public static byte[]? ExtractPadding(string filePath)
{
using (var file = new PortableExecutable(filePath))
{
var dosHeader = file.GetDosHeader();
var peHeader = file.GetPEHeader(dosHeader);
var signatureLocation = peHeader.DataDirectories[ImageDataDirectoryEntry.IMAGE_DIRECTORY_ENTRY_SECURITY];
using (var signatureData = file.ReadDataDirectory(signatureLocation))
{
using (var reader = new BinaryReader(signatureData))
{
var winCertLength = reader.ReadUInt32();
var winCertRevision = reader.ReadUInt16();
var winCertType = reader.ReadUInt16();
if (winCertRevision != 0x200 && winCertRevision != 0x100)
{
return(null);
}
if (winCertType != 0x0002)
{
return(null);
}
using (var memoryStream = new MemoryStream())
{
int read;
Span <byte> buffer = stackalloc byte[0x400];
while ((read = reader.Read(buffer)) > 0)
{
memoryStream.Write(buffer.Slice(0, read));
}
var winCertificate = memoryStream.ToArray();
var signer = new SignedCms();
signer.Decode(winCertificate);
var roundTrip = signer.Encode();
var sizeDifference = winCertificate.Length - roundTrip.Length;
var difference = new byte[sizeDifference];
Buffer.BlockCopy(winCertificate, roundTrip.Length, difference, 0, difference.Length);
return(difference);
}
}
}
}
}
