Skip to content
This repository was archived by the owner on Feb 1, 2024. It is now read-only.

Commit 67f5fe9

Browse files
sadrecksadreck
committed
Removed the signtool.exe dependency and are now signing executables natively
1 parent 933a7f5 commit 67f5fe9

15 files changed

+1078
-55
lines changed

‎CHANGELOG.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
# Codecepticon Changelog
22

3+
## v1.2.0
4+
5+
* `[Update]` Removed the `signtool.exe` dependency and are now natively signing executables. The code was taken & customised from https://github.com/Danielku15/SigningServer, under MIT License - original author is Danielku15.
6+
37
## v1.1.0
48

59
* `[New]` Module: Implement the `sign` module, to enable creating self-signed certificates and using any given certificate to sign an executable. This functionality is using `signtool.exe`.

‎Codecepticon/Codecepticon.csproj

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,19 @@
44
<OutputType>Exe</OutputType>
55
<TargetFramework>net472</TargetFramework>
66
<SatelliteResourceLanguages>none</SatelliteResourceLanguages>
7-
<PlatformTarget>x86</PlatformTarget>
7+
<PlatformTarget>x64</PlatformTarget>
88
<Platforms>AnyCPU;x86;x64</Platforms>
99
<LangVersion>9.0</LangVersion>
1010
<PackageId>Codecepticon</PackageId>
1111
<Title>Codecepticon</Title>
12-
<Version>1.1.0</Version>
12+
<Version>1.2.0</Version>
1313
<Authors>Pavel Tsakalidis</Authors>
1414
<Company>Accenture Security</Company>
1515
<Product>Codecepticon</Product>
1616
<Description>Offensive Security Code Obfuscator</Description>
1717
<PackageProjectUrl>https://github.com/Accenture/Codecepticon</PackageProjectUrl>
1818
<AssemblyVersion></AssemblyVersion>
19+
<AllowUnsafeBlocks>True</AllowUnsafeBlocks>
1920
</PropertyGroup>
2021

2122
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|AnyCPU'">

‎Codecepticon/Help/Sign.txt

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ Usage: Codecepticon.exe --module sign [OPTIONS]...
1616
--overwrite When used with '--action cert' this will indicate whether to rewrite the target file
1717
if it already exists.
1818
--password Password for the pfx file (either to save or load, depending on the --action)
19-
--signtool Only used with '--action sign' to indicate the location of signtool.exe on the system.
20-
If this argument is not passed, Codecepticon will try to find it automatically.
21-
--path [executable] Location of the executable file to be signed.
19+
--path [executable] Location of the executable file to be signed.
20+
--algorithm When used with '--action sign', this argument will specify the signature algorithm.
21+
This can be one of: MD5, SHA1, SHA256, SHA384, SHA512.
22+
--timestamp When used with '--action sign', this is where the Timestamp Server is specified.
23+
For example 'http://timestamp.sectigo.com' or 'http://timestamp.digicert.com'.

‎Codecepticon/Modules/CommandLineData.cs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,8 @@ public struct SignNewCertificate
155155
public struct SignSettings
156156
{
157157
public SignNewCertificate NewCertificate;
158-
public string SignTool;
158+
public string TimestampServer;
159+
public string SignatureAlgorithm;
159160
}
160161

161162
public struct RenameGeneratorStruct

‎Codecepticon/Modules/Sign/CommandLine/SignCommandLine.cs

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,8 @@ public SignCommandLine(string[] args) : base(args)
2121
{ "password", "" },
2222
{ "pfx-file", "" },
2323
{ "overwrite", "switch" },
24-
{ "signtool", "" }
24+
{ "algorithm", "" },
25+
{ "timestamp", "" }
2526
};
2627
MergeArguments();
2728
}
@@ -67,19 +68,22 @@ protected override bool Parse(Dictionary<string, string> arguments)
6768
}
6869
break;
6970
case "password":
70-
CommandLineData.Sign.NewCertificate.Password= argument.Value;
71+
CommandLineData.Sign.NewCertificate.Password = argument.Value;
7172
break;
7273
case "pfx-file":
73-
CommandLineData.Sign.NewCertificate.PfxFile= argument.Value;
74+
CommandLineData.Sign.NewCertificate.PfxFile = argument.Value;
7475
break;
7576
case "overwrite":
7677
if (argument.Value.ToLower() != "false")
7778
{
7879
CommandLineData.Sign.NewCertificate.Overwrite = (argument.Value.Length > 0);
7980
}
8081
break;
81-
case "signtool":
82-
CommandLineData.Sign.SignTool = argument.Value;
82+
case "algorithm":
83+
CommandLineData.Sign.SignatureAlgorithm = argument.Value.ToUpper();
84+
break;
85+
case "timestamp":
86+
CommandLineData.Sign.TimestampServer = argument.Value;
8387
break;
8488
}
8589
}

‎Codecepticon/Modules/Sign/CommandLine/ValidateCommandLine.cs

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -133,23 +133,29 @@ protected bool ValidateParameters()
133133
return false;
134134
}
135135

136-
if (String.IsNullOrEmpty(CommandLineData.Sign.SignTool))
136+
// Validate the PFX Password.
137+
if (!certificateManager.CheckPfxPassword(CommandLineData.Sign.NewCertificate.PfxFile, CommandLineData.Sign.NewCertificate.Password))
137138
{
138-
Logger.Info("SignTool path is empty - will try to find signtool.exe");
139+
Logger.Error("Invalid PFX file password");
140+
return false;
139141
}
140-
else if (!File.Exists(CommandLineData.Sign.SignTool))
142+
143+
if (String.IsNullOrEmpty(CommandLineData.Sign.SignatureAlgorithm))
141144
{
142-
Logger.Error("Path for signtool.exe does not exist: " + CommandLineData.Sign.SignTool);
145+
Logger.Error("Signature Algorithm not set");
143146
return false;
144147
}
145-
146-
// Validate the PFX Password.
147-
if (!certificateManager.CheckPfxPassword(CommandLineData.Sign.NewCertificate.PfxFile, CommandLineData.Sign.NewCertificate.Password))
148+
else if (!IsValidSignatureAlgorithm(CommandLineData.Sign.SignatureAlgorithm))
148149
{
149-
Logger.Error("Invalid PFX file password");
150+
Logger.Error("Invalid signature algorithm selected");
150151
return false;
151152
}
152153

154+
if (String.IsNullOrEmpty(CommandLineData.Sign.TimestampServer))
155+
{
156+
CommandLineData.Sign.TimestampServer = ""; // Make sure it's not null.
157+
}
158+
153159
break;
154160
default:
155161
Logger.Error("Invalid action: " + CommandLineData.Global.Action.ToString());
@@ -158,6 +164,12 @@ protected bool ValidateParameters()
158164
return true;
159165
}
160166

167+
protected bool IsValidSignatureAlgorithm(string algorithm)
168+
{
169+
List<string> validAlgorithms = new() { "MD5", "SHA1", "SHA256", "SHA384", "SHA512" };
170+
return validAlgorithms.Contains(algorithm);
171+
}
172+
161173
protected string FixDN(string dn)
162174
{
163175
// BouncyCastle does not recognise S=XXX within an X509Name, and it has to be in the form of ST=XXX.

‎Codecepticon/Modules/Sign/MsSign/ISigningTool.cs

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
using System;
2+
using System.Collections.Generic;
3+
using System.Linq;
4+
using System.Text;
5+
using System.Threading.Tasks;
6+
7+
namespace Codecepticon.Modules.Sign.MsSign
8+
{
9+
public interface ISigningTool
10+
{
11+
/// <summary>
12+
/// Gets the name of the format the signing tool offers to sign.
13+
/// </summary>
14+
string FormatName { get; }
15+
16+
/// <summary>
17+
/// Gets the list of hash algorithms supported by this signing tool.
18+
/// </summary>
19+
IReadOnlyList<string> SupportedHashAlgorithms { get; }
20+
21+
/// <summary>
22+
/// Performs the signing of the given file through the request.
23+
/// Might throw any exceptions describing the error during signing.
24+
/// </summary>
25+
/// <param name="signFileRequest">The request describing what to sign.</param>
26+
/// <param name="cancellationToken">A token to support cancellation.</param>
27+
/// <returns>The result of the signing operation.</returns>
28+
SignFileResponse SignFile(SignFileRequest signFileRequest);
29+
30+
/// <summary>
31+
/// Checks whether the given file is signed.
32+
/// </summary>
33+
/// <param name="inputFileName">The path to the file on disk.</param>
34+
/// <param name="cancellationToken">A token to support cancellation.</param>
35+
/// <returns>true if the file is considered signed, otherwise false.</returns>
36+
/// <remarks>
37+
/// Some tools might only do a very basic check and not a full validation on whether
38+
/// all aspects of the signing are in place and valid.
39+
/// </remarks>
40+
bool IsFileSigned(string inputFileName);
41+
}
42+
}

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy