INNER CODE UNIT · C++
size_of_headers
trailofbits/uthenticode · src/uthenticode.cpp:525
size_of_headers = pe->peHeader.nt.OptionalHeader.SizeOfHeaders;
cert_table_offset += 128;
} else if (pe->peHeader.nt.OptionalMagic == peparse::NT_OPTIONAL_64_MAGIC) {
security_dir = pe->peHeader.nt.OptionalHeader64.DataDirectory[peparse::DIR_SECURITY];
size_of_headers = pe->peHeader.nt.OptionalHeader64.SizeOfHeaders;
cert_table_offset += 144;
} else {
/* Mystical future PE version?
*/
return {};
}
/* We explicitly don't support hashing files that don't contain a security
* directory; not because we *can't*, but because doing so isn't well defined
* in the Authenticode specification.
*/
if (security_dir.VirtualAddress == 0) {
return {};