Added tests for certificate padding.

The included binaries are self-signed, however the validity of the
signature is not important for these tests.

The executables included are real with a changed extension, however
they are simply native binaries where main() returns zero and nothing
more.

Author: vcsjones

AuthenticodeLint/CheckEngine.cs

@@ -34,7 +34,7 @@ public RuleEngineResult RunAllRules(string file, Graph<Signature> signatures, Li
             foreach(var rule in rules)
             {
                 RuleResult result;
-                var verboseWriter = verbose ? new VerboseSignatureLogger() : SignatureLogger.Null;
+                var verboseWriter = verbose ? new MemorySignatureLogger() : SignatureLogger.Null;
                 if (signatures.Items.Count == 0)
                 {
                     result = RuleResult.Fail;

AuthenticodeLint/Rules/WinCertificatePaddingRule.cs

@@ -14,7 +14,7 @@ public class WinCertificatePaddingRule : IAuthenticodeFileRule
         public RuleResult Validate(string file, SignatureLogger verboseWriter, CheckConfiguration configuration)
         {
             var padding = CertificatePaddingExtractor.ExtractPadding(file);
-            if (padding?.Any(p => p != 0) ?? false)
+            if (padding?.Any(p => p != 0) == true)
             {
                 verboseWriter.LogMessage($"Non-zero data found after PKCS#7 structure: {Convert.ToBase64String(padding)}.");
                 return RuleResult.Fail;

AuthenticodeLint/VerboseSignatureTextWriter.cs

@@ -7,7 +7,7 @@
 
 namespace AuthenticodeLint
 {
-    public class VerboseSignatureLogger : SignatureLogger
+    public class MemorySignatureLogger : SignatureLogger
     {
         public override void LogMessage(string message) => Messages.Add(message);
 
@@ -34,7 +34,7 @@ public abstract class SignatureLogger
     {
         public static SignatureLogger Null { get; } = new NullSignatureLogger();
 
-        internal List<string> Messages { get; } = new List<string>();
+        public List<string> Messages { get; } = new List<string>();
 
         public abstract void LogSignatureMessage(SignerInfo signature, string message);
         public abstract void LogMessage(string message);

AuthenticodeLintTests/AuthenticodeLintTests.csproj

@@ -38,8 +38,11 @@
   <ItemGroup>
     <Compile Include="CommandLineParsingTests.cs" />
     <Compile Include="Properties\AssemblyInfo.cs" />
+    <Compile Include="Rules\WinCertificatePaddingRuleTests.cs" />
   </ItemGroup>
   <ItemGroup>
+    <None Include="inputs\wintrustnonpadded.ex_" />
+    <None Include="inputs\wintrustpadded.ex_" />
     <None Include="project.json" />
   </ItemGroup>
   <ItemGroup>
@@ -51,6 +54,7 @@
   <ItemGroup>
     <Service Include="{82A7F48D-3B50-4B1E-B82E-3ADA8210C358}" />
   </ItemGroup>
+  <ItemGroup />
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.

AuthenticodeLintTests/Rules/WinCertificatePaddingRuleTests.cs

@@ -0,0 +1,38 @@
+using AuthenticodeLint;
+using AuthenticodeLint.Rules;
+using System;
+using System.Collections.Generic;
+using Xunit;
+
+namespace AuthenticodeLintTests.Rules
+{
+    public class WinCertificatePaddingRuleTests
+    {
+        private static CheckConfiguration Configuration => new CheckConfiguration(new List<string>(), null, false, new HashSet<int>(), false, RevocationChecking.None);
+
+        [Fact]
+        public void PaddedExecutableShouldFail()
+        {
+            var file = "../../inputs/wintrustpadded.ex_";
+            var rule = new WinCertificatePaddingRule();
+            var logger = new MemorySignatureLogger();
+
+            var result = rule.Validate(file, logger, Configuration);
+            Assert.Equal(RuleResult.Fail, result);
+            var expectedPadding = Convert.ToBase64String(System.Text.Encoding.ASCII.GetBytes("fail"));
+            Assert.Contains($"Non-zero data found after PKCS#7 structure: {expectedPadding}.", logger.Messages);
+        }
+
+        [Fact]
+        public void NonPaddedExecutableShouldPass()
+        {
+            var file = "../../inputs/wintrustnonpadded.ex_";
+            var rule = new WinCertificatePaddingRule();
+            var logger = new MemorySignatureLogger();
+
+            var result = rule.Validate(file, logger, Configuration);
+            Assert.Equal(RuleResult.Pass, result);
+            Assert.Empty(logger.Messages);
+        }
+    }
+}