Examples of bypassing hash verification
For hackers, is the program unforgeable as long as it is digitally signed and validated? In this section, we will discuss how to bypass digital signature verification.
The following example is the signVerifyBypass project in the Chapter#9 folder of the GitHub project. In order to save space, this book only extracts the highlighted code – readers can refer to the complete project for detailed reading.
Figure 9.17 shows a description of the Windows API CryptSIPVerifyIndirectData function from researcher Matt Graeber’s public presentation, Subverting Trust in Windows:
Figure 9.17 – A description of the Windows API CryptSIPVerifyIndirectData function
In this figure, Matt Graeber describes how after a digitally signed executable has extracted the signature information (i.e., the full WIN_CERTIFICATE structure that Security Directory points to) through CryptSIPGetSignedDataMsg, the signature...
