INNER CODE UNIT · C++
pe_checksum_offset
trailofbits/uthenticode · src/uthenticode.cpp:515
auto pe_checksum_offset = pe->peHeader.dos.e_lfanew + 24 + 64;
/* The certificate table directory entry offset is also in the optional header,
* albeit at different offsets for PE32 and PE32+. See each of the cases below.
*/
std::size_t cert_table_offset = pe->peHeader.dos.e_lfanew + 24;
std::uint32_t size_of_headers = 0;
peparse::data_directory security_dir;
if (pe->peHeader.nt.OptionalMagic == peparse::NT_OPTIONAL_32_MAGIC) {
security_dir = pe->peHeader.nt.OptionalHeader.DataDirectory[peparse::DIR_SECURITY];
size_of_headers = pe->peHeader.nt.OptionalHeader.SizeOfHeaders;
cert_table_offset += 128;
} else if (pe->peHeader.nt.OptionalMagic == peparse::NT_OPTIONAL_64_MAGIC) {
security_dir = pe->peHeader.nt.OptionalHeader64.DataDirectory[peparse::DIR_SECURITY];
size_of_headers = pe->peHeader.nt.OptionalHeader64.SizeOfHeaders;
cert_table_offset += 144;
} else {
/* Mystical future PE version?