Uranium-and-Waffles/Dec2017-Script-Dump
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

scripts

Browse Source
This commit is contained in:
niko
2026-06-04 11:42:34 +02:00
parent f39ba70a9f
commit e720b98cd1
7488 changed files with 2493818 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mscorlib/Mono/Security/Authenticode/AuthenticodeBase.cs
+278
View File
@@ -0,0 +1,278 @@
using System;
using System.IO;
using System.Security.Cryptography;
namespace Mono.Security.Authenticode
{
// Token: 0x0200009F RID: 159
internal class AuthenticodeBase
{
// Token: 0x060008B2 RID: 2226 RVA: 0x00020E80 File Offset: 0x0001F080
public AuthenticodeBase()
{
this.fileblock = new byte[4096];
}
// Token: 0x170000E7 RID: 231
// (get) Token: 0x060008B3 RID: 2227 RVA: 0x00020E98 File Offset: 0x0001F098
internal int PEOffset
{
get
{
if (this.blockNo < 1)
{
this.ReadFirstBlock();
}
return this.peOffset;
}
}
// Token: 0x170000E8 RID: 232
// (get) Token: 0x060008B4 RID: 2228 RVA: 0x00020EB4 File Offset: 0x0001F0B4
internal int CoffSymbolTableOffset
{
get
{
if (this.blockNo < 1)
{
this.ReadFirstBlock();
}
return this.coffSymbolTableOffset;
}
}
// Token: 0x170000E9 RID: 233
// (get) Token: 0x060008B5 RID: 2229 RVA: 0x00020ED0 File Offset: 0x0001F0D0
internal int SecurityOffset
{
get
{
if (this.blockNo < 1)
{
this.ReadFirstBlock();
}
return this.dirSecurityOffset;
}
}
// Token: 0x060008B6 RID: 2230 RVA: 0x00020EEC File Offset: 0x0001F0EC
internal void Open(string filename)
{
if (this.fs != null)
{
this.Close();
}
this.fs = new FileStream(filename, FileMode.Open, FileAccess.Read, FileShare.Read);
}
// Token: 0x060008B7 RID: 2231 RVA: 0x00020F1C File Offset: 0x0001F11C
internal void Close()
{
if (this.fs != null)
{
this.fs.Close();
this.fs = null;
this.blockNo = 0;
}
}
// Token: 0x060008B8 RID: 2232 RVA: 0x00020F50 File Offset: 0x0001F150
internal bool ReadFirstBlock()
{
if (this.fs == null)
{
return false;
}
this.fs.Position = 0L;
this.blockLength = this.fs.Read(this.fileblock, 0, this.fileblock.Length);
this.blockNo = 1;
if (this.blockLength < 64)
{
return false;
}
if (BitConverterLE.ToUInt16(this.fileblock, 0) != 23117)
{
return false;
}
this.peOffset = BitConverterLE.ToInt32(this.fileblock, 60);
if (this.peOffset > this.fileblock.Length)
{
string text = string.Format(Locale.GetText("Header size too big (> {0} bytes)."), this.fileblock.Length);
throw new NotSupportedException(text);
}
if ((long)this.peOffset > this.fs.Length)
{
return false;
}
if (BitConverterLE.ToUInt32(this.fileblock, this.peOffset) != 17744U)
{
return false;
}
this.dirSecurityOffset = BitConverterLE.ToInt32(this.fileblock, this.peOffset + 152);
this.dirSecuritySize = BitConverterLE.ToInt32(this.fileblock, this.peOffset + 156);
this.coffSymbolTableOffset = BitConverterLE.ToInt32(this.fileblock, this.peOffset + 12);
return true;
}
// Token: 0x060008B9 RID: 2233 RVA: 0x0002109C File Offset: 0x0001F29C
internal byte[] GetSecurityEntry()
{
if (this.blockNo < 1)
{
this.ReadFirstBlock();
}
if (this.dirSecuritySize > 8)
{
byte[] array = new byte[this.dirSecuritySize - 8];
this.fs.Position = (long)(this.dirSecurityOffset + 8);
this.fs.Read(array, 0, array.Length);
return array;
}
return null;
}
// Token: 0x060008BA RID: 2234 RVA: 0x00021100 File Offset: 0x0001F300
internal byte[] GetHash(HashAlgorithm hash)
{
if (this.blockNo < 1)
{
this.ReadFirstBlock();
}
this.fs.Position = (long)this.blockLength;
int num = 0;
long num2;
if (this.dirSecurityOffset > 0)
{
if (this.dirSecurityOffset < this.blockLength)
{
this.blockLength = this.dirSecurityOffset;
num2 = 0L;
}
else
{
num2 = (long)(this.dirSecurityOffset - this.blockLength);
}
}
else if (this.coffSymbolTableOffset > 0)
{
this.fileblock[this.PEOffset + 12] = 0;
this.fileblock[this.PEOffset + 13] = 0;
this.fileblock[this.PEOffset + 14] = 0;
this.fileblock[this.PEOffset + 15] = 0;
this.fileblock[this.PEOffset + 16] = 0;
this.fileblock[this.PEOffset + 17] = 0;
this.fileblock[this.PEOffset + 18] = 0;
this.fileblock[this.PEOffset + 19] = 0;
if (this.coffSymbolTableOffset < this.blockLength)
{
this.blockLength = this.coffSymbolTableOffset;
num2 = 0L;
}
else
{
num2 = (long)(this.coffSymbolTableOffset - this.blockLength);
}
}
else
{
num = (int)(this.fs.Length & 7L);
if (num > 0)
{
num = 8 - num;
}
num2 = this.fs.Length - (long)this.blockLength;
}
int num3 = this.peOffset + 88;
hash.TransformBlock(this.fileblock, 0, num3, this.fileblock, 0);
num3 += 4;
hash.TransformBlock(this.fileblock, num3, 60, this.fileblock, num3);
num3 += 68;
if (num2 == 0L)
{
hash.TransformFinalBlock(this.fileblock, num3, this.blockLength - num3);
}
else
{
hash.TransformBlock(this.fileblock, num3, this.blockLength - num3, this.fileblock, num3);
long num4 = num2 >> 12;
int num5 = (int)(num2 - (num4 << 12));
if (num5 == 0)
{
num4 -= 1L;
num5 = 4096;
}
for (;;)
{
long num6 = num4;
num4 = num6 - 1L;
if (num6 <= 0L)
{
break;
}
this.fs.Read(this.fileblock, 0, this.fileblock.Length);
hash.TransformBlock(this.fileblock, 0, this.fileblock.Length, this.fileblock, 0);
}
if (this.fs.Read(this.fileblock, 0, num5) != num5)
{
return null;
}
if (num > 0)
{
hash.TransformBlock(this.fileblock, 0, num5, this.fileblock, 0);
hash.TransformFinalBlock(new byte[num], 0, num);
}
else
{
hash.TransformFinalBlock(this.fileblock, 0, num5);
}
}
return hash.Hash;
}
// Token: 0x060008BB RID: 2235 RVA: 0x000213C4 File Offset: 0x0001F5C4
protected byte[] HashFile(string fileName, string hashName)
{
byte[] array;
try
{
this.Open(fileName);
HashAlgorithm hashAlgorithm = HashAlgorithm.Create(hashName);
byte[] hash = this.GetHash(hashAlgorithm);
this.Close();
array = hash;
}
catch
{
array = null;
}
return array;
}
// Token: 0x040001C2 RID: 450
public const string spcIndirectDataContext = "1.3.6.1.4.1.311.2.1.4";
// Token: 0x040001C3 RID: 451
private byte[] fileblock;
// Token: 0x040001C4 RID: 452
private FileStream fs;
// Token: 0x040001C5 RID: 453
private int blockNo;
// Token: 0x040001C6 RID: 454
private int blockLength;
// Token: 0x040001C7 RID: 455
private int peOffset;
// Token: 0x040001C8 RID: 456
private int dirSecurityOffset;
// Token: 0x040001C9 RID: 457
private int dirSecuritySize;
// Token: 0x040001CA RID: 458
private int coffSymbolTableOffset;
}
}
mscorlib/Mono/Security/Authenticode/AuthenticodeDeformatter.cs
+486
View File
@@ -0,0 +1,486 @@
using System;
using System.Collections.Generic;
using System.Security;
using System.Security.Cryptography;
using Mono.Security.Cryptography;
using Mono.Security.X509;
namespace Mono.Security.Authenticode
{
// Token: 0x020000A0 RID: 160
internal class AuthenticodeDeformatter : AuthenticodeBase
{
// Token: 0x060008BC RID: 2236 RVA: 0x00021424 File Offset: 0x0001F624
public AuthenticodeDeformatter()
{
this.reason = -1;
this.signerChain = new X509Chain();
this.timestampChain = new X509Chain();
}
// Token: 0x060008BD RID: 2237 RVA: 0x0002144C File Offset: 0x0001F64C
public AuthenticodeDeformatter(string fileName)
: this()
{
this.FileName = fileName;
}
// Token: 0x170000EA RID: 234
// (get) Token: 0x060008BE RID: 2238 RVA: 0x0002145C File Offset: 0x0001F65C
// (set) Token: 0x060008BF RID: 2239 RVA: 0x00021464 File Offset: 0x0001F664
public string FileName
{
get
{
return this.filename;
}
set
{
this.Reset();
try
{
this.CheckSignature(value);
}
catch (SecurityException)
{
throw;
}
catch (Exception)
{
this.reason = 1;
}
}
}
// Token: 0x170000EB RID: 235
// (get) Token: 0x060008C0 RID: 2240 RVA: 0x000214D0 File Offset: 0x0001F6D0
public byte[] Hash
{
get
{
if (this.signedHash == null)
{
return null;
}
return (byte[])this.signedHash.Value.Clone();
}
}
// Token: 0x170000EC RID: 236
// (get) Token: 0x060008C1 RID: 2241 RVA: 0x00021500 File Offset: 0x0001F700
public int Reason
{
get
{
if (this.reason == -1)
{
this.IsTrusted();
}
return this.reason;
}
}
// Token: 0x060008C2 RID: 2242 RVA: 0x0002151C File Offset: 0x0001F71C
public bool IsTrusted()
{
if (this.entry == null)
{
this.reason = 1;
return false;
}
if (this.signingCertificate == null)
{
this.reason = 7;
return false;
}
if (this.signerChain.Root == null || !this.trustedRoot)
{
this.reason = 6;
return false;
}
if (this.timestamp != DateTime.MinValue)
{
if (this.timestampChain.Root == null || !this.trustedTimestampRoot)
{
this.reason = 6;
return false;
}
if (!this.signingCertificate.WasCurrent(this.Timestamp))
{
this.reason = 4;
return false;
}
}
else if (!this.signingCertificate.IsCurrent)
{
this.reason = 8;
return false;
}
if (this.reason == -1)
{
this.reason = 0;
}
return true;
}
// Token: 0x170000ED RID: 237
// (get) Token: 0x060008C3 RID: 2243 RVA: 0x00021600 File Offset: 0x0001F800
public byte[] Signature
{
get
{
if (this.entry == null)
{
return null;
}
return (byte[])this.entry.Clone();
}
}
// Token: 0x170000EE RID: 238
// (get) Token: 0x060008C4 RID: 2244 RVA: 0x00021620 File Offset: 0x0001F820
public DateTime Timestamp
{
get
{
return this.timestamp;
}
}
// Token: 0x170000EF RID: 239
// (get) Token: 0x060008C5 RID: 2245 RVA: 0x00021628 File Offset: 0x0001F828
public X509CertificateCollection Certificates
{
get
{
return this.coll;
}
}
// Token: 0x170000F0 RID: 240
// (get) Token: 0x060008C6 RID: 2246 RVA: 0x00021630 File Offset: 0x0001F830
public X509Certificate SigningCertificate
{
get
{
return this.signingCertificate;
}
}
// Token: 0x060008C7 RID: 2247 RVA: 0x00021638 File Offset: 0x0001F838
private bool CheckSignature(string fileName)
{
this.filename = fileName;
base.Open(this.filename);
this.entry = base.GetSecurityEntry();
if (this.entry == null)
{
this.reason = 1;
base.Close();
return false;
}
PKCS7.ContentInfo contentInfo = new PKCS7.ContentInfo(this.entry);
if (contentInfo.ContentType != "1.2.840.113549.1.7.2")
{
base.Close();
return false;
}
PKCS7.SignedData signedData = new PKCS7.SignedData(contentInfo.Content);
if (signedData.ContentInfo.ContentType != "1.3.6.1.4.1.311.2.1.4")
{
base.Close();
return false;
}
this.coll = signedData.Certificates;
ASN1 content = signedData.ContentInfo.Content;
this.signedHash = content[0][1][1];
int length = this.signedHash.Length;
HashAlgorithm hashAlgorithm;
if (length != 16)
{
if (length != 20)
{
this.reason = 5;
base.Close();
return false;
}
hashAlgorithm = HashAlgorithm.Create("SHA1");
this.hash = base.GetHash(hashAlgorithm);
}
else
{
hashAlgorithm = HashAlgorithm.Create("MD5");
this.hash = base.GetHash(hashAlgorithm);
}
base.Close();
if (!this.signedHash.CompareValue(this.hash))
{
this.reason = 2;
}
byte[] value = content[0].Value;
hashAlgorithm.Initialize();
byte[] array = hashAlgorithm.ComputeHash(value);
bool flag = this.VerifySignature(signedData, array, hashAlgorithm);
return flag && this.reason == 0;
}
// Token: 0x060008C8 RID: 2248 RVA: 0x000217D8 File Offset: 0x0001F9D8
private bool CompareIssuerSerial(string issuer, byte[] serial, X509Certificate x509)
{
if (issuer != x509.IssuerName)
{
return false;
}
if (serial.Length != x509.SerialNumber.Length)
{
return false;
}
int num = serial.Length;
for (int i = 0; i < serial.Length; i++)
{
if (serial[i] != x509.SerialNumber[--num])
{
return false;
}
}
return true;
}
// Token: 0x060008C9 RID: 2249 RVA: 0x0002183C File Offset: 0x0001FA3C
private bool VerifySignature(PKCS7.SignedData sd, byte[] calculatedMessageDigest, HashAlgorithm ha)
{
string text = null;
ASN1 asn = null;
int i = 0;
while (i < sd.SignerInfo.AuthenticatedAttributes.Count)
{
ASN1 asn2 = (ASN1)sd.SignerInfo.AuthenticatedAttributes[i];
string text2 = ASN1Convert.ToOid(asn2[0]);
string text3 = text2;
switch (text3)
{
case "1.2.840.113549.1.9.3":
text = ASN1Convert.ToOid(asn2[1][0]);
break;
case "1.2.840.113549.1.9.4":
asn = asn2[1][0];
break;
}
IL_F1:
i++;
continue;
goto IL_F1;
}
if (text != "1.3.6.1.4.1.311.2.1.4")
{
return false;
}
if (asn == null)
{
return false;
}
if (!asn.CompareValue(calculatedMessageDigest))
{
return false;
}
string text4 = CryptoConfig.MapNameToOID(ha.ToString());
ASN1 asn3 = new ASN1(49);
foreach (object obj in sd.SignerInfo.AuthenticatedAttributes)
{
ASN1 asn4 = (ASN1)obj;
asn3.Add(asn4);
}
ha.Initialize();
byte[] array = ha.ComputeHash(asn3.GetBytes());
byte[] signature = sd.SignerInfo.Signature;
string issuerName = sd.SignerInfo.IssuerName;
byte[] serialNumber = sd.SignerInfo.SerialNumber;
foreach (X509Certificate x509Certificate in this.coll)
{
if (this.CompareIssuerSerial(issuerName, serialNumber, x509Certificate) && x509Certificate.PublicKey.Length > signature.Length >> 3)
{
this.signingCertificate = x509Certificate;
RSACryptoServiceProvider rsacryptoServiceProvider = (RSACryptoServiceProvider)x509Certificate.RSA;
if (rsacryptoServiceProvider.VerifyHash(array, text4, signature))
{
this.signerChain.LoadCertificates(this.coll);
this.trustedRoot = this.signerChain.Build(x509Certificate);
break;
}
}
}
if (sd.SignerInfo.UnauthenticatedAttributes.Count == 0)
{
this.trustedTimestampRoot = true;
}
else
{
int j = 0;
while (j < sd.SignerInfo.UnauthenticatedAttributes.Count)
{
ASN1 asn5 = (ASN1)sd.SignerInfo.UnauthenticatedAttributes[j];
string text5 = ASN1Convert.ToOid(asn5[0]);
string text3 = text5;
if (text3 != null)
{
if (AuthenticodeDeformatter.<>f__switch$map6 == null)
{
AuthenticodeDeformatter.<>f__switch$map6 = new Dictionary<string, int>(1) { { "1.2.840.113549.1.9.6", 0 } };
}
int num;
if (AuthenticodeDeformatter.<>f__switch$map6.TryGetValue(text3, out num))
{
if (num == 0)
{
PKCS7.SignerInfo signerInfo = new PKCS7.SignerInfo(asn5[1]);
this.trustedTimestampRoot = this.VerifyCounterSignature(signerInfo, signature);
}
}
}
IL_35D:
j++;
continue;
goto IL_35D;
}
}
return this.trustedRoot && this.trustedTimestampRoot;
}
// Token: 0x060008CA RID: 2250 RVA: 0x00021C0C File Offset: 0x0001FE0C
private bool VerifyCounterSignature(PKCS7.SignerInfo cs, byte[] signature)
{
if (cs.Version != 1)
{
return false;
}
string text = null;
ASN1 asn = null;
int i = 0;
while (i < cs.AuthenticatedAttributes.Count)
{
ASN1 asn2 = (ASN1)cs.AuthenticatedAttributes[i];
string text2 = ASN1Convert.ToOid(asn2[0]);
string text3 = text2;
switch (text3)
{
case "1.2.840.113549.1.9.3":
text = ASN1Convert.ToOid(asn2[1][0]);
break;
case "1.2.840.113549.1.9.4":
asn = asn2[1][0];
break;
case "1.2.840.113549.1.9.5":
this.timestamp = ASN1Convert.ToDateTime(asn2[1][0]);
break;
}
IL_FC:
i++;
continue;
goto IL_FC;
}
if (text != "1.2.840.113549.1.7.1")
{
return false;
}
if (asn == null)
{
return false;
}
string text4 = null;
int length = asn.Length;
if (length != 16)
{
if (length == 20)
{
text4 = "SHA1";
}
}
else
{
text4 = "MD5";
}
HashAlgorithm hashAlgorithm = HashAlgorithm.Create(text4);
if (!asn.CompareValue(hashAlgorithm.ComputeHash(signature)))
{
return false;
}
byte[] signature2 = cs.Signature;
ASN1 asn3 = new ASN1(49);
foreach (object obj in cs.AuthenticatedAttributes)
{
ASN1 asn4 = (ASN1)obj;
asn3.Add(asn4);
}
byte[] array = hashAlgorithm.ComputeHash(asn3.GetBytes());
string issuerName = cs.IssuerName;
byte[] serialNumber = cs.SerialNumber;
foreach (X509Certificate x509Certificate in this.coll)
{
if (this.CompareIssuerSerial(issuerName, serialNumber, x509Certificate) && x509Certificate.PublicKey.Length > signature2.Length)
{
RSACryptoServiceProvider rsacryptoServiceProvider = (RSACryptoServiceProvider)x509Certificate.RSA;
RSAManaged rsamanaged = new RSAManaged();
rsamanaged.ImportParameters(rsacryptoServiceProvider.ExportParameters(false));
if (PKCS1.Verify_v15(rsamanaged, hashAlgorithm, array, signature2, true))
{
this.timestampChain.LoadCertificates(this.coll);
return this.timestampChain.Build(x509Certificate);
}
}
}
return false;
}
// Token: 0x060008CB RID: 2251 RVA: 0x00021F18 File Offset: 0x00020118
private void Reset()
{
this.filename = null;
this.entry = null;
this.hash = null;
this.signedHash = null;
this.signingCertificate = null;
this.reason = -1;
this.trustedRoot = false;
this.trustedTimestampRoot = false;
this.signerChain.Reset();
this.timestampChain.Reset();
this.timestamp = DateTime.MinValue;
}
// Token: 0x040001CB RID: 459
private string filename;
// Token: 0x040001CC RID: 460
private byte[] hash;
// Token: 0x040001CD RID: 461
private X509CertificateCollection coll;
// Token: 0x040001CE RID: 462
private ASN1 signedHash;
// Token: 0x040001CF RID: 463
private DateTime timestamp;
// Token: 0x040001D0 RID: 464
private X509Certificate signingCertificate;
// Token: 0x040001D1 RID: 465
private int reason;
// Token: 0x040001D2 RID: 466
private bool trustedRoot;
// Token: 0x040001D3 RID: 467
private bool trustedTimestampRoot;
// Token: 0x040001D4 RID: 468
private byte[] entry;
// Token: 0x040001D5 RID: 469
private X509Chain signerChain;
// Token: 0x040001D6 RID: 470
private X509Chain timestampChain;
}
}
mscorlib/Mono/Security/Authenticode/Authority.cs
+15
View File
@@ -0,0 +1,15 @@
using System;
namespace Mono.Security.Authenticode
{
// Token: 0x0200009E RID: 158
internal enum Authority
{
// Token: 0x040001BF RID: 447
Individual,
// Token: 0x040001C0 RID: 448
Commercial,
// Token: 0x040001C1 RID: 449
Maximum
}
}