put(buffer, zeros, 3 - (Size_ + 3) % 4);
}
-Hash Sign(const void *idata, size_t isize, std::streambuf &output, const std::string &identifier, const std::string &entitlements, bool merge, const std::string &requirements, const std::string &key, const Slots &slots, uint32_t flags, bool platform, const Progress &progress) {
+Hash Sign(const void *idata, size_t isize, std::streambuf &output, const std::string &identifier, const std::string &entitlements, bool merge, const std::string &requirements, const std::string &key, const Slots &slots, uint32_t flags, uint8_t platform, const Progress &progress) {
Hash hash;
directory.nCodeSlots = Swap(normal);
directory.hashSize = algorithm.size_;
directory.hashType = algorithm.type_;
- directory.platform = platform ? 0x01 : 0x00;
+ directory.platform = platform;
directory.pageSize = PageShift_;
directory.spare2 = Swap(uint32_t(0));
directory.scatterOffset = Swap(uint32_t(0));
}
};
-static Hash Sign(const uint8_t *prefix, size_t size, std::streambuf &buffer, Hash &hash, std::streambuf &save, const std::string &identifier, const std::string &entitlements, bool merge, const std::string &requirements, const std::string &key, const Slots &slots, size_t length, uint32_t flags, bool platform, const Progress &progress) {
+static Hash Sign(const uint8_t *prefix, size_t size, std::streambuf &buffer, Hash &hash, std::streambuf &save, const std::string &identifier, const std::string &entitlements, bool merge, const std::string &requirements, const std::string &key, const Slots &slots, size_t length, uint32_t flags, uint8_t platform, const Progress &progress) {
// XXX: this is a miserable fail
std::stringbuf temp;
put(temp, prefix, size);
}
};
-Bundle Sign(const std::string &root, Folder &parent, const std::string &key, State &local, const std::string &requirements, const Functor<std::string (const std::string &, const std::string &)> &alter, const Progress &progress) {
+Bundle Sign(const std::string &root, Folder &parent, const std::string &key, State &local, const std::string &requirements, const Functor<std::string (const std::string &, const std::string &)> &alter, bool merge, uint8_t platform, const Progress &progress) {
std::string executable;
std::string identifier;
State remote;
bundles[nested[1]] = Sign(root + bundle, subfolder, key, remote, "", Starts(name, "PlugIns/") ? alter :
static_cast<const Functor<std::string (const std::string &, const std::string &)> &>(fun([&](const std::string &, const std::string &) -> std::string { return entitlements; }))
- , progress);
+ , merge, platform, progress);
local.Merge(bundle, remote);
}), fun([&](const std::string &name, const Functor<std::string ()> &read) {
}));
case MH_CIGAM: case MH_CIGAM_64:
folder.Save(name, true, flag, fun([&](std::streambuf &save) {
Slots slots;
- Sign(header.bytes, size, data, hash, save, identifier, "", false, "", key, slots, length, 0, false, Progression(progress, root + name));
+ Sign(header.bytes, size, data, hash, save, identifier, "", false, "", key, slots, length, 0, platform, Progression(progress, root + name));
}));
return;
}
Slots slots;
slots[1] = local.files.at(info);
slots[3] = local.files.at(signature);
- bundle.hash = Sign(NULL, 0, buffer, local.files[executable], save, identifier, entitlements, false, requirements, key, slots, length, 0, false, Progression(progress, root + executable));
+ bundle.hash = Sign(NULL, 0, buffer, local.files[executable], save, identifier, entitlements, merge, requirements, key, slots, length, 0, platform, Progression(progress, root + executable));
}));
}));
return bundle;
}
-Bundle Sign(const std::string &root, Folder &folder, const std::string &key, const std::string &requirements, const Functor<std::string (const std::string &, const std::string &)> &alter, const Progress &progress) {
+Bundle Sign(const std::string &root, Folder &folder, const std::string &key, const std::string &requirements, const Functor<std::string (const std::string &, const std::string &)> &alter, bool merge, uint8_t platform, const Progress &progress) {
State local;
- return Sign(root, folder, key, local, requirements, alter, progress);
+ return Sign(root, folder, key, local, requirements, alter, merge, platform, progress);
}
#endif
fprintf(stderr, "Usage: %s [-Acputype:subtype] [-a] [-C[adhoc | enforcement | expires | hard |\n", argv0);
fprintf(stderr, " host | kill | library-validation | restrict | runtime]] [-D] [-d]\n");
fprintf(stderr, " [-Enum:file] [-e] [-H[sha1 | sha256]] [-h] [-Iname]\n");
- fprintf(stderr, " [-Kkey.p12 [-Upassword]] [-M] [-P] [-Qrequirements.xml] [-q]\n");
+ fprintf(stderr, " [-Kkey.p12 [-Upassword]] [-M] [-P[num]] [-Qrequirements.xml] [-q]\n");
fprintf(stderr, " [-r | -Sfile.xml | -s] [-u] [-arch arch_type] file ...\n");
- fprintf(stderr, "Options:\n");
+ fprintf(stderr, "Common Options:\n");
fprintf(stderr, " -S[file.xml] Pseudo-sign using the entitlements in file.xml\n");
fprintf(stderr, " -Kkey.p12 Sign using private key in key.p12\n");
fprintf(stderr, " -Upassword Use password to unlock key.p12\n");
bool flag_M(false);
uint32_t flags(0);
- bool platform(false);
+ uint8_t platform(0);
uint32_t flag_CPUType(_not(uint32_t));
uint32_t flag_CPUSubtype(_not(uint32_t));
} break;
case 'P':
- platform = true;
+ if (argv[argi][2] != '\0') {
+ char *platformchar = argv[argi] + 2;
+ char *arge;
+ platform = strtoul(platformchar, &arge, 0);
+ } else {
+ platform = 13;
+ }
break;
case 's':
}
if (S_ISDIR(info.st_mode)) {
- if (!flag_S) {
- fprintf(stderr, "ldid: Only -S can be used on directories\n");
+ if (!flag_S && !flag_s) {
+ fprintf(stderr, "ldid: Only -S and -s can be used on directories\n");
exit(1);
}
ldid::DiskFolder folder(path + "/");
- path += "/" + Sign("", folder, key, requirements, ldid::fun([&](const std::string &, const std::string &) -> std::string { return entitlements; }), dummy_).path;
- } else if (flag_S || flag_r) {
+ path += "/" + Sign("", folder, key, requirements, ldid::fun([&](const std::string &, const std::string &) -> std::string { return entitlements; }), flag_M, platform, dummy_).path;
+ } else if (flag_S || flag_r || flag_s) {
Map input(path, O_RDONLY, PROT_READ, MAP_PRIVATE);
std::filebuf output;
auto &algorithm(*algorithms[type - 1]);
uint8_t hash[algorithm.size_];
algorithm(hash, blob + begin, end - begin);
- candidates.insert({type, {directory, end - begin, algorithm, Hex(hash, 20), begin}});
+ candidates.insert({type, {directory, end - begin, algorithm, Hex(hash, algorithm.size_), begin}});
} else if (type == CSSLOT_SIGNATURESLOT) {
cmsBegin = Swap(super->index[index].offset);
cmsEnd = index + 1 == Swap(super->count) ? Swap(super->blob.length) : Swap(super->index[index + 1].offset);
auto choice(candidate.second.algorithm_.name());
choices += ',';
choices += choice;
- printf("CandidateCDHash %s=%s\n", choice, candidate.second.hash_.c_str());
+ printf("CandidateCDHash %s=%.40s\n", choice, candidate.second.hash_.c_str());
+ printf("CandidateCDHashFull %s=%s\n", choice, candidate.second.hash_.c_str());
}
printf("Hash choices=%s\n", choices.c_str() + 1);
- printf("CDHash=%s\n", best->second.hash_.c_str());
+ printf("CDHash=%.40s\n", best->second.hash_.c_str());
if (cmsBegin != 0 && cmsEnd != 0) {
// This loads the CMS blob and parses each X509 cert in the blob to extract the
if ((p7 = d2i_PKCS7_bio(bio, NULL)) == NULL) {
// In order to follow codesign, we just ignore errors
printf("Authority=(unavailable)\n");
- PKCS7_free(p7);
- continue;
- }
- STACK_OF(X509) *certs = NULL;
- switch (OBJ_obj2nid(p7->type)) {
- case NID_pkcs7_signed:
- if (p7->d.sign != NULL)
- certs = p7->d.sign->cert;
- break;
- case NID_pkcs7_signedAndEnveloped:
- if (p7->d.signed_and_enveloped != NULL)
- certs = p7->d.signed_and_enveloped->cert;
- break;
- default:
- break;
- }
- if (certs != NULL) {
- X509 *x;
- for (int i = 0; i < sk_X509_num(certs); i++) {
- x = sk_X509_value(certs, i);
- int lastpos = -1;
- X509_NAME *nm = X509_get_subject_name(x);
- X509_NAME_ENTRY *e;
-
- for (;;) {
- lastpos = X509_NAME_get_index_by_NID(nm, NID_commonName, lastpos);
- if (lastpos == -1)
- break;
- e = X509_NAME_get_entry(nm, lastpos);
- ASN1_STRING *s = X509_NAME_ENTRY_get_data(e);
- printf("Authority=%s\n", reinterpret_cast<const char *>(ASN1_STRING_get0_data(s)));
+ } else {
+ STACK_OF(X509) *certs = NULL;
+ switch (OBJ_obj2nid(p7->type)) {
+ case NID_pkcs7_signed:
+ if (p7->d.sign != NULL)
+ certs = p7->d.sign->cert;
+ break;
+ case NID_pkcs7_signedAndEnveloped:
+ if (p7->d.signed_and_enveloped != NULL)
+ certs = p7->d.signed_and_enveloped->cert;
+ break;
+ default:
+ break;
+ }
+ if (certs != NULL) {
+ X509 *x;
+ for (int i = 0; i < sk_X509_num(certs); i++) {
+ x = sk_X509_value(certs, i);
+ int lastpos = -1;
+ X509_NAME *nm = X509_get_subject_name(x);
+ X509_NAME_ENTRY *e;
+
+ for (;;) {
+ lastpos = X509_NAME_get_index_by_NID(nm, NID_commonName, lastpos);
+ if (lastpos == -1)
+ break;
+ e = X509_NAME_get_entry(nm, lastpos);
+ ASN1_STRING *s = X509_NAME_ENTRY_get_data(e);
+ printf("Authority=%s\n", reinterpret_cast<const char *>(ASN1_STRING_get0_data(s)));
+ }
}
+ } else {
+ printf("Authority=(unavailable)\n");
}
- } else {
- printf("Authority=(unavailable)\n");
}
PKCS7_free(p7);
}
+
+ if (Swap(directory->teamIDOffset) > 0)
+ printf("TeamIdentifier=%s\n", blob + best->second.offset + Swap(directory->teamIDOffset));
+ else
+ printf("TeamIdentifier=not set\n");
}
}
git.ckatri.com / ldid.git / blobdiff