checksec.h

Go to the documentation of this file.

#pragma once
 
#include <iostream>
#include <string>
#include <optional>
 
#include <pe-parse/parse.h>
 
namespace checksec {
 
class ChecksecError : public std::runtime_error {
   public:
    ChecksecError(const char* what) : std::runtime_error(what) {}
};
 
namespace impl {
constexpr const char kDynamicBaseDescription[] =
    "Binaries with dynamic base support can be "
    "dynamically rebased, enabling ASLR.";
 
constexpr const char kASLRDescription[] =
    "Binaries with ASLR support have randomized virtual memory layouts. "
    "ASLR is enabled by dynamic base support (without stripped relocation "
    "entries) or by using a managed runtime like .NET.";
 
constexpr const char kHighEntropyVADescription[] =
    "Binaries with high entropy virtual address support can leverage more of "
    "the virtual memory space to strengthen ASLR.";
 
constexpr const char kForceIntegrityDescription[] =
    "Binaries with force integrity checking enabled perform additional "
    "Authenticode signing checks, including page hash checks.";
 
constexpr const char kNXDescription[] =
    "Binaries with NX support can be run with hardware-enforced memory "
    "permissions (i.e., hardware DEP).";
 
constexpr const char kIsolationDescription[] =
    "Binaries with isolation support cause the Windows loader to perform "
    "a manifest lookup on program load.";
 
constexpr const char kSEHDescription[] =
    "Binaries with SEH support can use structured exception handlers.";
 
constexpr const char kCFGDescription[] =
    "Binaries with CFG enabled have additional protections on indirect calls.";
 
constexpr const char kAuthenticodeDescription[] =
    "Binaries with Authenticode signatures are verified at load time.";
 
constexpr const char kRFGDescription[] =
    "Binaries with RFG enabled have additional return-oriented-programming "
    "protections.";
 
constexpr const char kSafeSEHDescription[] =
    "Binaries with SafeSEH enabled have additional protections for stack-based "
    "structured exception handlers.";
 
constexpr const char kGSDescription[] =
    "Binaries with GS enabled have additional protections against stack-based "
    "buffer overflows.";
 
constexpr const char kDotNETDescription[] =
    ".NET binaries run in a managed environment with many default mitigations.";
 
constexpr const char kCetDescription[] =
    "Binaries with cet compat support will use "
    "the shadow stack (if available) to mitigate ROP.";
 
class LoadedImage {
   public:
    explicit LoadedImage(const std::string path) {
        if (!(pe_ = peparse::ParsePEFromFile(path.c_str()))) {
            throw ChecksecError("Couldn't load file; corrupt or not a PE?");
        }
    }
    ~LoadedImage() { peparse::DestructParsedPE(pe_); }
 
    // can't make copies of LoadedImage
    LoadedImage(const LoadedImage&) = delete;
    LoadedImage& operator=(const LoadedImage&) = delete;
 
    peparse::parsed_pe* get() const { return pe_; }
 
   private:
    peparse::parsed_pe* pe_;
};
}  // namespace impl
 
enum class MitigationPresence {
    Present,        
    NotPresent,     
    NotApplicable,  
    NotImplemented, 
};
 
struct MitigationReport {
    MitigationPresence presence;
 
    std::string description;
 
    std::optional<std::string> explanation;
 
    operator bool() const { return presence == MitigationPresence::Present; }
};
 
class Checksec {
   public:
    Checksec(std::string filepath);
 
    const std::string filepath() const { return filepath_; }
 
    const MitigationReport isDynamicBase() const;
 
    const MitigationReport isASLR() const;
 
    const MitigationReport isHighEntropyVA() const;
 
    const MitigationReport isForceIntegrity() const;
 
    const MitigationReport isNX() const;
 
    const MitigationReport isIsolation() const;
 
    const MitigationReport isSEH() const;
 
    const MitigationReport isCFG() const;
 
    const MitigationReport isAuthenticode() const;
 
    const MitigationReport isRFG() const;
 
    const MitigationReport isSafeSEH() const;
 
    const MitigationReport isGS() const;
 
    const MitigationReport isDotNET() const;
 
    const MitigationReport isCetCompat() const;
 
   private:
    impl::LoadedImage loadedImage_;
    std::string filepath_;
    std::uint16_t targetMachine_ = 0;
    std::uint16_t imageCharacteristics_ = 0;
    std::uint16_t dllCharacteristics_ = 0;
    std::uint32_t loadConfigSize_ = 0;
    std::uint32_t loadConfigGuardFlags_ = 0;
    std::uint64_t loadConfigSEHandlerTable_ = 0;
    std::uint64_t loadConfigSEHandlerCount_ = 0;
    std::uint64_t loadConfigSecurityCookie_ = 0;
    peparse::data_directory clrConfig_ = {0};
    std::uint16_t extendedDllCharacteristics_ = 0;
};
 
}  // namespace checksec