WIP: Code signing data parsing

lib/macho.rb

@@ -6,6 +6,7 @@
 require_relative "macho/structure"
 require_relative "macho/view"
 require_relative "macho/headers"
+require_relative "macho/code_signing"
 require_relative "macho/load_commands"
 require_relative "macho/sections"
 require_relative "macho/macho_file"

lib/macho/code_signing.rb

@@ -0,0 +1,234 @@
+# frozen_string_literal: true
+
+module MachO
+ module CodeSigning
+ CS_STRUCTURES = {
+ Headers::CSMAGIC_REQUIREMENT => "Requirement",
+ Headers::CSMAGIC_REQUIREMENTS => "Requirements",
+ Headers::CSMAGIC_CODEDIRECTORY => "CodeDirectory",
+ Headers::CSMAGIC_EMBEDDED_SIGNATURE => "EmbeddedSignature",
+ Headers::CSMAGIC_EMBEDDED_SIGNATURE_OLD => "OldEmbeddedSignature",
+ Headers::CSMAGIC_DETACHED_SIGNATURE => "DetachedSignature",
+ Headers::CSMAGIC_ENTITLEMENT => "Entitlement",
+ Headers::CSMAGIC_ENTITLEMENTDER => "DEREntitlement",
+ Headers::CSMAGIC_BLOBWRAPPER => "BlobWrapper",
+ }.freeze
+
+ CS_HASHTYPES = {
+ 1 => :CS_HASHTYPE_SHA1,
+ 2 => :CS_HASHTYPE_SHA256,
+ 3 => :CS_HASHTYPE_SHA256_TRUNCATED,
+ 4 => :CS_HASHTYPE_SHA384,
+ }.freeze
+
+ class CSStructure < MachOStructure
+ attr_reader :view
+
+ def self.new_from_bin(view)
+ bin = view.raw_data.slice(view.offset, bytesize)
+ format = Utils.specialize_format(self::FORMAT, view.endianness)
+
+ new(view, *bin.unpack(format))
+ end
+
+ def initialize(view)
+ @view = view
+ end
+
+ def to_h
+ {
+ "view" => view.to_h,
+ }.merge super
+ end
+ end
+
+ class CSBlob < CSStructure
+ field :magic, :uint32, endian: :big
+ field :length, :uint32, endian: :big
+
+ def magic_sym
+ Headers::CS_MAGICS[magic]
+ end
+
+ def to_h
+ {
+ "blob" => {
+ "magic" => magic,
+ "magic_sym" => magic_sym,
+ "length" => length,
+ },
+ }.merge super
+ end
+ end
+
+ class SuperBlob < CSBlob
+ class BlobIndex < CSStructure
+ field :type, :uint32, endian: :big
+ field :offset, :uint32, endian: :big
+ end
+
+ field :count, :uint32, endian: :big
+
+ def self.new_from_bin(view)
+ bin = view.raw_data.slice(view.offset, bytesize)
+ format = Utils.specialize_format(self::FORMAT, view.endianness)
+
+ new(view, *bin.unpack(format))
+ end
+
+ def initialize(view, magic, length, count)
+ # TODO(ww): Check magic matches CSMAGIC_EMBEDDED_SIGNATURE (0xfade0cc0)
+ super(view, magic, length)
+ @count = count
+ end
+
+ def each_blob_index
+ count.times do |i|
+ index_offset = view.offset + self.class.bytesize + (BlobIndex.bytesize * i)
+ blob_view = MachOView.new view.raw_data, view.endianness, index_offset
+ yield BlobIndex.new_from_bin blob_view
+ end
+ end
+
+ def each_blob
+ each_blob_index do |blob_index|
+ blob_offset = view.offset + blob_index.offset
+ blob_magic = view.raw_data[blob_offset, blob_offset + 4].unpack1("L>1")
+
+ blob_klass_str = CS_STRUCTURES[blob_magic]
+ raise CSBlobUnknownError, blob_magic unless blob_klass_str
+
+ blob_klass = CodeSigning.const_get blob_klass_str
+ blob_view = MachOView.new view.raw_data, view.endianness, blob_offset
+ yield blob_klass.new_from_bin blob_view
+ end
+ end
+
+ def to_h
+ {
+ magic_sym.to_h => {
+ "count" => count,
+ },
+ }.merge super
+ end
+ end
+
+ # Represents a code signing Requirement blob.
+ class Requirement < CSBlob
+ end
+
+ # Represents a code signing Requirements vector.
+ class Requirements < CSBlob
+ end
+
+ # Represents a code signing CodeDirectory blob.
+ class CodeDirectory < CSBlob
+ attr_reader :version
+ attr_reader :flags
+ attr_reader :hash_offset
+ attr_reader :ident_offset
+ attr_reader :n_special_slots
+ attr_reader :n_code_slots
+ attr_reader :code_limit
+ attr_reader :hash_size
+ attr_reader :hash_type
+ attr_reader :spare1
+ attr_reader :page_size
+ attr_reader :spare2
+
+ FORMAT = "L>9C4L>1"
+
+ SIZEOF = 44
+
+ def initialize(view, magic, length, version, flags, hash_offset,
+ ident_offset, n_special_slots, n_code_slots, code_limit,
+ hash_size, hash_type, spare1, page_size, spare2)
+ super(view, magic, length)
+ @version = version
+ @flags = flags
+ @hash_offset = hash_offset
+ @ident_offset = ident_offset
+ @n_special_slots = n_special_slots
+ @n_code_slots = n_code_slots
+ @code_limit = code_limit
+ @hash_size = hash_size
+ @hash_type = hash_type
+ @spare1 = spare1
+ @page_size = page_size
+ @spare2 = spare2
+ end
+
+ def hash_type_sym
+ CS_HASHTYPES[hash_type]
+ end
+
+ # TODO(ww): Figure out a good way to handle the fields that have been
+ # added with different CodeDirectory versions:
+ # * 0x20100:
+ # uint32_t scatterOffset
+ # char end_withScatter[0]
+ # * 0x20200:
+ # uint32_t teamOffset
+ # char end_withTeam[0]
+ # * 0x20300:
+ # uint32_t spare3
+ # uint64_t codeLimit64
+ # char end_withCodeLimit64[0]
+ # * 0x20400:
+ # uint64_t execSegBase
+ # uint64_t execSegLimit
+ # uint64_t execSegFlags
+ # char end_withExecSec[0]
+
+ def to_h
+ {
+ magic_sym.to_s => {
+ "version" => version,
+ "flags" => flags,
+ "hash_offset" => hash_offset,
+ "ident_offset" => ident_offset,
+ "n_special_slots" => n_special_slots,
+ "n_code_slots" => n_code_slots,
+ "code_limit" => code_limit,
+ "hash_size" => hash_size,
+ "hash_type" => hash_type,
+ "spare1" => spare1,
+ "page_size" => page_size,
+ "spare2" => spare2,
+ },
+ }.merge super
+ end
+ end
+
+ # Represents a code signing EmbeddedSignature blob.
+ class EmbeddedSignature < CSBlob
+ end
+
+ # Maybe represents an "old" embedded signature blob.
+ # Not documented.
+ class OldEmbeddedSignature < CSBlob
+ end
+
+ # Represents a multi-arch collection of embedded signatures.
+ class DetachedSignature < CSBlob
+ end
+
+ # Represents a code signing Entitlement blob.
+ class Entitlement < CSBlob
+ # NOTE(ww): This appears to just have one member, data, whose length
+ # is defined by attr :length.
+ # From SecTask.c:
+ # const struct theBlob {
+ # uint32_t magic; /* kSecCodeMagicEntitlement */
+ # uint32_t length;
+ # const uint8_t data[];
+ # }
+ end
+
+ class DEREntitlement < CSBlob
+ end
+
+ class BlobWrapper < CSBlob
+ end
+ end
+end

lib/macho/exceptions.rb

@@ -230,6 +230,22 @@ def initialize(offset)
  end
  end
 
+ # TODO(ww): doc
+ class LinkeditTypeMismatchError < MachOError
+ # TODO(ww): doc
+ def initialize(meth, lc_sym)
+ super "Method #{meth} can't be used on __LINKEDIT data commands of type #{lc_sym}"
+ end
+ end
+
+ # TODO(ww): doc
+ class CSBlobUnknownError < MachOError
+ # TODO(ww): doc
+ def initialize(magic)
+ super "Unknown code signing blob magic: 0x#{magic.to_s 16}"
+ end
+ end
+
  # Raised when attempting to parse a compressed Mach-O without explicitly
  # requesting decompression.
  class CompressedMachOError < MachOError

lib/macho/headers.rb

@@ -501,6 +501,32 @@ module Headers
  :MH_DYLIB_IN_CACHE => 0x80000000,
  }.freeze
 
+ # the blob index (presumably) for the CodeDirectory blob
+ # @api private
+ CSSLOT_CODEDIRECTORY = 0
+
+ CSMAGIC_REQUIREMENT = 0xfade0c00
+ CSMAGIC_REQUIREMENTS = 0xfade0c01
+ CSMAGIC_CODEDIRECTORY = 0xfade0c02
+ CSMAGIC_EMBEDDED_SIGNATURE = 0xfade0cc0
+ CSMAGIC_EMBEDDED_SIGNATURE_OLD = 0xfade0b02
+ CSMAGIC_DETACHED_SIGNATURE = 0xfade0cc0
+ CSMAGIC_ENTITLEMENT = 0xfade7171
+ CSMAGIC_ENTITLEMENTDER = 0xfade7172
+ CSMAGIC_BLOBWRAPPER = 0xfade0b01
+
+ CS_MAGICS = {
+ CSMAGIC_REQUIREMENT => :CSMAGIC_REQUIREMENT,
+ CSMAGIC_REQUIREMENTS => :CSMAGIC_REQUIREMENTS,
+ CSMAGIC_CODEDIRECTORY => :CSMAGIC_CODEDIRECTORY,
+ CSMAGIC_EMBEDDED_SIGNATURE => :CSMAGIC_EMBEDDED_SIGNATURE,
+ CSMAGIC_EMBEDDED_SIGNATURE_OLD => :CSMAGIC_EMBEDDED_SIGNATURE_OLD,
+ CSMAGIC_DETACHED_SIGNATURE => :CSMAGIC_DETACHED_SIGNATURE,
+ CSMAGIC_ENTITLEMENT => :CSMAGIC_ENTITLEMENT,
+ CSMAGIC_ENTITLEMENTDER => :CSMAGIC_ENTITLEMENTDER,
+ CSMAGIC_BLOBWRAPPER => :CSMAGIC_BLOBWRAPPER,
+ }.freeze
+
  # Fat binary header structure
  # @see MachO::FatArch
  class FatHeader < MachOStructure

lib/macho/load_commands.rb

@@ -973,6 +973,14 @@ def to_h
  "datasize" => datasize,
  }.merge super
  end
+
+ # TODO(ww): doc
+ def superblob
+ raise LinkeditTypeMismatchError.new(__method__, type) unless type == :LC_CODE_SIGNATURE
+
+ superblob_view = MachOView.new view.raw_data, view.endianness, dataoff
+ CodeSigning::SuperBlob.new_from_bin superblob_view
+ end
  end
 
  # A load command representing the offset to and size of an encrypted