integrity.c File Reference

#include <stdarg.h>
#include "windef.h"
#include "winbase.h"
#include "winerror.h"
#include "winternl.h"
#include "winnt.h"
#include "winver.h"
#include "imagehlp.h"
#include "wine/debug.h"

Include dependency graph for integrity.c:

Go to the source code of this file.

Macros
#define	HDR_FAIL   -1
#define	HDR_NT32   0
#define	HDR_NT64   1

Functions
	WINE_DEFAULT_DEBUG_CHANNEL (imagehlp)
static int	IMAGEHLP_GetNTHeaders (HANDLE handle, DWORD *pe_offset, IMAGE_NT_HEADERS32 *nt32, IMAGE_NT_HEADERS64 *nt64)
static BOOL	IMAGEHLP_GetSecurityDirOffset (HANDLE handle, DWORD *pdwOfs, DWORD *pdwSize)
static BOOL	IMAGEHLP_SetSecurityDirOffset (HANDLE handle, DWORD dwOfs, DWORD dwSize)
static BOOL	IMAGEHLP_GetCertificateOffset (HANDLE handle, DWORD num, DWORD *pdwOfs, DWORD *pdwSize)
static BOOL	IMAGEHLP_RecalculateChecksum (HANDLE handle)
BOOL WINAPI	ImageAddCertificate (HANDLE FileHandle, LPWIN_CERTIFICATE Certificate, PDWORD Index)
BOOL WINAPI	ImageEnumerateCertificates (HANDLE handle, WORD TypeFilter, PDWORD CertificateCount, PDWORD Indices, DWORD IndexCount)
BOOL WINAPI	ImageGetCertificateData (HANDLE handle, DWORD Index, LPWIN_CERTIFICATE Certificate, PDWORD RequiredLength)
BOOL WINAPI	ImageGetCertificateHeader (HANDLE handle, DWORD index, LPWIN_CERTIFICATE pCert)
static DWORD	IMAGEHLP_GetSectionOffset (IMAGE_SECTION_HEADER *hdr, DWORD num_sections, LPCSTR section, PDWORD size, PDWORD base)
static BOOL	IMAGEHLP_ReportSectionFromOffset (DWORD offset, DWORD size, BYTE *map, DWORD fileSize, DIGEST_FUNCTION DigestFunction, DIGEST_HANDLE DigestHandle)
static BOOL	IMAGEHLP_ReportSection (IMAGE_SECTION_HEADER *section_headers, DWORD num_sections, LPCSTR section, BYTE *map, DWORD fileSize, DIGEST_FUNCTION DigestFunction, DIGEST_HANDLE DigestHandle)
static BOOL	IMAGEHLP_ReportCodeSections (IMAGE_SECTION_HEADER *hdr, DWORD num_sections, BYTE *map, DWORD fileSize, DIGEST_FUNCTION DigestFunction, DIGEST_HANDLE DigestHandle)
static BOOL	IMAGEHLP_ReportImportSection (IMAGE_SECTION_HEADER *hdr, DWORD num_sections, BYTE *map, DWORD fileSize, DWORD DigestLevel, DIGEST_FUNCTION DigestFunction, DIGEST_HANDLE DigestHandle)
BOOL WINAPI	ImageGetDigestStream (HANDLE FileHandle, DWORD DigestLevel, DIGEST_FUNCTION DigestFunction, DIGEST_HANDLE DigestHandle)
BOOL WINAPI	ImageRemoveCertificate (HANDLE FileHandle, DWORD Index)

Macro Definition Documentation

HDR_FAIL

#define HDR_FAIL   -1

Definition at line 43 of file integrity.c.

HDR_NT32

#define HDR_NT32   0

Definition at line 44 of file integrity.c.

HDR_NT64

#define HDR_NT64   1

Definition at line 45 of file integrity.c.

Function Documentation

ImageAddCertificate()

BOOL WINAPI ImageAddCertificate	(	HANDLE	FileHandle,
		LPWIN_CERTIFICATE	Certificate,
		PDWORD	Index
	)

Definition at line 381 of file integrity.c.

{
    DWORD size = 0, count = 0, offset = 0, sd_VirtualAddr = 0, index = 0;
    WIN_CERTIFICATE hdr;
    const size_t cert_hdr_size = sizeof hdr - sizeof hdr.bCertificate;
    BOOL r;
 
    TRACE("(%p, %p, %p)\n", FileHandle, Certificate, Index);
 
    r = IMAGEHLP_GetSecurityDirOffset(FileHandle, &sd_VirtualAddr, &size);
 
    /* If we've already got a security directory, find the end of it */
    if ((r) && (sd_VirtualAddr != 0))
    {
        /* Check if the security directory is at the end of the file.
           If not, we should probably relocate it. */
        if (GetFileSize(FileHandle, NULL) != sd_VirtualAddr + size)
        {
            FIXME("Security directory already present but not located at EOF, not adding certificate\n");
 
            SetLastError(ERROR_NOT_SUPPORTED);
            return FALSE;
        }
 
        while (offset < size)
        {
            /* read the length of the current certificate */
            count = SetFilePointer (FileHandle, sd_VirtualAddr + offset,
                                     NULL, FILE_BEGIN);
 
            if (count == INVALID_SET_FILE_POINTER)
                return FALSE;
 
            r = ReadFile(FileHandle, &hdr, cert_hdr_size, &count, NULL);
 
            if (!r)
                return FALSE;
 
            if (count != cert_hdr_size)
                return FALSE;
 
            /* check the certificate is not too big or too small */
            if (hdr.dwLength < cert_hdr_size)
                return FALSE;
 
            if (hdr.dwLength > (size-offset))
                return FALSE;
 
            /* next certificate */
            offset += hdr.dwLength;
 
            /* padded out to the nearest 8-byte boundary */
            if (hdr.dwLength % 8)
                offset += 8 - (hdr.dwLength % 8);
 
            index++;
        }
 
        count = SetFilePointer (FileHandle, sd_VirtualAddr + offset, NULL, FILE_BEGIN);
 
        if (count == INVALID_SET_FILE_POINTER)
            return FALSE;
    }
    else
    {
        sd_VirtualAddr = SetFilePointer(FileHandle, 0, NULL, FILE_END);
 
        if (sd_VirtualAddr == INVALID_SET_FILE_POINTER)
            return FALSE;
    }
 
    /* Write the certificate to the file */
    r = WriteFile(FileHandle, Certificate, Certificate->dwLength, &count, NULL);
 
    if (!r)
        return FALSE;
 
    /* Pad out if necessary */
    if (Certificate->dwLength % 8)
    {
        char null[8];
 
        ZeroMemory(null, 8);
        WriteFile(FileHandle, null, 8 - (Certificate->dwLength % 8), &count, NULL);
 
        size += 8 - (Certificate->dwLength % 8);
    }
 
    size += Certificate->dwLength;
 
    /* Update the security directory offset and size */
    if (!IMAGEHLP_SetSecurityDirOffset(FileHandle, sd_VirtualAddr, size))
        return FALSE;
 
    if (!IMAGEHLP_RecalculateChecksum(FileHandle))
        return FALSE;
 
    if(Index)
        *Index = index;
    return TRUE;
}

Referenced by test_add_certificate(), and WINTRUST_PutSignedMsgToPEFile().

ImageEnumerateCertificates()

BOOL WINAPI ImageEnumerateCertificates	(	HANDLE	handle,
		WORD	TypeFilter,
		PDWORD	CertificateCount,
		PDWORD	Indices,
		DWORD	IndexCount
	)

Definition at line 487 of file integrity.c.

{
    DWORD size, count, offset, sd_VirtualAddr, index;
    WIN_CERTIFICATE hdr;
    const size_t cert_hdr_size = sizeof hdr - sizeof hdr.bCertificate;
    BOOL r;
 
    TRACE("%p %hd %p %p %ld\n",
           handle, TypeFilter, CertificateCount, Indices, IndexCount);
 
    r = IMAGEHLP_GetSecurityDirOffset( handle, &sd_VirtualAddr, &size );
    if( !r )
        return FALSE;
 
    offset = 0;
    index = 0;
    *CertificateCount = 0;
    while( offset < size )
    {
        /* read the length of the current certificate */
        count = SetFilePointer( handle, sd_VirtualAddr + offset,
                                 NULL, FILE_BEGIN );
        if( count == INVALID_SET_FILE_POINTER )
            return FALSE;
        r = ReadFile( handle, &hdr, cert_hdr_size, &count, NULL );
        if( !r )
            return FALSE;
        if( count != cert_hdr_size )
            return FALSE;
 
        TRACE("Size = %08lx  id = %08hx\n",
               hdr.dwLength, hdr.wCertificateType );
 
        /* check the certificate is not too big or too small */
        if( hdr.dwLength < cert_hdr_size )
            return FALSE;
        if( hdr.dwLength > (size-offset) )
            return FALSE;
       
        if( (TypeFilter == CERT_SECTION_TYPE_ANY) ||
            (TypeFilter == hdr.wCertificateType) )
        {
            (*CertificateCount)++;
            if(Indices && *CertificateCount <= IndexCount)
                *Indices++ = index;
        }
 
        /* next certificate */
        offset += hdr.dwLength;
 
        /* padded out to the nearest 8-byte boundary */
        if (hdr.dwLength % 8)
            offset += 8 - (hdr.dwLength % 8);
 
        index++;
    }
 
    return TRUE;
}

Referenced by ImageRemoveCertificate(), and test_remove_certificate().

ImageGetCertificateData()

BOOL WINAPI ImageGetCertificateData	(	HANDLE	handle,
		DWORD	Index,
		LPWIN_CERTIFICATE	Certificate,
		PDWORD	RequiredLength
	)

Definition at line 554 of file integrity.c.

{
    DWORD r, offset, ofs, size, count;
 
    TRACE("%p %ld %p %p\n", handle, Index, Certificate, RequiredLength);
 
    if( !RequiredLength)
    {
        SetLastError( ERROR_INVALID_PARAMETER );
        return FALSE;
    }
 
    if( !IMAGEHLP_GetCertificateOffset( handle, Index, &ofs, &size ) )
        return FALSE;
 
    if( *RequiredLength < size )
    {
        *RequiredLength = size;
        SetLastError( ERROR_INSUFFICIENT_BUFFER );
        return FALSE;
    }
 
    if( !Certificate )
    {
        SetLastError( ERROR_INVALID_PARAMETER );
        return FALSE;
    }
 
    *RequiredLength = size;
 
    offset = SetFilePointer( handle, ofs, NULL, FILE_BEGIN );
    if( offset == INVALID_SET_FILE_POINTER )
        return FALSE;
 
    r = ReadFile( handle, Certificate, size, &count, NULL );
    if( !r )
        return FALSE;
    if( count != size )
        return FALSE;
 
    TRACE("OK\n");
    SetLastError( NO_ERROR );
 
    return TRUE;
}

Referenced by test_get_certificate(), and WINTRUST_GetSignedMsgFromPEFile().

ImageGetCertificateHeader()

BOOL WINAPI ImageGetCertificateHeader	(	HANDLE	handle,
		DWORD	index,
		LPWIN_CERTIFICATE	pCert
	)

Definition at line 605 of file integrity.c.

{
    DWORD r, offset, ofs, size, count;
    const size_t cert_hdr_size = sizeof *pCert - sizeof pCert->bCertificate;
 
    TRACE("%p %ld %p\n", handle, index, pCert);
 
    if( !IMAGEHLP_GetCertificateOffset( handle, index, &ofs, &size ) )
        return FALSE;
 
    if( size < cert_hdr_size )
        return FALSE;
 
    offset = SetFilePointer( handle, ofs, NULL, FILE_BEGIN );
    if( offset == INVALID_SET_FILE_POINTER )
        return FALSE;
 
    r = ReadFile( handle, pCert, cert_hdr_size, &count, NULL );
    if( !r )
        return FALSE;
    if( count != cert_hdr_size )
        return FALSE;
 
    TRACE("OK\n");
 
    return TRUE;
}

Referenced by WINTRUST_GetSignedMsgFromPEFile().

ImageGetDigestStream()

BOOL WINAPI ImageGetDigestStream	(	HANDLE	FileHandle,
		DWORD	DigestLevel,
		DIGEST_FUNCTION	DigestFunction,
		DIGEST_HANDLE	DigestHandle
	)

Definition at line 782 of file integrity.c.

{
    DWORD error = 0;
    BOOL ret = FALSE;
    DWORD offset, size, num_sections, fileSize;
    HANDLE hMap = INVALID_HANDLE_VALUE;
    BYTE *map = NULL;
    IMAGE_DOS_HEADER *dos_hdr;
    IMAGE_NT_HEADERS *nt_hdr;
    IMAGE_SECTION_HEADER *section_headers;
 
    TRACE("(%p, %ld, %p, %p)\n", FileHandle, DigestLevel, DigestFunction,
        DigestHandle);
 
    /* Get the file size */
    if( !FileHandle )
        goto invalid_parameter;
    fileSize = GetFileSize( FileHandle, NULL );
    if(fileSize == INVALID_FILE_SIZE )
        goto invalid_parameter;
 
    /* map file */
    hMap = CreateFileMappingW( FileHandle, NULL, PAGE_READONLY, 0, 0, NULL );
    if( hMap == INVALID_HANDLE_VALUE )
        goto invalid_parameter;
    map = MapViewOfFile( hMap, FILE_MAP_COPY, 0, 0, 0 );
    if( !map )
        goto invalid_parameter;
 
    /* Read the file header */
    if( fileSize < sizeof(IMAGE_DOS_HEADER) )
        goto invalid_parameter;
    dos_hdr = (IMAGE_DOS_HEADER *)map;
 
    if( dos_hdr->e_magic != IMAGE_DOS_SIGNATURE )
        goto invalid_parameter;
    offset = dos_hdr->e_lfanew;
    if( !offset || offset > fileSize )
        goto invalid_parameter;
    ret = DigestFunction( DigestHandle, map, offset );
    if( !ret )
        goto end;
 
    /* Read the NT header */
    if( offset + sizeof(IMAGE_NT_HEADERS) > fileSize )
        goto invalid_parameter;
    nt_hdr = (IMAGE_NT_HEADERS *)(map + offset);
    if( nt_hdr->Signature != IMAGE_NT_SIGNATURE )
        goto invalid_parameter;
    /* It's clear why the checksum is cleared, but why only these size headers?
     */
    nt_hdr->OptionalHeader.SizeOfInitializedData = 0;
    nt_hdr->OptionalHeader.SizeOfImage = 0;
    nt_hdr->OptionalHeader.CheckSum = 0;
    size = sizeof(nt_hdr->Signature) + sizeof(nt_hdr->FileHeader) +
        nt_hdr->FileHeader.SizeOfOptionalHeader;
    ret = DigestFunction( DigestHandle, map + offset, size );
    if( !ret )
        goto end;
 
    /* Read the section headers */
    offset += size;
    num_sections = nt_hdr->FileHeader.NumberOfSections;
    size = num_sections * sizeof(IMAGE_SECTION_HEADER);
    if( offset + size > fileSize )
        goto invalid_parameter;
    ret = DigestFunction( DigestHandle, map + offset, size );
    if( !ret )
        goto end;
 
    section_headers = (IMAGE_SECTION_HEADER *)(map + offset);
    IMAGEHLP_ReportCodeSections( section_headers, num_sections,
        map, fileSize, DigestFunction, DigestHandle );
    IMAGEHLP_ReportSection( section_headers, num_sections, ".data",
        map, fileSize, DigestFunction, DigestHandle );
    IMAGEHLP_ReportSection( section_headers, num_sections, ".rdata",
        map, fileSize, DigestFunction, DigestHandle );
    IMAGEHLP_ReportImportSection( section_headers, num_sections,
        map, fileSize, DigestLevel, DigestFunction, DigestHandle );
    if( DigestLevel & CERT_PE_IMAGE_DIGEST_DEBUG_INFO )
        IMAGEHLP_ReportSection( section_headers, num_sections, ".debug",
            map, fileSize, DigestFunction, DigestHandle );
    if( DigestLevel & CERT_PE_IMAGE_DIGEST_RESOURCES )
        IMAGEHLP_ReportSection( section_headers, num_sections, ".rsrc",
            map, fileSize, DigestFunction, DigestHandle );
 
end:
    if( map )
        UnmapViewOfFile( map );
    if( hMap != INVALID_HANDLE_VALUE )
        CloseHandle( hMap );
    if( error )
        SetLastError(error);
    return ret;
 
invalid_parameter:
    error = ERROR_INVALID_PARAMETER;
    goto end;
}

Referenced by test_get_digest_stream().

IMAGEHLP_GetCertificateOffset()

static BOOL IMAGEHLP_GetCertificateOffset ( HANDLE  handle, DWORD  num, DWORD *  pdwOfs, DWORD *  pdwSize  )

static

Definition at line 239 of file integrity.c.

{
    DWORD size, count, offset, len, sd_VirtualAddr;
    BOOL r;
 
    r = IMAGEHLP_GetSecurityDirOffset( handle, &sd_VirtualAddr, &size );
    if( !r )
        return FALSE;
 
    offset = 0;
    /* take the n'th certificate */
    while( 1 )
    {
        /* read the length of the current certificate */
        count = SetFilePointer( handle, sd_VirtualAddr + offset,
                                 NULL, FILE_BEGIN );
        if( count == INVALID_SET_FILE_POINTER )
            return FALSE;
        r = ReadFile( handle, &len, sizeof len, &count, NULL );
        if( !r )
            return FALSE;
        if( count != sizeof len )
            return FALSE;
 
        /* check the certificate is not too big or too small */
        if( len < sizeof len )
            return FALSE;
        if( len > (size-offset) )
            return FALSE;
        if( !num-- )
            break;
 
        /* calculate the offset of the next certificate */
        offset += len;
 
        /* padded out to the nearest 8-byte boundary */
        if( len % 8 )
            offset += 8 - (len % 8);
 
        if( offset >= size )
            return FALSE;
    }
 
    *pdwOfs = sd_VirtualAddr + offset;
    *pdwSize = len;
 
    TRACE("len = %lx addr = %lx\n", len, sd_VirtualAddr + offset);
 
    return TRUE;
}

Referenced by ImageGetCertificateData(), ImageGetCertificateHeader(), and ImageRemoveCertificate().

IMAGEHLP_GetNTHeaders()

static int IMAGEHLP_GetNTHeaders ( HANDLE  handle, DWORD *  pe_offset, IMAGE_NT_HEADERS32 *  nt32, IMAGE_NT_HEADERS64 *  nt64  )

static

Definition at line 53 of file integrity.c.

{
    IMAGE_DOS_HEADER dos_hdr;
    DWORD count;
    BOOL r;
 
    TRACE("handle %p\n", handle);
 
    if ((!nt32) || (!nt64))
        return HDR_FAIL;
 
    /* read the DOS header */
    count = SetFilePointer(handle, 0, NULL, FILE_BEGIN);
 
    if (count == INVALID_SET_FILE_POINTER)
        return HDR_FAIL;
 
    count = 0;
 
    r = ReadFile(handle, &dos_hdr, sizeof dos_hdr, &count, NULL);
 
    if (!r)
        return HDR_FAIL;
 
    if (count != sizeof dos_hdr)
        return HDR_FAIL;
 
    /* verify magic number of 'MZ' */
    if (dos_hdr.e_magic != IMAGE_DOS_SIGNATURE)
        return HDR_FAIL;
 
    if (pe_offset != NULL)
        *pe_offset = dos_hdr.e_lfanew;
 
    /* read the PE header */
    count = SetFilePointer(handle, dos_hdr.e_lfanew, NULL, FILE_BEGIN);
 
    if (count == INVALID_SET_FILE_POINTER)
        return HDR_FAIL;
 
    count = 0;
 
    r = ReadFile(handle, nt32, sizeof(IMAGE_NT_HEADERS32), &count, NULL);
 
    if (!r)
        return HDR_FAIL;
 
    if (count != sizeof(IMAGE_NT_HEADERS32))
        return HDR_FAIL;
 
    /* verify NT signature */
    if (nt32->Signature != IMAGE_NT_SIGNATURE)
        return HDR_FAIL;
 
    /* check if we have a 32-bit or 64-bit executable */
    switch (nt32->OptionalHeader.Magic)
    {
        case IMAGE_NT_OPTIONAL_HDR32_MAGIC:
            return HDR_NT32;
 
        case IMAGE_NT_OPTIONAL_HDR64_MAGIC:
            /* Re-read as 64-bit */
 
            count = SetFilePointer(handle, dos_hdr.e_lfanew, NULL, FILE_BEGIN);
 
            if (count == INVALID_SET_FILE_POINTER)
                return HDR_FAIL;
 
            count = 0;
 
            r = ReadFile(handle, nt64, sizeof(IMAGE_NT_HEADERS64), &count, NULL);
 
            if (!r)
                return HDR_FAIL;
 
            if (count != sizeof(IMAGE_NT_HEADERS64))
                return HDR_FAIL;
 
            /* verify NT signature */
            if (nt64->Signature != IMAGE_NT_SIGNATURE)
                return HDR_FAIL;
 
            return HDR_NT64;
    }
 
    return HDR_FAIL;
}

Referenced by IMAGEHLP_GetSecurityDirOffset(), IMAGEHLP_RecalculateChecksum(), and IMAGEHLP_SetSecurityDirOffset().

IMAGEHLP_GetSectionOffset()

static DWORD IMAGEHLP_GetSectionOffset ( IMAGE_SECTION_HEADER *  hdr, DWORD  num_sections, LPCSTR  section, PDWORD  size, PDWORD  base  )

static

Definition at line 639 of file integrity.c.

{
    DWORD i, offset = 0;
 
    for( i = 0; !offset && i < num_sections; i++, hdr++ )
    {
        if( !memcmp( hdr->Name, section, strlen(section) ) )
        {
            offset = hdr->PointerToRawData;
            if( size )
                *size = hdr->SizeOfRawData;
            if( base )
                *base = hdr->VirtualAddress;
        }
    }
    return offset;
}

Referenced by IMAGEHLP_ReportImportSection(), and IMAGEHLP_ReportSection().

IMAGEHLP_GetSecurityDirOffset()

static BOOL IMAGEHLP_GetSecurityDirOffset ( HANDLE  handle, DWORD *  pdwOfs, DWORD *  pdwSize  )

static

Definition at line 147 of file integrity.c.

{
    IMAGE_NT_HEADERS32 nt_hdr32;
    IMAGE_NT_HEADERS64 nt_hdr64;
    IMAGE_DATA_DIRECTORY *sd;
    int ret;
 
    ret = IMAGEHLP_GetNTHeaders(handle, NULL, &nt_hdr32, &nt_hdr64);
 
    if (ret == HDR_NT32)
        sd = &nt_hdr32.OptionalHeader.DataDirectory[IMAGE_FILE_SECURITY_DIRECTORY];
    else if (ret == HDR_NT64)
        sd = &nt_hdr64.OptionalHeader.DataDirectory[IMAGE_FILE_SECURITY_DIRECTORY];
    else
        return FALSE;
 
    TRACE("ret = %d size = %lx addr = %lx\n", ret, sd->Size, sd->VirtualAddress);
 
    *pdwSize = sd->Size;
    *pdwOfs = sd->VirtualAddress;
 
    return TRUE;
}

Referenced by ImageAddCertificate(), ImageEnumerateCertificates(), IMAGEHLP_GetCertificateOffset(), and ImageRemoveCertificate().

IMAGEHLP_RecalculateChecksum()

static BOOL IMAGEHLP_RecalculateChecksum ( HANDLE  handle )

static

Definition at line 296 of file integrity.c.

{
    DWORD FileLength, count, HeaderSum, pe_offset, nt_hdr_size;
    IMAGE_NT_HEADERS32 nt_hdr32;
    IMAGE_NT_HEADERS64 nt_hdr64;
    LPVOID BaseAddress;
    HANDLE hMapping;
    DWORD *CheckSum;
    void *nt_hdr;
    int ret;
    BOOL r;
 
    TRACE("handle %p\n", handle);
 
    ret = IMAGEHLP_GetNTHeaders(handle, &pe_offset, &nt_hdr32, &nt_hdr64);
 
    if (ret == HDR_NT32)
    {
        CheckSum = &nt_hdr32.OptionalHeader.CheckSum;
 
        nt_hdr = &nt_hdr32;
        nt_hdr_size = sizeof(IMAGE_NT_HEADERS32);
    }
    else if (ret == HDR_NT64)
    {
        CheckSum = &nt_hdr64.OptionalHeader.CheckSum;
 
        nt_hdr = &nt_hdr64;
        nt_hdr_size = sizeof(IMAGE_NT_HEADERS64);
    }
    else
        return FALSE;
 
    hMapping = CreateFileMappingW(handle, NULL, PAGE_READONLY, 0, 0, NULL);
 
    if (!hMapping)
        return FALSE;
 
    BaseAddress = MapViewOfFile(hMapping, FILE_MAP_READ, 0, 0, 0);
 
    if (!BaseAddress)
    {
        CloseHandle(hMapping);
        return FALSE;
    }
 
    FileLength = GetFileSize(handle, NULL);
 
    *CheckSum = 0;
    CheckSumMappedFile(BaseAddress, FileLength, &HeaderSum, CheckSum);
 
    UnmapViewOfFile(BaseAddress);
    CloseHandle(hMapping);
 
    if (*CheckSum)
    {
        /* write the header back again */
        count = SetFilePointer(handle, pe_offset, NULL, FILE_BEGIN);
 
        if (count == INVALID_SET_FILE_POINTER)
            return FALSE;
 
        count = 0;
 
        r = WriteFile(handle, nt_hdr, nt_hdr_size, &count, NULL);
 
        if (!r)
            return FALSE;
 
        if (count != nt_hdr_size)
            return FALSE;
 
        return TRUE;
    }
 
    return FALSE;
}

Referenced by ImageAddCertificate(), and ImageRemoveCertificate().

IMAGEHLP_ReportCodeSections()

static BOOL IMAGEHLP_ReportCodeSections ( IMAGE_SECTION_HEADER *  hdr, DWORD  num_sections, BYTE *  map, DWORD  fileSize, DIGEST_FUNCTION  DigestFunction, DIGEST_HANDLE  DigestHandle  )

static

Definition at line 693 of file integrity.c.

{
    DWORD i;
    BOOL ret = TRUE;
 
    for( i = 0; ret && i < num_sections; i++, hdr++ )
    {
        if( hdr->Characteristics & IMAGE_SCN_CNT_CODE )
            ret = IMAGEHLP_ReportSectionFromOffset( hdr->PointerToRawData,
                hdr->SizeOfRawData, map, fileSize, DigestFunction, DigestHandle );
    }
    return ret;
}

Referenced by ImageGetDigestStream().

IMAGEHLP_ReportImportSection()

static BOOL IMAGEHLP_ReportImportSection ( IMAGE_SECTION_HEADER *  hdr, DWORD  num_sections, BYTE *  map, DWORD  fileSize, DWORD  DigestLevel, DIGEST_FUNCTION  DigestFunction, DIGEST_HANDLE  DigestHandle  )

static

Definition at line 713 of file integrity.c.

{
    BOOL ret = FALSE;
    DWORD offset, size, base;
 
    /* Get import data */
    offset = IMAGEHLP_GetSectionOffset( hdr, num_sections, ".idata", &size,
        &base );
    if( !offset )
        return FALSE;
 
    /* If CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO is set, the entire
     * section is reported.  Otherwise, the debug info section is
     * decoded and reported piecemeal.  See tests.  However, I haven't been
     * able to figure out how the native implementation decides which values
     * to report.  Either it's buggy or my understanding is flawed.
     */
    if( DigestLevel & CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO )
        ret = IMAGEHLP_ReportSectionFromOffset( offset, size, map, fileSize,
                DigestFunction, DigestHandle );
    else
    {
        FIXME("not supported except for CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO\n");
        SetLastError(ERROR_INVALID_PARAMETER);
        ret = FALSE;
    }
 
    return ret;
}

Referenced by ImageGetDigestStream().

IMAGEHLP_ReportSection()

static BOOL IMAGEHLP_ReportSection ( IMAGE_SECTION_HEADER *  section_headers, DWORD  num_sections, LPCSTR  section, BYTE *  map, DWORD  fileSize, DIGEST_FUNCTION  DigestFunction, DIGEST_HANDLE  DigestHandle  )

static

Definition at line 676 of file integrity.c.

{
    DWORD offset, size = 0;
 
    offset = IMAGEHLP_GetSectionOffset( section_headers, num_sections, section,
        &size, NULL );
    if( !offset )
        return FALSE;
    return IMAGEHLP_ReportSectionFromOffset( offset, size, map, fileSize,
            DigestFunction, DigestHandle );
}

Referenced by ImageGetDigestStream().

IMAGEHLP_ReportSectionFromOffset()

static BOOL IMAGEHLP_ReportSectionFromOffset ( DWORD  offset, DWORD  size, BYTE *  map, DWORD  fileSize, DIGEST_FUNCTION  DigestFunction, DIGEST_HANDLE  DigestHandle  )

static

Definition at line 661 of file integrity.c.

{
    if( offset + size > fileSize )
    {
        SetLastError(ERROR_INVALID_PARAMETER);
        return FALSE;
    }
    return DigestFunction( DigestHandle, map + offset, size );
}

Referenced by IMAGEHLP_ReportCodeSections(), IMAGEHLP_ReportImportSection(), and IMAGEHLP_ReportSection().

IMAGEHLP_SetSecurityDirOffset()

static BOOL IMAGEHLP_SetSecurityDirOffset ( HANDLE  handle, DWORD  dwOfs, DWORD  dwSize  )

static

Definition at line 178 of file integrity.c.

{
    IMAGE_NT_HEADERS32 nt_hdr32;
    IMAGE_NT_HEADERS64 nt_hdr64;
    IMAGE_DATA_DIRECTORY *sd;
    int ret, nt_hdr_size = 0;
    DWORD pe_offset;
    void *nt_hdr;
    DWORD count;
    BOOL r;
 
    ret = IMAGEHLP_GetNTHeaders(handle, &pe_offset, &nt_hdr32, &nt_hdr64);
 
    if (ret == HDR_NT32)
    {
        sd = &nt_hdr32.OptionalHeader.DataDirectory[IMAGE_FILE_SECURITY_DIRECTORY];
 
        nt_hdr = &nt_hdr32;
        nt_hdr_size = sizeof(IMAGE_NT_HEADERS32);
    }
    else if (ret == HDR_NT64)
    {
        sd = &nt_hdr64.OptionalHeader.DataDirectory[IMAGE_FILE_SECURITY_DIRECTORY];
 
        nt_hdr = &nt_hdr64;
        nt_hdr_size = sizeof(IMAGE_NT_HEADERS64);
    }
    else
        return FALSE;
 
    sd->Size = dwSize;
    sd->VirtualAddress = dwOfs;
 
    TRACE("size = %lx addr = %lx\n", sd->Size, sd->VirtualAddress);
 
    /* write the header back again */
    count = SetFilePointer(handle, pe_offset, NULL, FILE_BEGIN);
 
    if (count == INVALID_SET_FILE_POINTER)
        return FALSE;
 
    count = 0;
 
    r = WriteFile(handle, nt_hdr, nt_hdr_size, &count, NULL);
 
    if (!r)
        return FALSE;
 
    if (count != nt_hdr_size)
        return FALSE;
 
    return TRUE;
}

Referenced by ImageAddCertificate(), and ImageRemoveCertificate().

ImageRemoveCertificate()

BOOL WINAPI ImageRemoveCertificate	(	HANDLE	FileHandle,
		DWORD	Index
	)

Definition at line 887 of file integrity.c.

{
    DWORD size = 0, count = 0, sd_VirtualAddr = 0, offset = 0;
    DWORD data_size = 0, cert_size = 0, cert_size_padded = 0, ret = 0;
    LPVOID cert_data;
    BOOL r;
 
    TRACE("(%p, %ld)\n", FileHandle, Index);
 
    r = ImageEnumerateCertificates(FileHandle, CERT_SECTION_TYPE_ANY, &count, NULL, 0);
 
    if ((!r) || (count == 0))
        return FALSE;
 
    if ((!IMAGEHLP_GetSecurityDirOffset(FileHandle, &sd_VirtualAddr, &size)) ||
        (!IMAGEHLP_GetCertificateOffset(FileHandle, Index, &offset, &cert_size)))
        return FALSE;
 
    /* Ignore any padding we have, too */
    if (cert_size % 8)
        cert_size_padded = cert_size + (8 - (cert_size % 8));
    else
        cert_size_padded = cert_size;
 
    data_size = size - (offset - sd_VirtualAddr) - cert_size_padded;
 
    if (data_size == 0)
    {
        ret = SetFilePointer(FileHandle, sd_VirtualAddr, NULL, FILE_BEGIN);
 
        if (ret == INVALID_SET_FILE_POINTER)
            return FALSE;
    }
    else
    {
        cert_data = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, data_size);
 
        if (!cert_data)
            return FALSE;
 
        ret = SetFilePointer(FileHandle, offset + cert_size_padded, NULL, FILE_BEGIN);
 
        if (ret == INVALID_SET_FILE_POINTER)
            goto error;
 
        /* Read any subsequent certificates */
        r = ReadFile(FileHandle, cert_data, data_size, &count, NULL);
 
        if ((!r) || (count != data_size))
            goto error;
 
        SetFilePointer(FileHandle, offset, NULL, FILE_BEGIN);
 
        /* Write them one index back */
        r = WriteFile(FileHandle, cert_data, data_size, &count, NULL);
 
        if ((!r) || (count != data_size))
            goto error;
 
        HeapFree(GetProcessHeap(), 0, cert_data);
    }
 
    /* If security directory is at end of file, trim the file */
    if (GetFileSize(FileHandle, NULL) == sd_VirtualAddr + size)
        SetEndOfFile(FileHandle);
 
    if (count == 1)
        r = IMAGEHLP_SetSecurityDirOffset(FileHandle, 0, 0);
    else
        r = IMAGEHLP_SetSecurityDirOffset(FileHandle, sd_VirtualAddr, size - cert_size_padded);
 
    if (!r)
        return FALSE;
 
    if (!IMAGEHLP_RecalculateChecksum(FileHandle))
        return FALSE;
 
    return TRUE;
 
error:
    HeapFree(GetProcessHeap(), 0, cert_data);
    return FALSE;
}

Referenced by test_remove_certificate().

WINE_DEFAULT_DEBUG_CHANNEL()

WINE_DEFAULT_DEBUG_CHANNEL

(

imagehlp

)