jetbrains/format-ripper

Library for ELF / Mach-O / Fat-Mach-O / PE / Compound / MSI formats parsing and checking signatures

JetBrains format-ripper

JetBrains format-ripper library is applicable for:

• detect the type of software binaries
• determine the origin of software binaries via verification the cryptographic signatures
• determine the integrity of software binaries via computation and comparing the binaries hashes

Following types of software binaries files are supported:

• Portable executable (PE)
• MS Windows Installer (MSI)
• MachO
• Fat-MachO (Universal binaries)
• Executable and linking format (ELF)
• Apple disk image (DMG)

See further descriptions:

• .NET https://github.com/JetBrains/format-ripper/tree/master/net#readme

• Java https://github.com/JetBrains/format-ripper/tree/master/jvm#readme

format-ripper's Issues

machO chain signature verification not working

SignedMessageVerifier.VerifySignatureAsync fails for machO signed files, when verificationParams.BuildChain = true.

Verification fails with message "ERROR: Build chain for certificate was failed. Issuer= unable to find valid certification path to requested target" with result of InvalidChain instead of expected Valid

Relevant test MachoSignatureVerifierTests.VerifySignWithChainTest is added in #15.

.NET - Msi Signature Valid after patching Property->ProductName

Hello, I stumbled upon this behavior, I don't think it's expected. Can you please take a look? Thank you.

Repro steps:

• Copy data\msi\2dac4b.msi to data\msi\2dac4b_broken_productname.msi
• Open data\msi\2dac4b_broken_productname.msi in Orca
• Change Property->ProductName from Microsoft Visual Studio 2013 VsGraphics Helper Dependencies to XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
• Save data\msi\2dac4b_broken_productname.msi
• Confirm in Windows Explorer that Digital Certificate is now invalid
• Add following test case to net/JetBrains.SignatureVerifier/tests/MsiSignatureVerifierTests.cs

[TestCase(VerifySignatureStatus.InvalidSignature, "2dac4b_broken_productname.msi")]

• Run test and confirm it fails with following error:

Expected: InvalidSignature
But was:  Valid

Expected behavior:

• Test case succeeds ( == verification returns VerifySignatureStatus.InvalidSignature when checking 2dac4b_broken_productname.msi)

Screenshots: