Changeset 25341 in vbox for trunk/src

Timestamp:

Dec 12, 2009 2:33:26 AM (15 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

55936

Message:

ldrPE.cpp: Added WIN_CERTIFICATE and added very basic verification of it. (IMAGE_DIRECTORY_ENTRY_SECURITY)

Location:

trunk/src/VBox/Runtime

Files:

• common/ldr/ldrPE.cpp (modified) (2 diffs)
• include/internal/ldrPE.h (modified) (2 diffs)

trunk/src/VBox/Runtime/common/ldr/ldrPE.cpp

@@ -1118 +1118 @@
                 Log(("rtldrPEOpen: %s: dir no. %d (SECURITY) VirtualAddress=%#x Size=%#x is not supported!!!\n",
                      pszLogName, i, pDir->VirtualAddress, pDir->Size));
+                if (pDir->Size < sizeof(WIN_CERTIFICATE))
+                {
+                    Log(("rtldrPEOpen: %s: Security directory is too small: %#x bytes\n", pszLogName, i, pDir->Size));
+                    return VERR_LDRPE_MALFORMED_CERT;
+                }
+                if (pDir->Size >= _1M)
+                {
+                    Log(("rtldrPEOpen: %s: Security directory is too large: %#x bytes\n", pszLogName, i, pDir->Size));
+                    return VERR_LDRPE_MALFORMED_CERT;
+                }
+                if (pDir->VirtualAddress & 7)
+                {
+                    Log(("rtldrPEOpen: %s: Security directory is misaligned: %#x\n", pszLogName, i, pDir->VirtualAddress));
+                    return VERR_LDRPE_MALFORMED_CERT;
+                }
                 break;
 
@@ -1413 +1428 @@
         }
     }
+
+    /*
+     * If the image is signed, take a look at the signature.
+     */
+    Dir = pOptHdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY];
+    if (Dir.Size)
+    {
+        PWIN_CERTIFICATE pFirst = (PWIN_CERTIFICATE)RTMemTmpAlloc(Dir.Size);
+        if (!pFirst)
+            return VERR_NO_TMP_MEMORY;
+        int rc = pModPe->pReader->pfnRead(pModPe->pReader, pFirst, Dir.Size, Dir.VirtualAddress);
+        if (RT_SUCCESS(rc))
+        {
+            uint32_t         off  = 0;
+            PWIN_CERTIFICATE pCur = pFirst;
+            do
+            {
+                /* validate the members. */
+                uint32_t const cbCur = RT_ALIGN_32(pCur->dwLength, 8);
+                if (   cbCur < sizeof(WIN_CERTIFICATE)
+                    || cbCur + off > RT_ALIGN_32(Dir.Size, 8))
+                {
+                    Log(("rtldrPEOpen: %s: cert at %#x/%#x: dwLength=%#x\n", pszLogName, off, Dir.Size, pCur->dwLength));
+                    rc = VERR_LDRPE_MALFORMED_CERT;
+                    break;
+                }
+                if (    pCur->wRevision != WIN_CERT_REVISION_2_0
+                    &&  pCur->wRevision != WIN_CERT_REVISION_1_0)
+                {
+                    Log(("rtldrPEOpen: %s: cert at %#x/%#x: wRevision=%#x\n", pszLogName, off, Dir.Size, pCur->wRevision));
+                    rc = pCur->wRevision >= WIN_CERT_REVISION_1_0 ? VERR_LDRPE_CERT_UNSUPPORTED : VERR_LDRPE_CERT_MALFORMED;
+                    break;
+                }
+                if (    pCur->wCertificateType != WIN_CERT_TYPE_PKCS_SIGNED_DATA
+                    &&  pCur->wCertificateType != WIN_CERT_TYPE_X509
+                    /*&&  pCur->wCertificateType != WIN_CERT_TYPE_RESERVED_1*/
+                    /*&&  pCur->wCertificateType != WIN_CERT_TYPE_TS_STACK_SIGNED*/
+                    &&  pCur->wCertificateType != WIN_CERT_TYPE_EFI_PKCS115
+                    &&  pCur->wCertificateType != WIN_CERT_TYPE_EFI_GUID
+                   )
+                {
+                    Log(("rtldrPEOpen: %s: cert at %#x/%#x: wRevision=%#x\n", pszLogName, off, Dir.Size, pCur->wRevision));
+                    rc = pCur->wCertificateType ? VERR_LDRPE_CERT_UNSUPPORTED : VERR_LDRPE_CERT_MALFORMED;
+                    break;
+                }
+
+                /** @todo Rainy Day: Implement further verfication using openssl. */
+
+                /* next */
+                off += cbCur;
+                pCur = (PWIN_CERTIFICATE)((uint8_t *)pCur + cbCur);
+            } while (off < Dir.Size);
+        }
+        RTMemTmpFree(pFirst);
+        if (RT_FAILURE(rc))
+            return rc;
+    }
+
+
     return VINF_SUCCESS;
 }

trunk/src/VBox/Runtime/include/internal/ldrPE.h

@@ -196 +196 @@
 #define  IMAGE_DEBUG_TYPE_BORLAND  0x9
 #define  IMAGE_DEBUG_TYPE_RESERVED10  0x10
+
+/* security directory */
+#define  WIN_CERT_REVISION_1_0  UINT16_C(0x0100)
+#define  WIN_CERT_REVISION_2_0  UINT16_C(0x0200)
+
+#define  WIN_CERT_TYPE_X509  UINT16_C(1)
+#define  WIN_CERT_TYPE_PKCS_SIGNED_DATA  UINT16_C(2)
+#define  WIN_CERT_TYPE_RESERVED_1  UINT16_C(3)
+#define  WIN_CERT_TYPE_TS_STACK_SIGNED  UINT16_C(4)
+#define  WIN_CERT_TYPE_EFI_PKCS115 UINT16_C(0x0ef0)
+#define  WIN_CERT_TYPE_EFI_GUID UINT16_C(0x0ef1)
 
 
@@ -468 +479 @@
 typedef IMAGE_DEBUG_DIRECTORY *PIMAGE_DEBUG_DIRECTORY;
 
+
+typedef struct WIN_CERTIFICATE
+{
+    uint32_t    dwLength;
+    uint16_t    wRevision;
+    uint16_t    wCertificateType;
+    uint8_t     bCertificate[8];
+} WIN_CERTIFICATE;
+typedef WIN_CERTIFICATE *PWIN_CERTIFICATE;
+
 #pragma pack()