mirror of
https://github.com/bancika/diy-layout-creator
synced 2026-11-13 02:32:09 +10:00
Bane Stojkovic
40 lines
1.3 KiB
Python
40 lines
1.3 KiB
Python
#!/usr/bin/env python3
|
|
"""Exits 0 if the given PE file carries an Authenticode signature, 1 if it does not.
|
|
|
|
`osslsigncode verify` also fails on an untrusted chain, which is the normal result for the
|
|
SignPath test certificate, so it cannot answer this question on its own. This reads the PE
|
|
Certificate Table data directory instead, which says whether a signature is present without
|
|
making any claim about its validity.
|
|
"""
|
|
|
|
import struct
|
|
import sys
|
|
|
|
|
|
def has_signature(path):
|
|
with open(path, "rb") as f:
|
|
data = f.read()
|
|
|
|
pe = struct.unpack_from("<I", data, 0x3C)[0]
|
|
if data[pe:pe + 4] != b"PE\0\0":
|
|
raise ValueError("not a PE file: %s" % path)
|
|
|
|
optional_header = pe + 24
|
|
magic = struct.unpack_from("<H", data, optional_header)[0]
|
|
if magic == 0x10B:
|
|
directories = optional_header + 96
|
|
elif magic == 0x20B:
|
|
directories = optional_header + 112
|
|
else:
|
|
raise ValueError("unknown optional header magic 0x%x in %s" % (magic, path))
|
|
|
|
# data directory entry 4 is the Certificate Table
|
|
_, size = struct.unpack_from("<II", data, directories + 4 * 8)
|
|
return size > 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
signed = has_signature(sys.argv[1])
|
|
print("signed" if signed else "unsigned")
|
|
sys.exit(0 if signed else 1)
|