Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Make X509 serial number parsing code compatible with YARA #954

Closed
metthal opened this issue May 28, 2021 · 1 comment
Closed

Make X509 serial number parsing code compatible with YARA #954

metthal opened this issue May 28, 2021 · 1 comment
Labels
C-fileformat enhancement T-format-pe

Comments

@metthal
Copy link
Member

metthal commented May 28, 2021

Code in src/fileformat/file_format/pe/authenticode/x509_certificate.cpp and method getSerialNumber parses serial number by converting it to OpenSSL's BIGNUM. However there are discrepancies between BIGNUM representation (which usually strips leading zeroes) and the full octet representation taken out of DER encoded serial number.

We would like to make this serial compatible with other tools in the industry like YARA. The point of this ticket is to make this compatible with the way YARA parses the serial numbers.
xbabka01 added a commit to xbabka01/retdec that referenced this issue May 28, 2021
@xbabka01
Make X509 serial number parsing code compatible with YARA (avast#954)
7f509d2
xbabka01 added a commit to xbabka01/retdec that referenced this issue May 28, 2021
@xbabka01
Make X509 serial number parsing code compatible with YARA (avast#954)
58a91f9
xbabka01 added a commit to xbabka01/retdec that referenced this issue May 28, 2021
@xbabka01
Make X509 serial number parsing code compatible with YARA (avast#954)
251258d
xbabka01 added a commit to xbabka01/retdec that referenced this issue May 28, 2021
@xbabka01
Make X509 serial number parsing code compatible with YARA (avast#954)
bd6387b
@xbabka01 xbabka01 mentioned this issue May 28, 2021
Merged
metthal pushed a commit that referenced this issue Jun 3, 2021
@xbabka01
Make X509 serial number parsing code compatible with YARA (#954) (#955)
e59b138 
* Make X509 serial number parsing code compatible with YARA (#954)

* Return early
@HoundThe
Copy link
Member

As this was fixed with #955 can this issue be closed?

@metthal metthal closed this as completed Aug 10, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
C-fileformat enhancement T-format-pe
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@metthal @HoundThe