INNER CODE UNIT · C++

cert_table_offset

trailofbits/uthenticode · src/uthenticode.cpp:520

  std::size_t cert_table_offset = pe->peHeader.dos.e_lfanew + 24;
  std::uint32_t size_of_headers = 0;
  peparse::data_directory security_dir;
  if (pe->peHeader.nt.OptionalMagic == peparse::NT_OPTIONAL_32_MAGIC) {
    security_dir = pe->peHeader.nt.OptionalHeader.DataDirectory[peparse::DIR_SECURITY];
    size_of_headers = pe->peHeader.nt.OptionalHeader.SizeOfHeaders;
    cert_table_offset += 128;
  } else if (pe->peHeader.nt.OptionalMagic == peparse::NT_OPTIONAL_64_MAGIC) {
    security_dir = pe->peHeader.nt.OptionalHeader64.DataDirectory[peparse::DIR_SECURITY];
    size_of_headers = pe->peHeader.nt.OptionalHeader64.SizeOfHeaders;
    cert_table_offset += 144;
  } else {
    /* Mystical future PE version?
     */
    return {};
  }

  /* We explicitly don't support hashing files that don't contain a security

View source record →