Examples of mock signatures
The following example is the signatureThief project in the Chapter#9 folder of the GitHub project. In order to save space, this book only extracts the highlighted code, and the complete source code should be referred to the complete project for detailed reading.
At this point, the first exploit readers may think of, since signed programs must have an Authenticode signature message at the end of their files, is stealing someone else’s Authenticode signature message directly within our malware, which should bypass the authentication process. Let’s put that to the test.
Figure 9.13 shows the functional design for stealing static Authenticode signature information in the signatureThief project:
Figure 9.13 – The rippedCert function
At lines 26-37 of the code is the design of the rippedCert function. It reads the incoming PE file with fopen and fread, parses the Authenticode signature block pointed to by...
