Lz signature zeroed check

include/retdec/pelib/PeFile.h

@@ -774,6 +774,11 @@ namespace PeLib
 		if (ldrError != LDR_ERROR_NONE)
 			return ldrError;
 
+		// Check errors in entry point
+		ldrError = securityDir().loaderError();
+		if (ldrError != LDR_ERROR_NONE)
+			return ldrError;
+
 		// Nothing wrond found
 		return LDR_ERROR_NONE;
 	}

include/retdec/pelib/PeLibAux.h

@@ -100,6 +100,10 @@ namespace PeLib
 		LDR_ERROR_ENTRY_POINT_OUT_OF_IMAGE,         // The entry point is out of the image
 		LDR_ERROR_ENTRY_POINT_ZEROED,               // The entry point is zeroed
 
+		// Errors from signature parser
+		LDR_ERROR_DIGITAL_SIGNATURE_CUT,            // The file signature is out of the file
+		LDR_ERROR_DIGITAL_SIGNATURE_ZEROED,         // The file signature is zeroed
+
 		LDR_ERROR_MAX
 
 	};

include/retdec/pelib/SecurityDirectory.h

@@ -14,12 +14,17 @@ namespace PeLib
 	class SecurityDirectory
 	{
 		private:
+		  LoaderError m_ldrError;
 		  std::vector<PELIB_IMAGE_CERTIFICATE_ENTRY> m_certs;
 		public:
+		  /// Constructor
+		  SecurityDirectory();
 		  /// Number of certificates in the directory.
 		  unsigned int calcNumberOfCertificates() const; // EXPORT
 		  /// Returns certificate at specified index.
 		  const std::vector<unsigned char>& getCertificate(std::size_t index) const; // EXPORT
+		  /// Return the loader error
+		  LoaderError loaderError() const;
 		  /// Read a file's certificate directory.
 		  int read(
 				  std::istream& inStream,

src/pelib/PeLibAux.cpp

@@ -77,7 +77,11 @@ namespace PeLib
 		// Entry point error detection
 		{"LDR_ERROR_ENTRY_POINT_OUT_OF_IMAGE",     "The position of the entry point is out of the image" },
 		{"LDR_ERROR_ENTRY_POINT_ZEROED",           "The entry point is zeroed; probably damaged file" },
-	};
+
+		// Signature error detection
+		{"LDR_ERROR_DIGITAL_SIGNATURE_CUT",        "The digital signature is cut or missing; probably damaged file" },
+		{"LDR_ERROR_DIGITAL_SIGNATURE_ZEROED",     "The digital signature is zeroed; probably damaged file" },
+    };
 
 	PELIB_IMAGE_FILE_MACHINE_ITERATOR::PELIB_IMAGE_FILE_MACHINE_ITERATOR()
 	{
@@ -191,7 +195,9 @@ namespace PeLib
 		return (ldrError == LDR_ERROR_FILE_IS_CUT_LOADABLE ||
 				ldrError == LDR_ERROR_RSRC_OVER_END_OF_IMAGE ||
 				ldrError == LDR_ERROR_ENTRY_POINT_OUT_OF_IMAGE ||
-				ldrError == LDR_ERROR_ENTRY_POINT_ZEROED);
+				ldrError == LDR_ERROR_ENTRY_POINT_ZEROED ||
+				ldrError == LDR_ERROR_DIGITAL_SIGNATURE_CUT ||
+				ldrError == LDR_ERROR_DIGITAL_SIGNATURE_ZEROED);
 	}
 
 	// Anti-assert feature. Debug version of isprint in MS Visual C++ asserts

src/pelib/SecurityDirectory.cpp

@@ -9,6 +9,9 @@
 
 namespace PeLib
 {
+	SecurityDirectory::SecurityDirectory() : m_ldrError(LDR_ERROR_NONE)
+	{}
+
 	unsigned int SecurityDirectory::calcNumberOfCertificates() const
 	{
 		return (unsigned int)m_certs.size();
@@ -19,13 +22,20 @@ namespace PeLib
 		return m_certs[index].Certificate;
 	}
 
+	LoaderError SecurityDirectory::loaderError() const
+	{
+		return m_ldrError;
+	}
+
 	int SecurityDirectory::read(
 			std::istream& inStream,
 			unsigned int uiOffset,
 			unsigned int uiSize)
 	{
 		IStreamWrapper inStream_w(inStream);
 
+		m_ldrError = LDR_ERROR_NONE;
+
 		if (!inStream_w)
 		{
 			return ERROR_OPENING_FILE;
@@ -34,6 +44,7 @@ namespace PeLib
 		std::uint64_t ulFileSize = fileSize(inStream_w);
 		if (ulFileSize < uiOffset + uiSize)
 		{
+			m_ldrError = LDR_ERROR_DIGITAL_SIGNATURE_CUT;
 			return ERROR_INVALID_FILE;
 		}
 
@@ -42,6 +53,13 @@ namespace PeLib
 		std::vector<unsigned char> vCertDirectory(uiSize);
 		inStream_w.read(reinterpret_cast<char*>(vCertDirectory.data()), uiSize);
 
+		// Verify zeroed certificates (00002edec5247488029b2cc69568dda90714eeed8de0d84f1488635196b7e708)
+		if (std::all_of(vCertDirectory.begin(), vCertDirectory.end(), [](unsigned char item) { return item == 0; }))
+		{
+			m_ldrError = LDR_ERROR_DIGITAL_SIGNATURE_ZEROED;
+			return ERROR_INVALID_FILE;
+		}
+
 		InputBuffer inpBuffer(vCertDirectory);
 
 		unsigned bytesRead = 0;