s Moniker: SpcSerializedObject (%RTuuid)\n",
1982	pThis->szPrefix, pMoniker->Uuid.Asn1Core.uData.pUuid);
1983
1984	PCRTCRSPCSERIALIZEDOBJECTATTRIBUTES pData = pMoniker->u.pData;
1985	if (pData)
1986	for (uint32_t i = 0; i < pData->cItems; i++)
1987	{
1988	RTStrPrintf(&pThis->szPrefix[offPrefix], sizeof(pThis->szPrefix) - offPrefix,
1989	"MonikerAttrib[%u]: ", i);
1990
1991	switch (pData->papItems[i]->enmType)
1992	{
1993	case RTCRSPCSERIALIZEDOBJECTATTRIBUTETYPE_PAGE_HASHES_V2:
1994	case RTCRSPCSERIALIZEDOBJECTATTRIBUTETYPE_PAGE_HASHES_V1:
1995	{
1996	PCRTCRSPCSERIALIZEDPAGEHASHES pPgHashes = pData->papItems[i]->u.pPageHashes;
1997	uint32_t const cbHash = pData->papItems[i]->enmType
1998	== RTCRSPCSERIALIZEDOBJECTATTRIBUTETYPE_PAGE_HASHES_V1
1999	? 160/8 /SHA-1/ : 256/8 /SHA-256/;
2000	uint32_t const cPages = pPgHashes->RawData.Asn1Core.cb / (cbHash + sizeof(uint32_t));
2001
2002	RTPrintf("%sPage Hashes version %u - %u pages (%u bytes total)\n", pThis->szPrefix,
2003	pData->papItems[i]->enmType
2004	== RTCRSPCSERIALIZEDOBJECTATTRIBUTETYPE_PAGE_HASHES_V1 ? 1 : 2,
2005	cPages, pPgHashes->RawData.Asn1Core.cb);
2006	if (pThis->cVerbosity > 0)
2007	{
2008	PCRTCRSPCPEIMAGEPAGEHASHES pPg = pPgHashes->pData;
2009	for (unsigned iPg = 0; iPg < cPages; iPg++)
2010	{
2011	uint32_t offHash = 0;
2012	do
2013	{
2014	if (offHash == 0)
2015	RTPrintf("%.*s Page#%04u/%#08x: ",
2016	offPrefix, pThis->szPrefix, iPg, pPg->Generic.offFile);
2017	else
2018	RTPrintf("%.*s ", offPrefix, pThis->szPrefix);
2019	uint32_t cbLeft = cbHash - offHash;
2020	if (cbLeft > 24)
2021	cbLeft = 16;
2022	RTPrintf("%.*Rhxs\n", cbLeft, &pPg->Generic.abHash[offHash]);
2023	offHash += cbLeft;
2024	} while (offHash < cbHash);
2025	pPg = (PCRTCRSPCPEIMAGEPAGEHASHES)&pPg->Generic.abHash[cbHash];
2026	}
2027
2028	if (pThis->cVerbosity > 3)
2029	RTPrintf("%.*Rhxd\n",
2030	pPgHashes->RawData.Asn1Core.cb,
2031	pPgHashes->RawData.Asn1Core.uData.pu8);
2032	}
2033	break;
2034	}
2035
2036	case RTCRSPCSERIALIZEDOBJECTATTRIBUTETYPE_UNKNOWN:
2037	HandleShowExeWorkerDisplayObjIdSimple(pThis, &pData->papItems[i]->Type, "\n");
2038	break;
2039	case RTCRSPCSERIALIZEDOBJECTATTRIBUTETYPE_NOT_PRESENT:
2040	RTPrintf("%sNot present!\n", pThis->szPrefix);
2041	break;
2042	default:
2043	RTPrintf("%senmType=%d!\n", pThis->szPrefix, pData->papItems[i]->enmType);
2044	break;
2045	}
2046	pThis->szPrefix[offPrefix] = '\0';
2047	}
2048	else
2049	RTPrintf("%s pData is NULL!\n", pThis->szPrefix);
2050	}
2051	else
2052	RTPrintf("%s Moniker: Unknown UUID: %RTuuid\n",
2053	pThis->szPrefix, pMoniker->Uuid.Asn1Core.uData.pUuid);
2054	}
2055	else
2056	RTPrintf("%s Moniker: not present\n", pThis->szPrefix);
2057	break;
2058	}
2059
2060	case RTCRSPCLINKCHOICE_URL:
2061	{
2062	const char *pszUrl = NULL;
2063	int rc = pPeImage->T0.File.u.pUrl
2064	? RTAsn1String_QueryUtf8(pPeImage->T0.File.u.pUrl, &pszUrl, NULL)
2065	: VERR_NOT_FOUND;
2066	if (RT_SUCCESS(rc))
2067	RTPrintf("%s URL: '%s'\n", pThis->szPrefix, pszUrl);
2068	else
2069	RTPrintf("%s URL: rc=%Rrc\n", pThis->szPrefix, rc);
2070	break;
2071	}
2072
2073	case RTCRSPCLINKCHOICE_FILE:
2074	{
2075	const char *pszFile = NULL;
2076	int rc = pPeImage->T0.File.u.pT2 && pPeImage->T0.File.u.pT2->File.u.pAscii
2077	? RTAsn1String_QueryUtf8(pPeImage->T0.File.u.pT2->File.u.pAscii, &pszFile, NULL)
2078	: VERR_NOT_FOUND;
2079	if (RT_SUCCESS(rc))
2080	RTPrintf("%s File: '%s'\n", pThis->szPrefix, pszFile);
2081	else
2082	RTPrintf("%s File: rc=%Rrc\n", pThis->szPrefix, rc);
2083	break;
2084	}
2085
2086	case RTCRSPCLINKCHOICE_NOT_PRESENT:
2087	RTPrintf("%s File not present!\n", pThis->szPrefix);
2088	break;
2089	default:
2090	RTPrintf("%s enmChoice=%d!\n", pThis->szPrefix, pPeImage->T0.File.enmChoice);
2091	break;
2092	}
2093	break;
2094	}
2095
2096	case RTCRSPCAAOVTYPE_UNKNOWN:
2097	HandleShowExeWorkerDisplayObjId(pThis, &pIndData->Data.Type, " Data Type: ", "\n");
2098	break;
2099	case RTCRSPCAAOVTYPE_NOT_PRESENT:
2100	RTPrintf("%s Data Type: Not present!\n", pThis->szPrefix);
2101	break;
2102	default:
2103	RTPrintf("%s Data Type: enmType=%d!\n", pThis->szPrefix, pIndData->Data.enmType);
2104	break;
2105	}
2106
2107	return VINF_SUCCESS;
2108	}
2109
2110
2111	/**
2112	* Display an PKCS#7 signed data instance.
2113	*
2114	* @returns IPRT status code.
2115	* @param pThis The show exe instance data.
2116	* @param pSignedData The signed data to display.
2117	* @param offPrefix The current prefix offset.
2118	* @param pContentInfo The content info structure (for the size).
2119	*/
2120	static int HandleShowExeWorkerPkcs7Display(PSHOWEXEPKCS7 pThis, PRTCRPKCS7SIGNEDDATA pSignedData, size_t offPrefix,
2121	PCRTCRPKCS7CONTENTINFO pContentInfo)
2122	{
2123	pThis->szPrefix[offPrefix] = '\0';
2124	RTPrintf("%sPKCS#7 signature: %u (%#x) bytes\n", pThis->szPrefix,
2125	RTASN1CORE_GET_RAW_ASN1_SIZE(&pContentInfo->SeqCore.Asn1Core),
2126	RTASN1CORE_GET_RAW_ASN1_SIZE(&pContentInfo->SeqCore.Asn1Core));
2127
2128	/*
2129	* Display list of signing algorithms.
2130	*/
2131	RTPrintf("%sDigestAlgorithms: ", pThis->szPrefix);
2132	if (pSignedData->DigestAlgorithms.cItems == 0)
2133	RTPrintf("none");
2134	for (unsigned i = 0; i < pSignedData->DigestAlgorithms.cItems; i++)
2135	{
2136	PCRTCRX509ALGORITHMIDENTIFIER pAlgoId = pSignedData->DigestAlgorithms.papItems[i];
2137	const char *pszDigestType = RTCrDigestTypeToName(RTCrX509AlgorithmIdentifier_QueryDigestType(pAlgoId));
2138	if (!pszDigestType)
2139	pszDigestType = pAlgoId->Algorithm.szObjId;
2140	RTPrintf(i == 0 ? "%s" : ", %s", pszDigestType);
2141	if (pThis->cVerbosity > 1)
2142	RTPrintf(" (%s)", pAlgoId->Algorithm.szObjId);
2143	}
2144	RTPrintf("\n");
2145
2146	/*
2147	* Display the signed data content.
2148	*/
2149	if (RTAsn1ObjId_CompareWithString(&pSignedData->ContentInfo.ContentType, RTCRSPCINDIRECTDATACONTENT_OID) == 0)
2150	{
2151	RTPrintf("%s ContentType: SpcIndirectDataContent (" RTCRSPCINDIRECTDATACONTENT_OID ")\n", pThis->szPrefix);
2152	size_t offPrefix2 = RTStrPrintf(&pThis->szPrefix[offPrefix], sizeof(pThis->szPrefix) - offPrefix, " SPC Ind Data: ");
2153	HandleShowExeWorkerPkcs7DisplaySpcIdirectDataContent(pThis, offPrefix2 + offPrefix,
2154	pSignedData->ContentInfo.u.pIndirectDataContent);
2155	pThis->szPrefix[offPrefix] = '\0';
2156	}
2157	else
2158	HandleShowExeWorkerDisplayObjId(pThis, &pSignedData->ContentInfo.ContentType, " ContentType: ", " - not implemented.\n");
2159
2160	/*
2161	* Display certificates (Certificates).
2162	*/
2163	if (pSignedData->Certificates.cItems > 0)
2164	{
2165	RTPrintf("%s Certificates: %u\n", pThis->szPrefix, pSignedData->Certificates.cItems);
2166	if (pThis->cVerbosity >= 2)
2167	{
2168	for (uint32_t i = 0; i < pSignedData->Certificates.cItems; i++)
2169	{
2170	if (i != 0)
2171	RTPrintf("\n");
2172	RTPrintf("%s Certificate #%u:\n", pThis->szPrefix, i);
2173	RTAsn1Dump(RTCrPkcs7Cert_GetAsn1Core(pSignedData->Certificates.papItems[i]), 0,
2174	((uint32_t)offPrefix + 9) / 2, RTStrmDumpPrintfV, g_pStdOut);
2175	}
2176	}
2177	/** @todo display certificates properly. */
2178	}
2179
2180	if (pSignedData->Crls.cb > 0)
2181	RTPrintf("%s CRLs: %u bytes\n", pThis->szPrefix, pSignedData->Crls.cb);
2182
2183	/*
2184	* Show signatures (SignerInfos).
2185	*/
2186	unsigned const cSigInfos = pSignedData->SignerInfos.cItems;
2187	if (cSigInfos != 1)
2188	RTPrintf("%s SignerInfos: %u signers\n", pThis->szPrefix, cSigInfos);
2189	else
2190	RTPrintf("%s SignerInfos:\n", pThis->szPrefix);
2191	for (unsigned i = 0; i < cSigInfos; i++)
2192	{
2193	PRTCRPKCS7SIGNERINFO pSigInfo = pSignedData->SignerInfos.papItems[i];
2194	size_t offPrefix2 = offPrefix;
2195	if (cSigInfos != 1)
2196	offPrefix2 += RTStrPrintf(&pThis->szPrefix[offPrefix], sizeof(pThis->szPrefix) - offPrefix, "SignerInfo[%u]: ", i);
2197
2198	int rc = RTAsn1Integer_ToString(&pSigInfo->IssuerAndSerialNumber.SerialNumber,
2199	pThis->szTmp, sizeof(pThis->szTmp), 0 /fFlags/, NULL);
2200	if (RT_FAILURE(rc))
2201	RTStrPrintf(pThis->szTmp, sizeof(pThis->szTmp), "%Rrc", rc);
2202	RTPrintf("%s Serial No: %s\n", pThis->szPrefix, pThis->szTmp);
2203
2204	rc = RTCrX509Name_FormatAsString(&pSigInfo->IssuerAndSerialNumber.Name, pThis->szTmp, sizeof(pThis->szTmp), NULL);
2205	if (RT_FAILURE(rc))
2206	RTStrPrintf(pThis->szTmp, sizeof(pThis->szTmp), "%Rrc", rc);
2207	RTPrintf("%s Issuer: %s\n", pThis->szPrefix, pThis->szTmp);
2208
2209	const char *pszType = RTCrDigestTypeToName(RTCrX509AlgorithmIdentifier_QueryDigestType(&pSigInfo->DigestAlgorithm));
2210	if (!pszType)
2211	pszType = pSigInfo->DigestAlgorithm.Algorithm.szObjId;
2212	RTPrintf("%s Digest Algorithm: %s", pThis->szPrefix, pszType);
2213	if (pThis->cVerbosity > 1)
2214	RTPrintf(" (%s)\n", pSigInfo->DigestAlgorithm.Algorithm.szObjId);
2215	else
2216	RTPrintf("\n");
2217
2218	HandleShowExeWorkerDisplayObjId(pThis, &pSigInfo->DigestEncryptionAlgorithm.Algorithm,
2219	"Digest Encryption Algorithm: ", "\n");
2220
2221	if (pSigInfo->AuthenticatedAttributes.cItems == 0)
2222	RTPrintf("%s Authenticated Attributes: none\n", pThis->szPrefix);
2223	else
2224	{
2225	RTPrintf("%s Authenticated Attributes: %u item%s\n", pThis->szPrefix,
2226	pSigInfo->AuthenticatedAttributes.cItems, pSigInfo->AuthenticatedAttributes.cItems > 1 ? "s" : "");
2227	for (unsigned j = 0; j < pSigInfo->AuthenticatedAttributes.cItems; j++)
2228	{
2229	PRTCRPKCS7ATTRIBUTE pAttr = pSigInfo->AuthenticatedAttributes.papItems[j];
2230	size_t offPrefix3 = offPrefix2 + RTStrPrintf(&pThis->szPrefix[offPrefix2], sizeof(pThis->szPrefix) - offPrefix2,
2231	" AuthAttrib[%u]: ", j);
2232	HandleShowExeWorkerPkcs7DisplayAttrib(pThis, offPrefix3, pAttr);
2233	}
2234	pThis->szPrefix[offPrefix2] = '\0';
2235	}
2236
2237	if (pSigInfo->UnauthenticatedAttributes.cItems == 0)
2238	RTPrintf("%s Unauthenticated Attributes: none\n", pThis->szPrefix);
2239	else
2240	{
2241	RTPrintf("%s Unauthenticated Attributes: %u item%s\n", pThis->szPrefix,
2242	pSigInfo->UnauthenticatedAttributes.cItems, pSigInfo->UnauthenticatedAttributes.cItems > 1 ? "s" : "");
2243	for (unsigned j = 0; j < pSigInfo->UnauthenticatedAttributes.cItems; j++)
2244	{
2245	PRTCRPKCS7ATTRIBUTE pAttr = pSigInfo->UnauthenticatedAttributes.papItems[j];
2246	size_t offPrefix3 = offPrefix2 + RTStrPrintf(&pThis->szPrefix[offPrefix2], sizeof(pThis->szPrefix) - offPrefix2,
2247	" UnauthAttrib[%u]: ", j);
2248	HandleShowExeWorkerPkcs7DisplayAttrib(pThis, offPrefix3, pAttr);
2249	}
2250	pThis->szPrefix[offPrefix2] = '\0';
2251	}
2252
2253	/** @todo show the encrypted stuff (EncryptedDigest)? */
2254	}
2255	pThis->szPrefix[offPrefix] = '\0';
2256
2257	return VINF_SUCCESS;
2258	}
2259
2260
2261	/*
2262	* The 'show-exe' command.
2263	*/
2264	static RTEXITCODE HelpShowExe(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel)
2265	{
2266	RT_NOREF_PV(enmLevel);
2267	RTStrmPrintf(pStrm,
2268	"show-exe [--verbose\|-v] [--quiet\|-q] <exe1> [exe2 [..]]\n");
2269	return RTEXITCODE_SUCCESS;
2270	}
2271
2272
2273	static RTEXITCODE HandleShowExe(int cArgs, char **papszArgs)
2274	{
2275	/*
2276	* Parse arguments.
2277	*/
2278	static const RTGETOPTDEF s_aOptions[] =
2279	{
2280	{ "--verbose", 'v', RTGETOPT_REQ_NOTHING },
2281	{ "--quiet", 'q', RTGETOPT_REQ_NOTHING },
2282	};
2283
2284	unsigned cVerbosity = 0;
2285	RTLDRARCH enmLdrArch = RTLDRARCH_WHATEVER;
2286
2287	RTGETOPTSTATE GetState;
2288	int rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1, RTGETOPTINIT_FLAGS_OPTS_FIRST);
2289	AssertRCReturn(rc, RTEXITCODE_FAILURE);
2290	RTGETOPTUNION ValueUnion;
2291	int ch;
2292	while ((ch = RTGetOpt(&GetState, &ValueUnion)) && ch != VINF_GETOPT_NOT_OPTION)
2293	{
2294	switch (ch)
2295	{
2296	case 'v': cVerbosity++; break;
2297	case 'q': cVerbosity = 0; break;
2298	case 'V': return HandleVersion(cArgs, papszArgs);
2299	case 'h': return HelpShowExe(g_pStdOut, RTSIGNTOOLHELP_FULL);
2300	default: return RTGetOptPrintError(ch, &ValueUnion);
2301	}
2302	}
2303	if (ch != VINF_GETOPT_NOT_OPTION)
2304	return RTMsgErrorExit(RTEXITCODE_FAILURE, "No executable given.");
2305
2306	/*
2307	* Do it.
2308	*/
2309	unsigned iFile = 0;
2310	RTEXITCODE rcExit = RTEXITCODE_SUCCESS;
2311	do
2312	{
2313	RTPrintf(iFile == 0 ? "%s:\n" : "\n%s:\n", ValueUnion.psz);
2314
2315	SHOWEXEPKCS7 This;
2316	RT_ZERO(This);
2317	This.cVerbosity = cVerbosity;
2318
2319	RTEXITCODE rcExitThis = SignToolPkcs7Exe_InitFromFile(&This, ValueUnion.psz, cVerbosity, enmLdrArch);
2320	if (rcExitThis == RTEXITCODE_SUCCESS)
2321	{
2322	rc = HandleShowExeWorkerPkcs7Display(&This, This.pSignedData, 0, &This.ContentInfo);
2323	if (RT_FAILURE(rc))
2324	rcExit = RTEXITCODE_FAILURE;
2325	SignToolPkcs7Exe_Delete(&This);
2326	}
2327	if (rcExitThis != RTEXITCODE_SUCCESS && rcExit == RTEXITCODE_SUCCESS)
2328	rcExit = rcExitThis;
2329
2330	iFile++;
2331	} while ((ch = RTGetOpt(&GetState, &ValueUnion)) == VINF_GETOPT_NOT_OPTION);
2332	if (ch != 0)
2333	return RTGetOptPrintError(ch, &ValueUnion);
2334
2335	return rcExit;
2336	}
2337
2338
2339	/*
2340	* The 'show-cat' command.
2341	*/
2342	static RTEXITCODE HelpShowCat(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel)
2343	{
2344	RT_NOREF_PV(enmLevel);
2345	RTStrmPrintf(pStrm,
2346	"show-cat [--verbose\|-v] [--quiet\|-q] <cat1> [cat2 [..]]\n");
2347	return RTEXITCODE_SUCCESS;
2348	}
2349
2350
2351	static RTEXITCODE HandleShowCat(int cArgs, char **papszArgs)
2352	{
2353	/*
2354	* Parse arguments.
2355	*/
2356	static const RTGETOPTDEF s_aOptions[] =
2357	{
2358	{ "--verbose", 'v', RTGETOPT_REQ_NOTHING },
2359	{ "--quiet", 'q', RTGETOPT_REQ_NOTHING },
2360	};
2361
2362	unsigned cVerbosity = 0;
2363
2364	RTGETOPTSTATE GetState;
2365	int rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1, RTGETOPTINIT_FLAGS_OPTS_FIRST);
2366	AssertRCReturn(rc, RTEXITCODE_FAILURE);
2367	RTGETOPTUNION ValueUnion;
2368	int ch;
2369	while ((ch = RTGetOpt(&GetState, &ValueUnion)) && ch != VINF_GETOPT_NOT_OPTION)
2370	{
2371	switch (ch)
2372	{
2373	case 'v': cVerbosity++; break;
2374	case 'q': cVerbosity = 0; break;
2375	case 'V': return HandleVersion(cArgs, papszArgs);
2376	case 'h': return HelpShowCat(g_pStdOut, RTSIGNTOOLHELP_FULL);
2377	default: return RTGetOptPrintError(ch, &ValueUnion);
2378	}
2379	}
2380	if (ch != VINF_GETOPT_NOT_OPTION)
2381	return RTMsgErrorExit(RTEXITCODE_FAILURE, "No executable given.");
2382
2383	/*
2384	* Do it.
2385	*/
2386	unsigned iFile = 0;
2387	RTEXITCODE rcExit = RTEXITCODE_SUCCESS;
2388	do
2389	{
2390	RTPrintf(iFile == 0 ? "%s:\n" : "\n%s:\n", ValueUnion.psz);
2391
2392	SHOWEXEPKCS7 This;
2393	RT_ZERO(This);
2394	This.cVerbosity = cVerbosity;
2395
2396	RTEXITCODE rcExitThis = SignToolPkcs7_InitFromFile(&This, ValueUnion.psz, cVerbosity);
2397	if (rcExitThis == RTEXITCODE_SUCCESS)
2398	{
2399	This.hLdrMod = NIL_RTLDRMOD;
2400
2401	rc = HandleShowExeWorkerPkcs7Display(&This, This.pSignedData, 0, &This.ContentInfo);
2402	if (RT_FAILURE(rc))
2403	rcExit = RTEXITCODE_FAILURE;
2404	SignToolPkcs7Exe_Delete(&This);
2405	}
2406	if (rcExitThis != RTEXITCODE_SUCCESS && rcExit == RTEXITCODE_SUCCESS)
2407	rcExit = rcExitThis;
2408
2409	iFile++;
2410	} while ((ch = RTGetOpt(&GetState, &ValueUnion)) == VINF_GETOPT_NOT_OPTION);
2411	if (ch != 0)
2412	return RTGetOptPrintError(ch, &ValueUnion);
2413
2414	return rcExit;
2415	}
2416
2417
2418	/*
2419	* The 'make-tainfo' command.
2420	*/
2421	static RTEXITCODE HelpMakeTaInfo(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel)
2422	{
2423	RT_NOREF_PV(enmLevel);
2424	RTStrmPrintf(pStrm,
2425	"make-tainfo [--verbose\|--quiet] [--cert <cert.der>] [-o\|--output] <tainfo.der>\n");
2426	return RTEXITCODE_SUCCESS;
2427	}
2428
2429
2430	typedef struct MAKETAINFOSTATE
2431	{
2432	int cVerbose;
2433	const char *pszCert;
2434	const char *pszOutput;
2435	} MAKETAINFOSTATE;
2436
2437
2438	/** @callback_method_impl{FNRTASN1ENCODEWRITER} */
2439	static DECLCALLBACK(int) handleMakeTaInfoWriter(const void pvBuf, size_t cbToWrite, void pvUser, PRTERRINFO pErrInfo)
2440	{
2441	RT_NOREF_PV(pErrInfo);
2442	return RTStrmWrite((PRTSTREAM)pvUser, pvBuf, cbToWrite);
2443	}
2444
2445
2446	static RTEXITCODE HandleMakeTaInfo(int cArgs, char **papszArgs)
2447	{
2448	/*
2449	* Parse arguments.
2450	*/
2451	static const RTGETOPTDEF s_aOptions[] =
2452	{
2453	{ "--cert", 'c', RTGETOPT_REQ_STRING },
2454	{ "--output", 'o', RTGETOPT_REQ_STRING },
2455	{ "--verbose", 'v', RTGETOPT_REQ_NOTHING },
2456	{ "--quiet", 'q', RTGETOPT_REQ_NOTHING },
2457	};
2458
2459	MAKETAINFOSTATE State = { 0, NULL, NULL };
2460
2461	RTGETOPTSTATE GetState;
2462	int rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1, RTGETOPTINIT_FLAGS_OPTS_FIRST);
2463	AssertRCReturn(rc, RTEXITCODE_FAILURE);
2464	RTGETOPTUNION ValueUnion;
2465	int ch;
2466	while ((ch = RTGetOpt(&GetState, &ValueUnion)) != 0)
2467	{
2468	switch (ch)
2469	{
2470	case 'c':
2471	if (State.pszCert)
2472	return RTMsgErrorExit(RTEXITCODE_FAILURE, "The --cert option can only be used once.");
2473	State.pszCert = ValueUnion.psz;
2474	break;
2475
2476	case 'o':
2477	case VINF_GETOPT_NOT_OPTION:
2478	if (State.pszOutput)
2479	return RTMsgErrorExit(RTEXITCODE_FAILURE, "Multiple output files specified.");
2480	State.pszOutput = ValueUnion.psz;
2481	break;
2482
2483	case 'v': State.cVerbose++; break;
2484	case 'q': State.cVerbose = 0; break;
2485	case 'V': return HandleVersion(cArgs, papszArgs);
2486	case 'h': return HelpMakeTaInfo(g_pStdOut, RTSIGNTOOLHELP_FULL);
2487	default: return RTGetOptPrintError(ch, &ValueUnion);
2488	}
2489	}
2490	if (!State.pszCert)
2491	return RTMsgErrorExit(RTEXITCODE_FAILURE, "No input certificate was specified.");
2492	if (!State.pszOutput)
2493	return RTMsgErrorExit(RTEXITCODE_FAILURE, "No output file was specified.");
2494
2495	/*
2496	* Read the certificate.
2497	*/
2498	RTERRINFOSTATIC StaticErrInfo;
2499	RTCRX509CERTIFICATE Certificate;
2500	rc = RTCrX509Certificate_ReadFromFile(&Certificate, State.pszCert, 0, &g_RTAsn1DefaultAllocator,
2501	RTErrInfoInitStatic(&StaticErrInfo));
2502	if (RT_FAILURE(rc))
2503	return RTMsgErrorExit(RTEXITCODE_FAILURE, "Error reading certificate from %s: %Rrc - %s",
2504	State.pszCert, rc, StaticErrInfo.szMsg);
2505	/*
2506	* Construct the trust anchor information.
2507	*/
2508	RTCRTAFTRUSTANCHORINFO TrustAnchor;
2509	rc = RTCrTafTrustAnchorInfo_Init(&TrustAnchor, &g_RTAsn1DefaultAllocator);
2510	if (RT_SUCCESS(rc))
2511	{
2512	/* Public key. */
2513	Assert(RTCrX509SubjectPublicKeyInfo_IsPresent(&TrustAnchor.PubKey));
2514	RTCrX509SubjectPublicKeyInfo_Delete(&TrustAnchor.PubKey);
2515	rc = RTCrX509SubjectPublicKeyInfo_Clone(&TrustAnchor.PubKey, &Certificate.TbsCertificate.SubjectPublicKeyInfo,
2516	&g_RTAsn1DefaultAllocator);
2517	if (RT_FAILURE(rc))
2518	RTMsgError("RTCrX509SubjectPublicKeyInfo_Clone failed: %Rrc", rc);
2519	RTAsn1Core_ResetImplict(RTCrX509SubjectPublicKeyInfo_GetAsn1Core(&TrustAnchor.PubKey)); /* temporary hack. */
2520
2521	/* Key Identifier. */
2522	PCRTASN1OCTETSTRING pKeyIdentifier = NULL;
2523	if (Certificate.TbsCertificate.T3.fFlags & RTCRX509TBSCERTIFICATE_F_PRESENT_SUBJECT_KEY_IDENTIFIER)
2524	pKeyIdentifier = Certificate.TbsCertificate.T3.pSubjectKeyIdentifier;
2525	else if ( (Certificate.TbsCertificate.T3.fFlags & RTCRX509TBSCERTIFICATE_F_PRESENT_AUTHORITY_KEY_IDENTIFIER)
2526	&& RTCrX509Certificate_IsSelfSigned(&Certificate)
2527	&& RTAsn1OctetString_IsPresent(&Certificate.TbsCertificate.T3.pAuthorityKeyIdentifier->KeyIdentifier) )
2528	pKeyIdentifier = &Certificate.TbsCertificate.T3.pAuthorityKeyIdentifier->KeyIdentifier;
2529	else if ( (Certificate.TbsCertificate.T3.fFlags & RTCRX509TBSCERTIFICATE_F_PRESENT_OLD_AUTHORITY_KEY_IDENTIFIER)
2530	&& RTCrX509Certificate_IsSelfSigned(&Certificate)
2531	&& RTAsn1OctetString_IsPresent(&Certificate.TbsCertificate.T3.pOldAuthorityKeyIdentifier->KeyIdentifier) )
2532	pKeyIdentifier = &Certificate.TbsCertificate.T3.pOldAuthorityKeyIdentifier->KeyIdentifier;
2533	if (pKeyIdentifier && pKeyIdentifier->Asn1Core.cb > 0)
2534	{
2535	Assert(RTAsn1OctetString_IsPresent(&TrustAnchor.KeyIdentifier));
2536	RTAsn1OctetString_Delete(&TrustAnchor.KeyIdentifier);
2537	rc = RTAsn1OctetString_Clone(&TrustAnchor.KeyIdentifier, pKeyIdentifier, &g_RTAsn1DefaultAllocator);
2538	if (RT_FAILURE(rc))
2539	RTMsgError("RTAsn1OctetString_Clone failed: %Rrc", rc);
2540	RTAsn1Core_ResetImplict(RTAsn1OctetString_GetAsn1Core(&TrustAnchor.KeyIdentifier)); /* temporary hack. */
2541	}
2542	else
2543	RTMsgWarning("No key identifier found or has zero length.");
2544
2545	/* Subject */
2546	if (RT_SUCCESS(rc))
2547	{
2548	Assert(!RTCrTafCertPathControls_IsPresent(&TrustAnchor.CertPath));
2549	rc = RTCrTafCertPathControls_Init(&TrustAnchor.CertPath, &g_RTAsn1DefaultAllocator);
2550	if (RT_SUCCESS(rc))
2551	{
2552	Assert(RTCrX509Name_IsPresent(&TrustAnchor.CertPath.TaName));
2553	RTCrX509Name_Delete(&TrustAnchor.CertPath.TaName);
2554	rc = RTCrX509Name_Clone(&TrustAnchor.CertPath.TaName, &Certificate.TbsCertificate.Subject,
2555	&g_RTAsn1DefaultAllocator);
2556	if (RT_SUCCESS(rc))
2557	{
2558	RTAsn1Core_ResetImplict(RTCrX509Name_GetAsn1Core(&TrustAnchor.CertPath.TaName)); /* temporary hack. */
2559	rc = RTCrX509Name_RecodeAsUtf8(&TrustAnchor.CertPath.TaName, &g_RTAsn1DefaultAllocator);
2560	if (RT_FAILURE(rc))
2561	RTMsgError("RTCrX509Name_RecodeAsUtf8 failed: %Rrc", rc);
2562	}
2563	else
2564	RTMsgError("RTCrX509Name_Clone failed: %Rrc", rc);
2565	}
2566	else
2567	RTMsgError("RTCrTafCertPathControls_Init failed: %Rrc", rc);
2568	}
2569
2570	/* Check that what we've constructed makes some sense. */
2571	if (RT_SUCCESS(rc))
2572	{
2573	rc = RTCrTafTrustAnchorInfo_CheckSanity(&TrustAnchor, 0, RTErrInfoInitStatic(&StaticErrInfo), "TAI");
2574	if (RT_FAILURE(rc))
2575	RTMsgError("RTCrTafTrustAnchorInfo_CheckSanity failed: %Rrc - %s", rc, StaticErrInfo.szMsg);
2576	}
2577
2578	if (RT_SUCCESS(rc))
2579	{
2580	/*
2581	* Encode it and write it to the output file.
2582	*/
2583	uint32_t cbEncoded;
2584	rc = RTAsn1EncodePrepare(RTCrTafTrustAnchorInfo_GetAsn1Core(&TrustAnchor), RTASN1ENCODE_F_DER, &cbEncoded,
2585	RTErrInfoInitStatic(&StaticErrInfo));
2586	if (RT_SUCCESS(rc))
2587	{
2588	if (State.cVerbose >= 1)
2589	RTAsn1Dump(RTCrTafTrustAnchorInfo_GetAsn1Core(&TrustAnchor), 0, 0, RTStrmDumpPrintfV, g_pStdOut);
2590
2591	PRTSTREAM pStrm;
2592	rc = RTStrmOpen(State.pszOutput, "wb", &pStrm);
2593	if (RT_SUCCESS(rc))
2594	{
2595	rc = RTAsn1EncodeWrite(RTCrTafTrustAnchorInfo_GetAsn1Core(&TrustAnchor), RTASN1ENCODE_F_DER,
2596	handleMakeTaInfoWriter, pStrm, RTErrInfoInitStatic(&StaticErrInfo));
2597	if (RT_SUCCESS(rc))
2598	{
2599	rc = RTStrmClose(pStrm);
2600	if (RT_SUCCESS(rc))
2601	RTMsgInfo("Successfully wrote TrustedAnchorInfo to '%s'.", State.pszOutput);
2602	else
2603	RTMsgError("RTStrmClose failed: %Rrc", rc);
2604	}
2605	else
2606	{
2607	RTMsgError("RTAsn1EncodeWrite failed: %Rrc - %s", rc, StaticErrInfo.szMsg);
2608	RTStrmClose(pStrm);
2609	}
2610	}
2611	else
2612	RTMsgError("Error opening '%s' for writing: %Rrcs", State.pszOutput, rc);
2613	}
2614	else
2615	RTMsgError("RTAsn1EncodePrepare failed: %Rrc - %s", rc, StaticErrInfo.szMsg);
2616	}
2617
2618	RTCrTafTrustAnchorInfo_Delete(&TrustAnchor);
2619	}
2620	else
2621	RTMsgError("RTCrTafTrustAnchorInfo_Init failed: %Rrc", rc);
2622
2623	RTCrX509Certificate_Delete(&Certificate);
2624	return RT_SUCCESS(rc) ? RTEXITCODE_SUCCESS : RTEXITCODE_FAILURE;
2625	}
2626
2627
2628
2629	/*
2630	* The 'version' command.
2631	*/
2632	static RTEXITCODE HelpVersion(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel)
2633	{
2634	RT_NOREF_PV(enmLevel);
2635	RTStrmPrintf(pStrm, "version\n");
2636	return RTEXITCODE_SUCCESS;
2637	}
2638
2639	static RTEXITCODE HandleVersion(int cArgs, char **papszArgs)
2640	{
2641	RT_NOREF_PV(cArgs); RT_NOREF_PV(papszArgs);
2642	#ifndef IN_BLD_PROG /* RTBldCfgVersion or RTBldCfgRevision in build time IPRT lib. */
2643	RTPrintf("%s\n", RTBldCfgVersion());
2644	return RTEXITCODE_SUCCESS;
2645	#else
2646	return RTEXITCODE_FAILURE;
2647	#endif
2648	}
2649
2650
2651
2652	/**
2653	* Command mapping.
2654	*/
2655	static struct
2656	{
2657	/** The command. */
2658	const char *pszCmd;
2659	/**
2660	* Handle the command.
2661	* @returns Program exit code.
2662	* @param cArgs Number of arguments.
2663	* @param papszArgs The argument vector, starting with the command name.
2664	*/
2665	RTEXITCODE (pfnHandler)(int cArgs, char *papszArgs);
2666	/**
2667	* Produce help.
2668	* @returns RTEXITCODE_SUCCESS to simplify handling '--help' in the handler.
2669	* @param pStrm Where to send help text.
2670	* @param enmLevel The level of the help information.
2671	*/
2672	RTEXITCODE (*pfnHelp)(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel);
2673	}
2674	/** Mapping commands to handler and helper functions. */
2675	const g_aCommands[] =
2676	{
2677	{ "extract-exe-signer-cert", HandleExtractExeSignerCert, HelpExtractExeSignerCert },
2678	{ "add-nested-exe-signature", HandleAddNestedExeSignature, HelpAddNestedExeSignature },
2679	{ "add-nested-cat-signature", HandleAddNestedCatSignature, HelpAddNestedCatSignature },
2680	#ifndef IPRT_IN_BUILD_TOOL
2681	{ "verify-exe", HandleVerifyExe, HelpVerifyExe },
2682	#endif
2683	{ "show-exe", HandleShowExe, HelpShowExe },
2684	{ "show-cat", HandleShowCat, HelpShowCat },
2685	{ "make-tainfo", HandleMakeTaInfo, HelpMakeTaInfo },
2686	{ "help", HandleHelp, HelpHelp },
2687	{ "--help", HandleHelp, NULL },
2688	{ "-h", HandleHelp, NULL },
2689	{ "version", HandleVersion, HelpVersion },
2690	{ "--version", HandleVersion, NULL },
2691	{ "-V", HandleVersion, NULL },
2692	};
2693
2694
2695	/*
2696	* The 'help' command.
2697	*/
2698	static RTEXITCODE HelpHelp(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel)
2699	{
2700	RT_NOREF_PV(enmLevel);
2701	RTStrmPrintf(pStrm, "help [cmd-patterns]\n");
2702	return RTEXITCODE_SUCCESS;
2703	}
2704
2705	static RTEXITCODE HandleHelp(int cArgs, char **papszArgs)
2706	{
2707	RTSIGNTOOLHELP enmLevel = cArgs <= 1 ? RTSIGNTOOLHELP_USAGE : RTSIGNTOOLHELP_FULL;
2708	uint32_t cShowed = 0;
2709	for (uint32_t iCmd = 0; iCmd < RT_ELEMENTS(g_aCommands); iCmd++)
2710	{
2711	if (g_aCommands[iCmd].pfnHelp)
2712	{
2713	bool fShow = false;
2714	if (cArgs <= 1)
2715	fShow = true;
2716	else
2717	{
2718	for (int iArg = 1; iArg < cArgs; iArg++)
2719	if (RTStrSimplePatternMultiMatch(papszArgs[iArg], RTSTR_MAX, g_aCommands[iCmd].pszCmd, RTSTR_MAX, NULL))
2720	{
2721	fShow = true;
2722	break;
2723	}
2724	}
2725	if (fShow)
2726	{
2727	g_aCommands[iCmd].pfnHelp(g_pStdOut, enmLevel);
2728	cShowed++;
2729	}
2730	}
2731	}
2732	return cShowed ? RTEXITCODE_SUCCESS : RTEXITCODE_FAILURE;
2733	}
2734
2735
2736
2737	int main(int argc, char **argv)
2738	{
2739	int rc = RTR3InitExe(argc, &argv, 0);
2740	if (RT_FAILURE(rc))
2741	return RTMsgInitFailure(rc);
2742
2743	/*
2744	* Parse global arguments.
2745	*/
2746	int iArg = 1;
2747	/* none presently. */
2748
2749	/*
2750	* Command dispatcher.
2751	*/
2752	if (iArg < argc)
2753	{
2754	const char *pszCmd = argv[iArg];
2755	uint32_t i = RT_ELEMENTS(g_aCommands);
2756	while (i-- > 0)
2757	if (!strcmp(g_aCommands[i].pszCmd, pszCmd))
2758	return g_aCommands[i].pfnHandler(argc - iArg, &argv[iArg]);
2759	RTMsgError("Unknown command '%s'.", pszCmd);
2760	}
2761	else
2762	RTMsgError("No command given. (try --help)");
2763
2764	return RTEXITCODE_SYNTAX;
2765	}
2766

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Runtime/tools/RTSignTool.cpp@ 88823

Download in other formats: