def get_auth_data(filename):
with open(filename, 'rb') as objf:
fingerprinter = fingerprint.Fingerprinter(objf)
fingerprinter.EvalGeneric()
results = fingerprinter.HashIt()
signed_pecoffs = [
x for x in results if x['name'] == 'pecoff' and 'SignedData' in x
]
if not signed_pecoffs:
print('This PE/COFF binary has no signature. Exiting.')
return
signed_pecoff = signed_pecoffs[0]
signed_datas = signed_pecoff['SignedData']
# There may be multiple of these, if the windows binary was signed multiple
# times, e.g. by different entities. Each of them adds a complete SignedData
# blob to the binary.
# TODO(user): Process all instances
signed_data = signed_datas[0]
blob = pecoff_blob.PecoffBlob(signed_data)
auth = auth_data.AuthData(blob.getCertificateBlob())
content_hasher_name = auth.digest_algorithm().name
computed_content_hash = signed_pecoff[content_hasher_name]
return auth, computed_content_hash
def testReasonableInterval(self):
# Check if the limit on maximum blocksize for processing still holds.
dummy = StringIO("")
fp = fingerprint.Fingerprinter(dummy)
big_finger = fingerprint.Finger(None, [fingerprint.Range(0, 1000001)],
None)
fp.fingers.append(big_finger)
start, stop = fp._GetNextInterval()
self.assertEqual(0, start)
self.assertEqual(1000000, stop)
def main():
os.chdir('data')
files = os.listdir('.')
for fnam in files:
if not fnam.lower().endswith('.res'):
print('Scanning %s' % fnam)
with open(fnam, 'rb') as objf:
fingerprinter = fingerprint.Fingerprinter(objf)
fingerprinter.EvalPecoff()
fingerprinter.EvalGeneric()
results = fingerprinter.HashIt()
with open(fnam + '.res', 'wb') as resf:
pickle.dump(results, resf, pickle.HIGHEST_PROTOCOL)
def testHashBlock(self):
# Does it invoke a hash function?
dummy = "12345"
fp = fingerprint.Fingerprinter(StringIO(dummy))
big_finger = fingerprint.Finger(None,
[fingerprint.Range(0, len(dummy))],
None)
hasher = self.MockHasher()
big_finger.hashers = [hasher]
fp.fingers.append(big_finger)
# Let's process the block
fp._HashBlock(dummy, 0, len(dummy))
self.assertEqual(hasher.seen, dummy)
def testRunTestData(self):
# Walk through all data files in the test_data folder, and compare output
# with precomputed expected output.
data_dir = os.path.join("data")
files = os.listdir(data_dir)
for fnam in files:
if not fnam.lower().endswith(".res"):
with open(os.path.join(data_dir, fnam), "rb") as objf:
fp = fingerprint.Fingerprinter(objf)
fp.EvalGeneric()
fp.EvalPecoff()
results = fp.HashIt()
with open(os.path.join(data_dir, fnam + ".res"),
"rb") as resf:
exp_results = pickle.load(resf)
diff = (exp_results != results)
if diff:
print
print(fingerprint.FormatResults(resf, exp_results))
print(fingerprint.FormatResults(objf, results))
self.fail()
def testAdjustments(self):
dummy = StringIO("")
fp = fingerprint.Fingerprinter(dummy)
big_finger = fingerprint.Finger(None, [fingerprint.Range(10, 20)],
None)
fp.fingers.append(big_finger)
# The remaining range should not yet be touched...
fp._AdjustIntervals(9, 10)
self.assertEqual([fingerprint.Range(10, 20)], fp.fingers[0].ranges)
# Trying to consume into the range. Blow up.
self.assertRaises(RuntimeError, fp._AdjustIntervals, 9, 11)
# We forgot a byte. Blow up.
self.assertRaises(RuntimeError, fp._AdjustIntervals, 11, 12)
# Consume a byte
fp._AdjustIntervals(10, 11)
self.assertEqual([fingerprint.Range(11, 20)], fp.fingers[0].ranges)
# Consumed too much. Blow up.
self.assertRaises(RuntimeError, fp._AdjustIntervals, 11, 21)
# Consume exactly.
fp._AdjustIntervals(11, 20)
self.assertEqual(0, len(fp.fingers[0].ranges))