trailofbits/pegoat

Signed PE with trailing data

Open

#10 opened on Aug 2, 2023

View on GitHub
 (0 comments) (0 reactions) (0 assignees)CMake (8 forks)auto 404
enhancementhelp wanted

Repository metrics

Stars
 (12 stars)
PR merge metrics
 (PR metrics pending)

Description

It'd be nice to have an example of a PE that has a correct Authenticode signature and also contains trailing data. Real-world examples of this exist but tend to be pretty large (e.g. the Firefox installer).

xref https://github.com/trailofbits/uthenticode/pull/84

Contributor guide

Research direction
To create a PE with correct Authenticode signature and trailing data, you need to understand the PE format's checksum and signature structure. Look at existing signed PEs and modify them to include data after the signature boundary while maintaining valid signature. Reference the linked PR for discussion.
Tech stack
None
Domain
security
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
PE file formatdigital signatures
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40