diff --git a/BurnOutSharp.Models/PortableExecutable/AttributeCertificateTableEntry.cs b/BurnOutSharp.Models/PortableExecutable/AttributeCertificateTableEntry.cs new file mode 100644 index 00000000..d6c384e0 --- /dev/null +++ b/BurnOutSharp.Models/PortableExecutable/AttributeCertificateTableEntry.cs @@ -0,0 +1,63 @@ +namespace BurnOutSharp.Models.PortableExecutable +{ + /// + /// Attribute certificates can be associated with an image by adding an attribute + /// certificate table. The attribute certificate table is composed of a set of + /// contiguous, quadword-aligned attribute certificate entries. Zero padding is + /// inserted between the original end of the file and the beginning of the attribute + /// certificate table to achieve this alignment. + /// + /// The virtual address value from the Certificate Table entry in the Optional + /// Header Data Directory is a file offset to the first attribute certificate + /// entry. Subsequent entries are accessed by advancing that entry's dwLength + /// bytes, rounded up to an 8-byte multiple, from the start of the current + /// attribute certificate entry. This continues until the sum of the rounded dwLength + /// values equals the Size value from the Certificates Table entry in the Optional + /// Header Data Directory. If the sum of the rounded dwLength values does not equal + /// the Size value, then either the attribute certificate table or the Size field + /// is corrupted. + /// + /// The first certificate starts at offset 0x5000 from the start of the file on disk. + /// To advance through all the attribute certificate entries: + /// + /// 1. Add the first attribute certificate's dwLength value to the starting offset. + /// 2. Round the value from step 1 up to the nearest 8-byte multiple to find the offset + /// of the second attribute certificate entry. + /// 3. Add the offset value from step 2 to the second attribute certificate entry's + /// dwLength value and round up to the nearest 8-byte multiple to determine the offset + /// of the third attribute certificate entry. + /// 4. Repeat step 3 for each successive certificate until the calculated offset equals + /// 0x6000 (0x5000 start + 0x1000 total size), which indicates that you've walked + /// the entire table. + /// + /// Attribute certificate table entries can contain any certificate type, as long as + /// the entry has the correct dwLength value, a unique wRevision value, and a unique + /// wCertificateType value. The most common type of certificate table entry is a + /// WIN_CERTIFICATE structure, which is documented in Wintrust.h and discussed in + /// the remainder of this section. + /// + /// + public class AttributeCertificateTableEntry + { + /// + /// Specifies the length of the attribute certificate entry. + /// + public uint Length; + + /// + /// Contains the certificate version number. + /// + public WindowsCertificateRevision Revision; + + /// + /// Specifies the type of content in Certificate. + /// + public WindowsCertificateType CertificateType; + + /// + /// Contains a certificate, such as an Authenticode signature. + /// + /// + public byte[] Certificate; + } +} diff --git a/BurnOutSharp.Models/PortableExecutable/Executable.cs b/BurnOutSharp.Models/PortableExecutable/Executable.cs index 70cc16e1..89794959 100644 --- a/BurnOutSharp.Models/PortableExecutable/Executable.cs +++ b/BurnOutSharp.Models/PortableExecutable/Executable.cs @@ -46,6 +46,11 @@ namespace BurnOutSharp.Models.PortableExecutable /// public COFFStringTable COFFStringTable { get; set; } - // TODO: Left off at "The Attribute Certificate Table (Image Only)" + /// + /// Attribute certificate table + /// + public AttributeCertificateTableEntry[] AttributeCertificateTable { get; set; } + + // TODO: Left off at "Delay-Load Import Tables (Image Only)" } }