Rename resign to Sign and put into ldid namespace.

[ldid.git] / ldid.cpp

diff --git a/ldid.cpp b/ldid.cpp
index caf6bc1f09c01651379637a875030aef02fe5fe4..9ed5792ac3560afee0cc351be40a2e1354f3fcc6 100644 (file)
--- a/ldid.cpp
+++ b/ldid.cpp
@@ -28,19 +28,25 @@
 #include <string>
 #include <vector>
 
 #include <string>
 #include <vector>
 

-#include <dlfcn.h>

 #include <errno.h>
 #include <fcntl.h>
 #include <stdbool.h>
 #include <stdint.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <stdbool.h>
 #include <stdint.h>

+#include <unistd.h>

 
 #include <sys/mman.h>
 #include <sys/stat.h>
 
 
 #include <sys/mman.h>
 #include <sys/stat.h>
 

+#include <openssl/err.h>
+#include <openssl/pem.h>
+#include <openssl/pkcs7.h>
+#include <openssl/pkcs12.h>

 #include <openssl/sha.h>
 
 #include <plist/plist.h>
 
 #include <openssl/sha.h>
 
 #include <plist/plist.h>
 

+#include "ldid.hpp"
+

 #define _assert___(line) \
     #line
 #define _assert__(line) \
 #define _assert___(line) \
     #line
 #define _assert__(line) \


@@ -372,13 +378,16 @@ Type_ Align(Type_ value, size_t align) {
     return value;
 }
 
     return value;
 }
 

-uint16_t Swap_(uint16_t value) {
+static const uint8_t PageShift_(0x0c);
+static const uint32_t PageSize_(1 << PageShift_);
+
+static inline uint16_t Swap_(uint16_t value) {

     return
         ((value >>  8) & 0x00ff) |
         ((value <<  8) & 0xff00);
 }
 
     return
         ((value >>  8) & 0x00ff) |
         ((value <<  8) & 0xff00);
 }
 

-uint32_t Swap_(uint32_t value) {
+static inline uint32_t Swap_(uint32_t value) {

     value = ((value >>  8) & 0x00ff00ff) |
             ((value <<  8) & 0xff00ff00);
     value = ((value >> 16) & 0x0000ffff) |
     value = ((value >>  8) & 0x00ff00ff) |
             ((value <<  8) & 0xff00ff00);
     value = ((value >> 16) & 0x0000ffff) |


@@ -386,48 +395,48 @@ uint32_t Swap_(uint32_t value) {
     return value;
 }
 
     return value;
 }
 

-uint64_t Swap_(uint64_t value) {
+static inline uint64_t Swap_(uint64_t value) {

     value = (value & 0x00000000ffffffff) << 32 | (value & 0xffffffff00000000) >> 32;
     value = (value & 0x0000ffff0000ffff) << 16 | (value & 0xffff0000ffff0000) >> 16;
     value = (value & 0x00ff00ff00ff00ff) << 8  | (value & 0xff00ff00ff00ff00) >> 8;
     return value;
 }
 
     value = (value & 0x00000000ffffffff) << 32 | (value & 0xffffffff00000000) >> 32;
     value = (value & 0x0000ffff0000ffff) << 16 | (value & 0xffff0000ffff0000) >> 16;
     value = (value & 0x00ff00ff00ff00ff) << 8  | (value & 0xff00ff00ff00ff00) >> 8;
     return value;
 }
 

-int16_t Swap_(int16_t value) {
+static inline int16_t Swap_(int16_t value) {

     return Swap_(static_cast<uint16_t>(value));
 }
 
     return Swap_(static_cast<uint16_t>(value));
 }
 

-int32_t Swap_(int32_t value) {
+static inline int32_t Swap_(int32_t value) {

     return Swap_(static_cast<uint32_t>(value));
 }
 
     return Swap_(static_cast<uint32_t>(value));
 }
 

-int64_t Swap_(int64_t value) {
+static inline int64_t Swap_(int64_t value) {

     return Swap_(static_cast<uint64_t>(value));
 }
 
     return Swap_(static_cast<uint64_t>(value));
 }
 

-bool little_(true);
+static bool little_(true);

 
 

-uint16_t Swap(uint16_t value) {
+static inline uint16_t Swap(uint16_t value) {

     return little_ ? Swap_(value) : value;
 }
 
     return little_ ? Swap_(value) : value;
 }
 

-uint32_t Swap(uint32_t value) {
+static inline uint32_t Swap(uint32_t value) {

     return little_ ? Swap_(value) : value;
 }
 
     return little_ ? Swap_(value) : value;
 }
 

-uint64_t Swap(uint64_t value) {
+static inline uint64_t Swap(uint64_t value) {

     return little_ ? Swap_(value) : value;
 }
 
     return little_ ? Swap_(value) : value;
 }
 

-int16_t Swap(int16_t value) {
+static inline int16_t Swap(int16_t value) {

     return Swap(static_cast<uint16_t>(value));
 }
 
     return Swap(static_cast<uint16_t>(value));
 }
 

-int32_t Swap(int32_t value) {
+static inline int32_t Swap(int32_t value) {

     return Swap(static_cast<uint32_t>(value));
 }
 
     return Swap(static_cast<uint32_t>(value));
 }
 

-int64_t Swap(int64_t value) {
+static inline int64_t Swap(int64_t value) {

     return Swap(static_cast<uint64_t>(value));
 }
 
     return Swap(static_cast<uint64_t>(value));
 }
 


@@ -792,7 +801,7 @@ struct CodeDirectory {
 
 extern "C" uint32_t hash(uint8_t *k, uint32_t length, uint32_t initval);
 
 
 extern "C" uint32_t hash(uint8_t *k, uint32_t length, uint32_t initval);
 

-void sha1(uint8_t *hash, const void *data, size_t size) {
+static void sha1(uint8_t *hash, const void *data, size_t size) {

     SHA1(static_cast<const uint8_t *>(data), size, hash);
 }
 
     SHA1(static_cast<const uint8_t *>(data), size, hash);
 }
 


@@ -877,6 +886,10 @@ class Map {
         clear();
     }
 
         clear();
     }
 

+    bool empty() const {
+        return data_ == NULL;
+    }
+

     void open(const char *path, int oflag, int pflag, int mflag) {
         clear();
 
     void open(const char *path, int oflag, int pflag, int mflag) {
         clear();
 


@@ -919,7 +932,6 @@ template <typename Type_, typename... Args_>
 class Functor<Type_ (Args_...)> {
   public:
     virtual Type_ operator ()(Args_... args) const = 0;
 class Functor<Type_ (Args_...)> {
   public:
     virtual Type_ operator ()(Args_... args) const = 0;

-    virtual operator bool() const = 0;

 };
 
 template <typename Function_>
 };
 
 template <typename Function_>


@@ -933,11 +945,6 @@ class FunctorImpl<Type_ (Value_::*)(Args_...) const> :
     const Value_ *value_;
 
   public:
     const Value_ *value_;
 
   public:

-    FunctorImpl() :
-        value_(NULL)
-    {
-    }
-

     FunctorImpl(const Value_ &value) :
         value_(&value)
     {
     FunctorImpl(const Value_ &value) :
         value_(&value)
     {


@@ -953,7 +960,9 @@ FunctorImpl<decltype(&Function_::operator())> fun(const Function_ &value) {
     return value;
 }
 
     return value;
 }
 

-void resign(void *idata, size_t isize, std::streambuf &output, const Functor<size_t (size_t)> &allocate, const Functor<size_t (std::streambuf &output, size_t, const std::string &, const char *)> &save) {
+namespace ldid {
+
+static void Allocate(void *idata, size_t isize, std::streambuf &output, const Functor<size_t (size_t)> &allocate, const Functor<size_t (std::streambuf &output, size_t, const std::string &, const char *)> &save) {

     FatHeader source(idata, isize);
 
     size_t offset(0);
     FatHeader source(idata, isize);
 
     size_t offset(0);


@@ -1001,7 +1010,7 @@ void resign(void *idata, size_t isize, std::streambuf &output, const Functor<siz
 
         allocations.push_back(CodesignAllocation(mach_header, offset, size, limit, alloc, align));
         offset += size + alloc;
 
         allocations.push_back(CodesignAllocation(mach_header, offset, size, limit, alloc, align));
         offset += size + alloc;

-        offset = Align(offset, 16);
+        offset = Align(offset, 0x10);

     }
 
     size_t position(0);
     }
 
     size_t position(0);


@@ -1038,7 +1047,7 @@ void resign(void *idata, size_t isize, std::streambuf &output, const Functor<siz
         _foreach (load_command, mach_header.GetLoadCommands()) {
             std::string copy(reinterpret_cast<const char *>(load_command), load_command->cmdsize);
 
         _foreach (load_command, mach_header.GetLoadCommands()) {
             std::string copy(reinterpret_cast<const char *>(load_command), load_command->cmdsize);
 

-            switch (uint32_t cmd = mach_header.Swap(load_command->cmd)) {
+            switch (mach_header.Swap(load_command->cmd)) {

                 case LC_CODE_SIGNATURE:
                     continue;
                 break;
                 case LC_CODE_SIGNATURE:
                     continue;
                 break;


@@ -1049,7 +1058,7 @@ void resign(void *idata, size_t isize, std::streambuf &output, const Functor<siz
                         break;
                     size_t size(mach_header.Swap(allocation.limit_ + allocation.alloc_ - mach_header.Swap(segment_command->fileoff)));
                     segment_command->filesize = size;
                         break;
                     size_t size(mach_header.Swap(allocation.limit_ + allocation.alloc_ - mach_header.Swap(segment_command->fileoff)));
                     segment_command->filesize = size;

-                    segment_command->vmsize = Align(size, 0x1000);
+                    segment_command->vmsize = Align(size, PageSize_);

                 } break;
 
                 case LC_SEGMENT_64: {
                 } break;
 
                 case LC_SEGMENT_64: {


@@ -1058,7 +1067,7 @@ void resign(void *idata, size_t isize, std::streambuf &output, const Functor<siz
                         break;
                     size_t size(mach_header.Swap(allocation.limit_ + allocation.alloc_ - mach_header.Swap(segment_command->fileoff)));
                     segment_command->filesize = size;
                         break;
                     size_t size(mach_header.Swap(allocation.limit_ + allocation.alloc_ - mach_header.Swap(segment_command->fileoff)));
                     segment_command->filesize = size;

-                    segment_command->vmsize = Align(size, 0x1000);
+                    segment_command->vmsize = Align(size, PageSize_);

                 } break;
             }
 
                 } break;
             }
 


@@ -1127,11 +1136,169 @@ void resign(void *idata, size_t isize, std::streambuf &output, const Functor<siz
     }
 }
 
     }
 }
 

-void resign(void *idata, size_t isize, std::streambuf &output, const char *name, const std::string &entitlements) {
-    uint8_t pageshift(0x0c);
-    uint32_t pagesize(1 << pageshift);
+}
+
+typedef std::map<uint32_t, std::string> Blobs;
+
+static void insert(Blobs &blobs, uint32_t slot, const std::stringbuf &buffer) {
+    auto value(buffer.str());
+    std::swap(blobs[slot], value);
+}
+
+static void insert(Blobs &blobs, uint32_t slot, uint32_t magic, const std::stringbuf &buffer) {
+    auto value(buffer.str());
+    Blob blob;
+    blob.magic = Swap(magic);
+    blob.length = Swap(uint32_t(sizeof(blob) + value.size()));
+    value.insert(0, reinterpret_cast<char *>(&blob), sizeof(blob));
+    std::swap(blobs[slot], value);
+}
+
+static size_t put(std::streambuf &output, uint32_t magic, const Blobs &blobs) {
+    size_t total(0);
+    _foreach (blob, blobs)
+        total += blob.second.size();
+
+    struct SuperBlob super;
+    super.blob.magic = Swap(magic);
+    super.blob.length = Swap(uint32_t(sizeof(SuperBlob) + blobs.size() * sizeof(BlobIndex) + total));
+    super.count = Swap(uint32_t(blobs.size()));
+    put(output, &super, sizeof(super));
+
+    size_t offset(sizeof(SuperBlob) + sizeof(BlobIndex) * blobs.size());
+
+    _foreach (blob, blobs) {
+        BlobIndex index;
+        index.type = Swap(blob.first);
+        index.offset = Swap(uint32_t(offset));
+        put(output, &index, sizeof(index));
+        offset += blob.second.size();
+    }
+
+    _foreach (blob, blobs)
+        put(output, blob.second.data(), blob.second.size());
+
+    return offset;
+}
+
+class Buffer {
+  private:
+    BIO *bio_;
+
+  public:
+    Buffer(BIO *bio) :
+        bio_(bio)
+    {
+        _assert(bio_ != NULL);
+    }
+
+    Buffer() :
+        bio_(BIO_new(BIO_s_mem()))
+    {
+    }
+
+    Buffer(const char *data, size_t size) :
+        Buffer(BIO_new_mem_buf(const_cast<char *>(data), size))
+    {
+    }
+
+    Buffer(const std::string &data) :
+        Buffer(data.data(), data.size())
+    {
+    }
+
+    Buffer(PKCS7 *pkcs) :
+        Buffer()
+    {
+        _assert(i2d_PKCS7_bio(bio_, pkcs) != 0);
+    }
+
+    ~Buffer() {
+        BIO_free_all(bio_);
+    }
+
+    operator BIO *() const {
+        return bio_;
+    }
+
+    explicit operator std::string() const {
+        char *data;
+        auto size(BIO_get_mem_data(bio_, &data));
+        return std::string(data, size);
+    }
+};

 
 

-    resign(idata, isize, output, fun([&](size_t size) -> size_t {
+class Stuff {
+  private:
+    PKCS12 *value_;
+    EVP_PKEY *key_;
+    X509 *cert_;
+    STACK_OF(X509) *ca_;
+
+  public:
+    Stuff(BIO *bio) :
+        value_(d2i_PKCS12_bio(bio, NULL)),
+        ca_(NULL)
+    {
+        _assert(value_ != NULL);
+        _assert(PKCS12_parse(value_, "", &key_, &cert_, &ca_) != 0);
+        _assert(key_ != NULL);
+        _assert(cert_ != NULL);
+    }
+
+    Stuff(const std::string &data) :
+        Stuff(Buffer(data))
+    {
+    }
+
+    ~Stuff() {
+        sk_X509_pop_free(ca_, X509_free);
+        X509_free(cert_);
+        EVP_PKEY_free(key_);
+        PKCS12_free(value_);
+    }
+
+    operator PKCS12 *() const {
+        return value_;
+    }
+
+    operator EVP_PKEY *() const {
+        return key_;
+    }
+
+    operator X509 *() const {
+        return cert_;
+    }
+
+    operator STACK_OF(X509) *() const {
+        return ca_;
+    }
+};
+
+class Signature {
+  private:
+    PKCS7 *value_;
+
+  public:
+    Signature(const Stuff &stuff, const Buffer &data) :
+        value_(PKCS7_sign(stuff, stuff, stuff, data, PKCS7_BINARY | PKCS7_DETACHED))
+    {
+        _assert(value_ != NULL);
+    }
+
+    ~Signature() {
+        PKCS7_free(value_);
+    }
+
+    operator PKCS7 *() const {
+        return value_;
+    }
+};
+
+namespace ldid {
+
+void Sign(void *idata, size_t isize, std::streambuf &output, const std::string &name, const std::string &entitlements, const std::string &key, const Slots &slots) {
+    Allocate(idata, isize, output, fun([&](size_t size) -> size_t {

         size_t alloc(sizeof(struct SuperBlob));
 
         uint32_t special(0);
         size_t alloc(sizeof(struct SuperBlob));
 
         uint32_t special(0);


@@ -1140,7 +1307,7 @@ void resign(void *idata, size_t isize, std::streambuf &output, const char *name,
         alloc += sizeof(struct BlobIndex);
         alloc += 0xc;
 
         alloc += sizeof(struct BlobIndex);
         alloc += 0xc;
 

-        if (entitlements.size() != 0) {
+        if (!entitlements.empty()) {

             special = std::max(special, CSSLOT_ENTITLEMENTS);
             alloc += sizeof(struct BlobIndex);
             alloc += sizeof(struct Blob);
             special = std::max(special, CSSLOT_ENTITLEMENTS);
             alloc += sizeof(struct BlobIndex);
             alloc += sizeof(struct Blob);


@@ -1151,40 +1318,37 @@ void resign(void *idata, size_t isize, std::streambuf &output, const char *name,
         alloc += sizeof(struct BlobIndex);
         alloc += sizeof(struct Blob);
         alloc += sizeof(struct CodeDirectory);
         alloc += sizeof(struct BlobIndex);
         alloc += sizeof(struct Blob);
         alloc += sizeof(struct CodeDirectory);

-        alloc += strlen(name) + 1;
+        alloc += name.size() + 1;
+
+        if (!key.empty()) {
+            alloc += sizeof(struct BlobIndex);
+            alloc += sizeof(struct Blob);
+            // XXX: this is just a "sufficiently large number"
+            alloc += 0x3000;
+        }

 
 

-        uint32_t normal((size + pagesize - 1) / pagesize);
+        _foreach (slot, slots)
+            special = std::max(special, slot.first);
+
+        uint32_t normal((size + PageSize_ - 1) / PageSize_);

         alloc = Align(alloc + (special + normal) * SHA_DIGEST_LENGTH, 16);
         return alloc;
     }), fun([&](std::streambuf &output, size_t limit, const std::string &overlap, const char *top) -> size_t {
         alloc = Align(alloc + (special + normal) * SHA_DIGEST_LENGTH, 16);
         return alloc;
     }), fun([&](std::streambuf &output, size_t limit, const std::string &overlap, const char *top) -> size_t {

-        std::map<uint32_t, std::string> blobs;
+        Blobs blobs;

 
         if (true) {
             std::stringbuf data;
 
 
         if (true) {
             std::stringbuf data;
 

-            Blob blob;
-            blob.magic = Swap(CSMAGIC_REQUIREMENTS);
-            blob.length = Swap(uint32_t(sizeof(Blob) + sizeof(uint32_t)));
-            put(data, &blob, sizeof(blob));
-
-            uint32_t requirements;
-            requirements = Swap(0);
-            put(data, &requirements, sizeof(requirements));
+            Blobs requirements;
+            put(data, CSMAGIC_REQUIREMENTS, requirements);

 
 

-            blobs.insert(std::make_pair(CSSLOT_REQUIREMENTS, data.str()));
+            insert(blobs, CSSLOT_REQUIREMENTS, data);

         }
 
         }
 

-        if (entitlements.size() != 0) {
+        if (!entitlements.empty()) {

             std::stringbuf data;
             std::stringbuf data;

-
-            Blob blob;
-            blob.magic = Swap(CSMAGIC_EMBEDDED_ENTITLEMENTS);
-            blob.length = Swap(uint32_t(sizeof(blob) + entitlements.size()));
-            put(data, &blob, sizeof(blob));
-

             put(data, entitlements.data(), entitlements.size());
             put(data, entitlements.data(), entitlements.size());

-
-            blobs.insert(std::make_pair(CSSLOT_ENTITLEMENTS, data.str()));
+            insert(blobs, CSSLOT_ENTITLEMENTS, CSMAGIC_EMBEDDED_ENTITLEMENTS, data);

         }
 
         if (true) {
         }
 
         if (true) {


@@ -1193,29 +1357,26 @@ void resign(void *idata, size_t isize, std::streambuf &output, const char *name,
             uint32_t special(0);
             _foreach (blob, blobs)
                 special = std::max(special, blob.first);
             uint32_t special(0);
             _foreach (blob, blobs)
                 special = std::max(special, blob.first);

-            uint32_t normal((limit + pagesize - 1) / pagesize);
-
-            Blob blob;
-            blob.magic = Swap(CSMAGIC_CODEDIRECTORY);
-            blob.length = Swap(uint32_t(sizeof(blob) + sizeof(CodeDirectory) + strlen(name) + 1 + SHA_DIGEST_LENGTH * (special + normal)));
-            put(data, &blob, sizeof(blob));
+            _foreach (slot, slots)
+                special = std::max(special, slot.first);
+            uint32_t normal((limit + PageSize_ - 1) / PageSize_);

 
             CodeDirectory directory;
             directory.version = Swap(uint32_t(0x00020001));
             directory.flags = Swap(uint32_t(0));
 
             CodeDirectory directory;
             directory.version = Swap(uint32_t(0x00020001));
             directory.flags = Swap(uint32_t(0));

-            directory.hashOffset = Swap(uint32_t(sizeof(blob) + sizeof(CodeDirectory) + strlen(name) + 1 + SHA_DIGEST_LENGTH * special));
-            directory.identOffset = Swap(uint32_t(sizeof(blob) + sizeof(CodeDirectory)));
+            directory.hashOffset = Swap(uint32_t(sizeof(Blob) + sizeof(CodeDirectory) + name.size() + 1 + SHA_DIGEST_LENGTH * special));
+            directory.identOffset = Swap(uint32_t(sizeof(Blob) + sizeof(CodeDirectory)));

             directory.nSpecialSlots = Swap(special);
             directory.codeLimit = Swap(uint32_t(limit));
             directory.nCodeSlots = Swap(normal);
             directory.hashSize = SHA_DIGEST_LENGTH;
             directory.hashType = CS_HASHTYPE_SHA1;
             directory.spare1 = 0x00;
             directory.nSpecialSlots = Swap(special);
             directory.codeLimit = Swap(uint32_t(limit));
             directory.nCodeSlots = Swap(normal);
             directory.hashSize = SHA_DIGEST_LENGTH;
             directory.hashType = CS_HASHTYPE_SHA1;
             directory.spare1 = 0x00;

-            directory.pageSize = pageshift;
+            directory.pageSize = PageShift_;

             directory.spare2 = Swap(uint32_t(0));
             put(data, &directory, sizeof(directory));
 
             directory.spare2 = Swap(uint32_t(0));
             put(data, &directory, sizeof(directory));
 

-            put(data, name, strlen(name) + 1);
+            put(data, name.c_str(), name.size() + 1);

 
             uint8_t storage[special + normal][SHA_DIGEST_LENGTH];
             uint8_t (*hashes)[SHA_DIGEST_LENGTH] = storage + special;
 
             uint8_t storage[special + normal][SHA_DIGEST_LENGTH];
             uint8_t (*hashes)[SHA_DIGEST_LENGTH] = storage + special;


@@ -1227,53 +1388,54 @@ void resign(void *idata, size_t isize, std::streambuf &output, const char *name,
                 sha1((uint8_t *) (hashes - blob.first), local, Swap(local->length));
             }
 
                 sha1((uint8_t *) (hashes - blob.first), local, Swap(local->length));
             }
 

+            _foreach (slot, slots) {
+                _assert(sizeof(*hashes) == slot.second.size());
+                memcpy(hashes - slot.first, slot.second.data(), slot.second.size());
+            }
+

             if (normal != 1)
                 for (size_t i = 0; i != normal - 1; ++i)
             if (normal != 1)
                 for (size_t i = 0; i != normal - 1; ++i)

-                    sha1(hashes[i], (pagesize * i < overlap.size() ? overlap.data() : top) + pagesize * i, pagesize);
+                    sha1(hashes[i], (PageSize_ * i < overlap.size() ? overlap.data() : top) + PageSize_ * i, PageSize_);

             if (normal != 0)
             if (normal != 0)

-                sha1(hashes[normal - 1], top + pagesize * (normal - 1), ((limit - 1) % pagesize) + 1);
+                sha1(hashes[normal - 1], top + PageSize_ * (normal - 1), ((limit - 1) % PageSize_) + 1);

 
             put(data, storage, sizeof(storage));
 
 
             put(data, storage, sizeof(storage));
 

-            blobs.insert(std::make_pair(CSSLOT_CODEDIRECTORY, data.str()));
+            insert(blobs, CSSLOT_CODEDIRECTORY, CSMAGIC_CODEDIRECTORY, data);

         }
 
         }
 

-        size_t total(0);
-        _foreach (blob, blobs)
-            total += blob.second.size();
+        if (!key.empty()) {
+            std::stringbuf data;
+            const std::string &sign(blobs[CSSLOT_CODEDIRECTORY]);

 
 

-        struct SuperBlob super;
-        super.blob.magic = Swap(CSMAGIC_EMBEDDED_SIGNATURE);
-        super.blob.length = Swap(uint32_t(sizeof(SuperBlob) + blobs.size() * sizeof(BlobIndex) + total));
-        super.count = Swap(uint32_t(blobs.size()));
-        put(output, &super, sizeof(super));
+            Stuff stuff(key);
+            Buffer bio(sign);

 
 

-        size_t offset(sizeof(SuperBlob) + sizeof(BlobIndex) * blobs.size());
+            Signature signature(stuff, sign);
+            Buffer result(signature);
+            std::string value(result);
+            put(data, value.data(), value.size());

 
 

-        _foreach (blob, blobs) {
-            BlobIndex index;
-            index.type = Swap(blob.first);
-            index.offset = Swap(uint32_t(offset));
-            put(output, &index, sizeof(index));
-            offset += blob.second.size();
+            insert(blobs, CSSLOT_SIGNATURESLOT, CSMAGIC_BLOBWRAPPER, data);

         }
 
         }
 

-        _foreach (blob, blobs)
-            put(output, blob.second.data(), blob.second.size());
-
-        return offset;
+        return put(output, CSMAGIC_EMBEDDED_SIGNATURE, blobs);

     }));
 }
 
     }));
 }
 

-void resign(void *idata, size_t isize, std::streambuf &output) {
-    resign(idata, isize, output, fun([](size_t size) -> size_t {
+static void Unsign(void *idata, size_t isize, std::streambuf &output) {
+    Allocate(idata, isize, output, fun([](size_t size) -> size_t {

         return 0;
     }), fun([](std::streambuf &output, size_t limit, const std::string &overlap, const char *top) -> size_t {
         return 0;
     }));
 }
 
         return 0;
     }), fun([](std::streambuf &output, size_t limit, const std::string &overlap, const char *top) -> size_t {
         return 0;
     }));
 }
 

-int main(int argc, const char *argv[]) {
+}
+
+int main(int argc, char *argv[]) {
+    OpenSSL_add_all_algorithms();
+

     union {
         uint16_t word;
         uint8_t byte[2];
     union {
         uint16_t word;
         uint8_t byte[2];


@@ -1303,6 +1465,8 @@ int main(int argc, const char *argv[]) {
     uint32_t timev(0);
 
     Map entitlements;
     uint32_t timev(0);
 
     Map entitlements;

+    Map key;
+    ldid::Slots slots;

 
     std::vector<std::string> files;
 
 
     std::vector<std::string> files;
 


@@ -1318,14 +1482,33 @@ int main(int argc, const char *argv[]) {
         if (argv[argi][0] != '-')
             files.push_back(argv[argi]);
         else switch (argv[argi][1]) {
         if (argv[argi][0] != '-')
             files.push_back(argv[argi]);
         else switch (argv[argi][1]) {

-            case 'r': flag_r = true; break;
+            case 'r':
+                _assert(!flag_s);
+                _assert(!flag_S);
+                flag_r = true;
+            break;
+

             case 'e': flag_e = true; break;
 
             case 'e': flag_e = true; break;
 

+            case 'E': {
+                const char *slot = argv[argi] + 2;
+                const char *colon = strchr(slot, ':');
+                _assert(colon != NULL);
+                Map file(colon + 1, O_RDONLY, PROT_READ, MAP_PRIVATE);
+                char *arge;
+                unsigned number(strtoul(slot, &arge, 0));
+                _assert(arge == colon);
+                std::string &hash(slots[number]);
+                hash.resize(SHA_DIGEST_LENGTH);
+                sha1(reinterpret_cast<uint8_t *>(&hash[0]), file.data(), file.size());
+            } break;
+

             case 'D': flag_D = true; break;
 
             case 'a': flag_a = true; break;
 
             case 'A':
             case 'D': flag_D = true; break;
 
             case 'a': flag_a = true; break;
 
             case 'A':

+                _assert(!flag_A);

                 flag_A = true;
                 if (argv[argi][2] != '\0') {
                     const char *cpu = argv[argi] + 2;
                 flag_A = true;
                 if (argv[argi][2] != '\0') {
                     const char *cpu = argv[argi] + 2;


@@ -1340,11 +1523,13 @@ int main(int argc, const char *argv[]) {
             break;
 
             case 's':
             break;
 
             case 's':

+                _assert(!flag_r);

                 _assert(!flag_S);
                 flag_s = true;
             break;
 
             case 'S':
                 _assert(!flag_S);
                 flag_s = true;
             break;
 
             case 'S':

+                _assert(!flag_r);

                 _assert(!flag_s);
                 flag_S = true;
                 if (argv[argi][2] != '\0') {
                 _assert(!flag_s);
                 flag_S = true;
                 if (argv[argi][2] != '\0') {


@@ -1353,6 +1538,10 @@ int main(int argc, const char *argv[]) {
                 }
             break;
 
                 }
             break;
 

+            case 'K':
+                key.open(argv[argi] + 2, O_RDONLY, PROT_READ, MAP_PRIVATE);
+            break;
+

             case 'T': {
                 flag_T = true;
                 if (argv[argi][2] == '-')
             case 'T': {
                 flag_T = true;
                 if (argv[argi][2] == '-')


@@ -1373,7 +1562,8 @@ int main(int argc, const char *argv[]) {
             break;
         }
 
             break;
         }
 

-    _assert(!flag_S || !flag_r);
+    _assert(flag_S || key.empty());
+    _assert(flag_S || flag_I == NULL);

 
     if (files.empty()) usage: {
         exit(0);
 
     if (files.empty()) usage: {
         exit(0);


@@ -1382,32 +1572,40 @@ int main(int argc, const char *argv[]) {
     size_t filei(0), filee(0);
     _foreach (file, files) try {
         const char *path(file.c_str());
     size_t filei(0), filee(0);
     _foreach (file, files) try {
         const char *path(file.c_str());

-        const char *base = strrchr(path, '/');
-
-        std::string dir;
-        if (base != NULL)
-            dir.assign(path, base++ - path + 1);
-        else
-            base = path;
-
-        const char *name(flag_I ?: base);
-        char *temp(NULL);

 
         if (flag_S || flag_r) {
             Map input(path, O_RDONLY, PROT_READ, MAP_PRIVATE);
 
 
         if (flag_S || flag_r) {
             Map input(path, O_RDONLY, PROT_READ, MAP_PRIVATE);
 

+            std::string dir;
+            const char *base = strrchr(path, '/');
+
+            if (base != NULL)
+                dir.assign(path, base++ - path + 1);
+            else
+                base = path;
+
+            std::string temp(dir + "." + base + ".cs");

             std::filebuf output;
             std::filebuf output;

-            asprintf(&temp, "%s.%s.cs", dir.c_str(), base);
-            _assert(output.open(temp, std::ios::out | std::ios::trunc | std::ios::binary) == &output);
+            _assert(output.open(temp.c_str(), std::ios::out | std::ios::trunc | std::ios::binary) == &output);

 
             if (flag_r)
 
             if (flag_r)

-                resign(input.data(), input.size(), output);
+                ldid::Unsign(input.data(), input.size(), output);

             else {
             else {

-                resign(input.data(), input.size(), output, name, entitlements);
+                const char *name(flag_I ?: base);
+                ldid::Sign(input.data(), input.size(), output, name, entitlements, key, slots);

             }
             }

+
+            struct stat info;
+            _syscall(stat(path, &info));
+#ifndef __WIN32__
+            _syscall(chown(temp.c_str(), info.st_uid, info.st_gid));
+#endif
+            _syscall(chmod(temp.c_str(), info.st_mode));
+            _syscall(unlink(path));
+            _syscall(rename(temp.c_str(), path));

         }
 
         }
 

-        Map mapping(temp ?: path, flag_T || flag_s);
+        Map mapping(path, flag_T || flag_s);

         FatHeader fat_header(mapping.data(), mapping.size());
 
         _foreach (mach_header, fat_header.GetMachHeaders()) {
         FatHeader fat_header(mapping.data(), mapping.size());
 
         _foreach (mach_header, fat_header.GetMachHeaders()) {


@@ -1468,7 +1666,7 @@ int main(int argc, const char *argv[]) {
                     if (Swap(super->index[index].type) == CSSLOT_ENTITLEMENTS) {
                         uint32_t begin = Swap(super->index[index].offset);
                         struct Blob *entitlements = reinterpret_cast<struct Blob *>(blob + begin);
                     if (Swap(super->index[index].type) == CSSLOT_ENTITLEMENTS) {
                         uint32_t begin = Swap(super->index[index].offset);
                         struct Blob *entitlements = reinterpret_cast<struct Blob *>(blob + begin);

-                        fwrite(entitlements + 1, 1, Swap(entitlements->length) - sizeof(struct Blob), stdout);
+                        fwrite(entitlements + 1, 1, Swap(entitlements->length) - sizeof(*entitlements), stdout);

                     }
             }
 
                     }
             }
 


@@ -1491,23 +1689,13 @@ int main(int argc, const char *argv[]) {
 
                         if (pages != 1)
                             for (size_t i = 0; i != pages - 1; ++i)
 
                         if (pages != 1)
                             for (size_t i = 0; i != pages - 1; ++i)

-                                sha1(hashes[i], top + 0x1000 * i, 0x1000);
+                                sha1(hashes[i], top + PageSize_ * i, PageSize_);

                         if (pages != 0)
                         if (pages != 0)

-                            sha1(hashes[pages - 1], top + 0x1000 * (pages - 1), ((data - 1) % 0x1000) + 1);
+                            sha1(hashes[pages - 1], top + PageSize_ * (pages - 1), ((data - 1) % PageSize_) + 1);

                     }
             }
         }
 
                     }
             }
         }
 

-        if (temp != NULL) {
-            struct stat info;
-            _syscall(stat(path, &info));
-            _syscall(chown(temp, info.st_uid, info.st_gid));
-            _syscall(chmod(temp, info.st_mode));
-            _syscall(unlink(path));
-            _syscall(rename(temp, path));
-            free(temp);
-        }
-

         ++filei;
     } catch (const char *) {
         ++filee;
         ++filei;
     } catch (const char *) {
         ++filee;