Function authenticode_sha384_hash

dstack-mr/src/kernel.rs:11–116

Calculates the Authenticode hash of a PE/COFF file

(data: &[u8])

/// Calculates the Authenticode hash of a PE/COFF file
fn authenticode_sha384_hash(data: &[u8]) -> Result<Vec<u8>> {
    let lfanew_offset = 0x3c;
    let lfanew: u32 = read_le(data, lfanew_offset, "DOS header")?;

    let pe_sig_offset = lfanew as usize;
    let pe_sig: u32 = read_le(data, pe_sig_offset, "PE signature offset")?;
    if pe_sig != pe::IMAGE_NT_SIGNATURE {
        bail!("Invalid PE signature");
    }

    let coff_header_offset = pe_sig_offset + 4;
    let optional_header_size =
        read_le::<u16>(data, coff_header_offset + 16, "COFF header size")? as usize;

    let optional_header_offset = coff_header_offset + 20;
    let magic: u16 = read_le(data, optional_header_offset, "header magic")?;

    let is_pe32_plus = magic == 0x20b;

    let checksum_offset = optional_header_offset + 64;
    let checksum_end = checksum_offset + 4;

    let data_dir_offset = optional_header_offset + if is_pe32_plus { 112 } else { 96 };
    let cert_dir_offset = data_dir_offset + (pe::IMAGE_DIRECTORY_ENTRY_SECURITY * 8);
    let cert_dir_end = cert_dir_offset + 8;

    let size_of_headers_offset = optional_header_offset + 60;
    let size_of_headers = read_le::<u32>(data, size_of_headers_offset, "size_of_headers")? as usize;

    let mut hasher = Sha384::new();
    hasher.update(&data[0..checksum_offset]);
    hasher.update(&data[checksum_end..cert_dir_offset]);
    hasher.update(&data[cert_dir_end..size_of_headers]);

    let mut sum_of_bytes_hashed = size_of_headers;

    let num_sections_offset = coff_header_offset + 2;
    let num_sections = read_le::<u16>(data, num_sections_offset, "number of sections")? as usize;

    let section_table_offset = optional_header_offset + optional_header_size;
    let section_size = 40;

    let mut sections = Vec::with_capacity(num_sections);
    for i in 0..num_sections {
        let section_offset = section_table_offset + (i * section_size);

        let ptr_raw_data_offset = section_offset + 20;
        let ptr_raw_data =
            read_le::<u32>(data, ptr_raw_data_offset, "pointer_to_raw_data")? as usize;

        let size_raw_data_offset = section_offset + 16;
        let size_raw_data =
            read_le::<u32>(data, size_raw_data_offset, "size_of_raw_data")? as usize;

        if size_raw_data > 0 {
            sections.push((ptr_raw_data, size_raw_data));
        }
    }