Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: mach-o certificate parsing implemented with der_parser #276

Merged
merged 13 commits into from
Jan 13, 2025

Conversation

latonis
Copy link
Contributor

@latonis latonis commented Dec 28, 2024

As discussed in #235, implementing the certificate parsing with der_parser to reduce dependencies and potential headaches.

Depends on #275, as the ASN.1 parsing functions were specific to PE before this PR.

@latonis latonis marked this pull request as draft December 28, 2024 23:05
@latonis
Copy link
Contributor Author

latonis commented Dec 31, 2024

Open to discussing how much CMS data we return.

Currently we expose the following:

Certificate {
      issuer: c.x509.issuer.to_string(),
      subject: c.x509.subject.to_string(),
      is_self_signed: c.x509.issuer
          == c.x509.subject,
  }

@latonis latonis marked this pull request as ready for review December 31, 2024 01:32
@plusvic
Copy link
Member

plusvic commented Jan 13, 2025

Open to discussing how much CMS data we return.

Currently we expose the following:

Certificate {
      issuer: c.x509.issuer.to_string(),
      subject: c.x509.subject.to_string(),
      is_self_signed: c.x509.issuer
          == c.x509.subject,
  }

I would like to expose as much data as in the pe module if possible. This is the structure that we are currently exposing in the pe module:

message Certificate {
  optional string issuer = 1;
  optional string subject = 2;
  optional string thumbprint = 3;
  optional int64 version = 4;
  optional string algorithm = 5;
  optional string algorithm_oid = 6;
  optional string serial = 7;
  optional int64 not_before = 8 [(yaml.field).fmt = "t"];
  optional int64 not_after = 9 [(yaml.field).fmt = "t"];
}

I guess this information is also available for Mach-O certificates, right? I would also add the is_self_signed field to the PE module.

@plusvic plusvic merged commit 867ef7c into VirusTotal:main Jan 13, 2025
15 checks passed
@latonis latonis deleted the macho-cert-native branch January 31, 2025 17:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants