Class CertScanner

source code

A scanner for certificate ASN.1 objects.

Yara rules for the two ASN.1 encoded objects we are looking for:

'x509' : 'rule x509 {
   strings: $a = {30 82 ?? ?? 30 82 ?? ??} condition: $a
   }',

'pkcs' : 'rule pkcs {
   strings: $a = {30 82 ?? ?? 02 01 00} condition: $a
   }',

These rules are very simple, and so we don't really use Yara for this - its
faster to just scan directly.

Scan the region from offset for maxlen.

Args:
  offset: The starting offset in our current address space to scan.

  maxlen: The maximum length to scan. If not provided we just scan until
    there is no data.

Yields:
  offsets where all the constrainst are satisfied.