wootski / verify-sigs Goto Github PK

1. download http://live.sysinternals.com/psfile.exe
2. run the AuthentiCode verification on it

I'd expect this to validate just fine.

However, the result is

  Asn1Error: Outer and countersign digest algorithms don't match.

Tip revision at the time of filing this.

Will read up in the specification to see whether this should be a reason for 
failure.

  oids.OID_TO_CLASS.get(oid) is <built-in function openssl_md5>
  self.digest_algorithm is <built-in function openssl_sha1>

What steps will reproduce the problem?
1. I'm receiving KeyErrors for sha256/sha512 within FindPehash

What is the expected output? What do you see instead?
=========================
When receiving a KeyError:
=========================
$ python verify-sigs-1.2/fingerprint.py file.tmp 
Scanning file.tmp
file.tmp:
  generic fingerprint type
    md5: <removed>
    sha1: <removed>
    sha256: <removed>
    sha512: <removed>
  pecoff fingerprint type
    SignedData: (rev=512, type=2, cert len=960 bytes)
    md5: <removed>
    sha1: <removed>

Traceback (most recent call last):
  File "verify-sigs-1.2/fingerprint.py", line 481, in <module>
    main(sys.argv[1:])
  File "verify-sigs-1.2/fingerprint.py", line 477, in main
    FindPehash(results)
  File "verify-sigs-1.2/fingerprint.py", line 461, in FindPehash
    if res['SignedData'][0][2].find(res[hashes]) != -1:
KeyError: 'sha256'

===============================================
When the keys 'sha256' and 'sha512' are removed
===============================================
$ python verify-sigs-1.2/fingerprint.py file.tmp 
Scanning file.tmp
file:
  generic fingerprint type
    md5: <removed>
    sha1: <removed>
    sha256: <removed>
    sha512: <removed>
  pecoff fingerprint type
    SignedData: (rev=512, type=2, cert len=960 bytes)
    md5: <removed>
    sha1: <removed>

PE File with signature data, NO hash matches.



What version of the product are you using? On what operating system?
v1.2

Please provide any additional information below.
I can provide the file being tested if needed.

What steps will reproduce the problem?
1. Run fingerprint.py on Ubuntu 12.x
2.
3.

What is the expected output? What do you see instead?
The expected output is the Authenticode output:

Program: Windows Internet Explorer 9, URL: http://www.microsoft.com/windows/ie 
Countersignature is present. Timestamp: Sat Jun  2 09:11:39 2012 UTC
Binary is signed with cert issued by:
("{'CN': 'Microsoft Code Signing PCA', 'C': 'US', 'L': 'Redmond', 'O': 
'Microsoft Corporation', 'ST': 'Washington'}",
 458545458566207933251686L)

However, on Ubuntu this is not available.



What version of the product are you using? On what operating system?

1.2 on Ubuntu 12

Please provide any additional information below.

The openssl implementation on Ubuntu 12 has disabled SSL V2 for security 
reasons. M2Crypto will build but will not run with this version of openssl. The 
version available via pip or apt-get seems to have disabled the SSL V2 call.

fingerprint.py silently fails to parse the Authenicode segment because of this.