Class: PEdump::WIN_CERTIFICATE

Inherits:
Object
  • Object
show all
Defined in:
lib/pedump/security.rb

Overview

msdn.microsoft.com/en-us/library/aa447037.aspx

Class Method Summary collapse

Class Method Details

.read(f) ⇒ Object 



37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
 
# File 'lib/pedump/security.rb', line 37

def self.read f
  super.tap do |x|
    if x.dwLength.to_i < 8
      PEdump.logger.error "[!] #{x.class}: too small length #{x.dwLength}"
    elsif x.dwLength.to_i > 0x100_000
      PEdump.logger.error "[!] #{x.class}: too big length #{x.dwLength}"
    else
      x.data = f.read(x.dwLength - 8)
      begin
        case x.wCertificateType
        when 2
          require 'openssl'
          x.data = OpenSSL::PKCS7.new(x.data)
        end
      rescue
        PEdump.logger.error "[!] #{$!}"
      end
    end
  end
end