29 Commits (8a77214c8292f5f7ce94dee7b4f363b5c14d91af)

Author	SHA1	Message	Date
Val Snyder	7ff29b8c37	Bump copyright dates for 2025	3 months ago
Micah Snyder	9cb28e51e6	Bump copyright dates for 2024	1 year ago
Micah Snyder	6eebecc303	Bump copyright for 2023	2 years ago
micasnyd	140c88aa4e	Bump copyright for 2022 ... Includes minor format corrections.	3 years ago
Micah Snyder (micasnyd)	b9ca6ea103	Update copyright dates for 2021 ... Also fixes up clang-format.	4 years ago
Micah Snyder	206dbaefe8	Update copyright dates for 2020	5 years ago
Andrew	e8169c7053	Multiple blacklist sigs can now match with allmatch ... Also, move the cert-related DCONF cfg checks to more appropriate locations. One change in behavior: PE_CONF_CATALOG will disable loading trusted hashes from .cat files, but won't disable Authenticode hash checking completely (PE_CONF_CERTS does this).	6 years ago
Andrew	92088f91f1	Add support for cert blacklisting and whitelisting upfront ... Instead of checking the Authenticode header as an FP prevention mechanism, we now check it in the beginning if it exists. Also, we can now do actual blacklisting with .crb rules (previously, a blacklist rule just let you override a whitelist rule).	6 years ago
Micah Snyder	52cddcbcfd	Updating and cleaning up copyright notices.	6 years ago
Andrew	64ecd1099c	Fix support for authenticode signatures from external .cat files ... This commit adds back in support for whitelisting files based on signatures from .cat files loaded in via a '-d' flag to clamscan. This also makes it so that a .crb blacklist rule match can't be overruled by a signature in a .cat file	7 years ago
Andrew	ecae7f1976	Fix bug in how ptrs to file data are used for computing Authenticode hash ... We used to get a pointer to file data without locking and for some samples this pointer would be invalidated by the time we used it. Now, we just store the offset for the sections that should be hashed as part of the Authenticode hash computation and get the file data pointer right before it's needed.	7 years ago
Andrew	c714559526	Add support for MD5 and SHA256 hash-based validation of the exe code ... Also refactors the code a bit to consolidate some duplicate functionality	7 years ago
Mickey Sola	46a35abe56	mass update of copyright headers	10 years ago
Shawn Webb	56b4f4b0b9	Change the cert management code to cache the trusted/revoked root certs in the engine struct	13 years ago
aCaB	0393aa560a	cli_checkfp_pe	14 years ago
aCaB	7cb86faf7d	few fixmes fixed	14 years ago
aCaB	6bc5d0cb45	embedded authenticode verification	14 years ago
aCaB	3a55c60d14	refactor	14 years ago
aCaB	5d49bd063f	readd (broken) support for emb cats	14 years ago
aCaB	774120ff8f	temp commit	14 years ago
aCaB	d29b5c5fe4	refactor expect_obj	14 years ago
aCaB	7bcfb2f3bf	TL;DR: a bunch of stuff	14 years ago
aCaB	8997495d13	crtmgr_add	14 years ago
aCaB	e5c6c1aaf7	add crtmgr	14 years ago
aCaB	871afd19d7	extract hashes from cats	14 years ago
aCaB	5b48b665ff	add spam on errors	14 years ago
aCaB	b28a0d6fe5	add asn1.c	14 years ago
aCaB	eda6c4628b	partial crypto stuff, so it doesn't get lost	14 years ago