335 lines
11 KiB
JSON
335 lines
11 KiB
JSON
{
|
|
"schema_version": 1,
|
|
"scope": "Observed named PE exports in exact x64 ci.dll samples; not runtime or ABI certification",
|
|
"generated_from": {
|
|
"corpus-index.json": "c324dddaa4b88e66eb119e2ce26023face3763fb68d496d6285b836a60d267f8",
|
|
"iso-corpus-index.json": "1b5f95e4ef2eb6aa6e7d0414cd5a899426ff7092e1ef8afb65f3b50f958bc6dc",
|
|
"manifest.json": "7712d6e88b81ac155bd1371ada61df2848e943a12abe709b7b2050ce4b91c6e5",
|
|
"ci-26100.8328-evidence.json": "ea0f939df9d8b7abde40e3402c01b2ac398253728f329e8c2b7134de8df6305f"
|
|
},
|
|
"apis": [
|
|
"CiCheckSignedFile",
|
|
"CiFindPageHashesInCatalog",
|
|
"CiFindPageHashesInSignedFile",
|
|
"CiFreePolicyInfo",
|
|
"CiGetCertPublisherName",
|
|
"CiGetPEInformation",
|
|
"CiInitialize",
|
|
"CiSetTrustedOriginClaimId",
|
|
"CiValidateFileObject",
|
|
"CiVerifyHashInCatalog"
|
|
],
|
|
"samples": [
|
|
{
|
|
"label": "Windows 10 1507",
|
|
"ci_file_version": "10.0.10240.16463",
|
|
"architecture": "x64",
|
|
"sha256": "e83d900f4675c6e6ffc3fb7dcd3074610876a1398e495796769988df810fd3bc",
|
|
"source": "corpus-index.json",
|
|
"named_exports": [
|
|
"CiCheckSignedFile",
|
|
"CiFindPageHashesInCatalog",
|
|
"CiFindPageHashesInSignedFile",
|
|
"CiFreePolicyInfo",
|
|
"CiGetPEInformation",
|
|
"CiInitialize",
|
|
"CiValidateFileObject",
|
|
"CiVerifyHashInCatalog"
|
|
],
|
|
"ordinal_only_export_count": 3,
|
|
"api_presence": {
|
|
"CiCheckSignedFile": true,
|
|
"CiFindPageHashesInCatalog": true,
|
|
"CiFindPageHashesInSignedFile": true,
|
|
"CiFreePolicyInfo": true,
|
|
"CiGetCertPublisherName": false,
|
|
"CiGetPEInformation": true,
|
|
"CiInitialize": true,
|
|
"CiSetTrustedOriginClaimId": false,
|
|
"CiValidateFileObject": true,
|
|
"CiVerifyHashInCatalog": true
|
|
}
|
|
},
|
|
{
|
|
"label": "Windows 10 1511",
|
|
"ci_file_version": "10.0.10586.0",
|
|
"architecture": "x64",
|
|
"sha256": "f949bfa614addea6174b28c3818c56b327c9290fd41bd91dfc545414b3df6783",
|
|
"source": "corpus-index.json",
|
|
"named_exports": [
|
|
"CiCheckSignedFile",
|
|
"CiFindPageHashesInCatalog",
|
|
"CiFindPageHashesInSignedFile",
|
|
"CiFreePolicyInfo",
|
|
"CiGetPEInformation",
|
|
"CiInitialize",
|
|
"CiValidateFileObject",
|
|
"CiVerifyHashInCatalog"
|
|
],
|
|
"ordinal_only_export_count": 3,
|
|
"api_presence": {
|
|
"CiCheckSignedFile": true,
|
|
"CiFindPageHashesInCatalog": true,
|
|
"CiFindPageHashesInSignedFile": true,
|
|
"CiFreePolicyInfo": true,
|
|
"CiGetCertPublisherName": false,
|
|
"CiGetPEInformation": true,
|
|
"CiInitialize": true,
|
|
"CiSetTrustedOriginClaimId": false,
|
|
"CiValidateFileObject": true,
|
|
"CiVerifyHashInCatalog": true
|
|
}
|
|
},
|
|
{
|
|
"label": "Windows 10 1607",
|
|
"ci_file_version": "10.0.14393.2189",
|
|
"architecture": "x64",
|
|
"sha256": "ef0c02ecbd0818e84be9f61421f919825f96a3c59199460cab08548eee2881df",
|
|
"source": "corpus-index.json",
|
|
"named_exports": [
|
|
"CiCheckSignedFile",
|
|
"CiFindPageHashesInCatalog",
|
|
"CiFindPageHashesInSignedFile",
|
|
"CiFreePolicyInfo",
|
|
"CiGetPEInformation",
|
|
"CiInitialize",
|
|
"CiValidateFileObject",
|
|
"CiVerifyHashInCatalog"
|
|
],
|
|
"ordinal_only_export_count": 3,
|
|
"api_presence": {
|
|
"CiCheckSignedFile": true,
|
|
"CiFindPageHashesInCatalog": true,
|
|
"CiFindPageHashesInSignedFile": true,
|
|
"CiFreePolicyInfo": true,
|
|
"CiGetCertPublisherName": false,
|
|
"CiGetPEInformation": true,
|
|
"CiInitialize": true,
|
|
"CiSetTrustedOriginClaimId": false,
|
|
"CiValidateFileObject": true,
|
|
"CiVerifyHashInCatalog": true
|
|
}
|
|
},
|
|
{
|
|
"label": "Windows 10 1703",
|
|
"ci_file_version": "10.0.15063.0",
|
|
"architecture": "x64",
|
|
"sha256": "3705aaf408f05326e028621380aa5c96a1f3583a2de8a139b188da4b82577863",
|
|
"source": "corpus-index.json",
|
|
"named_exports": [
|
|
"CiCheckSignedFile",
|
|
"CiFindPageHashesInCatalog",
|
|
"CiFindPageHashesInSignedFile",
|
|
"CiFreePolicyInfo",
|
|
"CiGetPEInformation",
|
|
"CiInitialize",
|
|
"CiSetTrustedOriginClaimId",
|
|
"CiValidateFileObject",
|
|
"CiVerifyHashInCatalog"
|
|
],
|
|
"ordinal_only_export_count": 3,
|
|
"api_presence": {
|
|
"CiCheckSignedFile": true,
|
|
"CiFindPageHashesInCatalog": true,
|
|
"CiFindPageHashesInSignedFile": true,
|
|
"CiFreePolicyInfo": true,
|
|
"CiGetCertPublisherName": false,
|
|
"CiGetPEInformation": true,
|
|
"CiInitialize": true,
|
|
"CiSetTrustedOriginClaimId": true,
|
|
"CiValidateFileObject": true,
|
|
"CiVerifyHashInCatalog": true
|
|
}
|
|
},
|
|
{
|
|
"label": "Windows 10 1709",
|
|
"ci_file_version": "10.0.16299.125",
|
|
"architecture": "x64",
|
|
"sha256": "1db7ae5a08bd2361fc7fcdd373fb980e8d680035e67b02e5967095db0443effd",
|
|
"source": "corpus-index.json",
|
|
"named_exports": [
|
|
"CiCheckSignedFile",
|
|
"CiFindPageHashesInCatalog",
|
|
"CiFindPageHashesInSignedFile",
|
|
"CiFreePolicyInfo",
|
|
"CiGetPEInformation",
|
|
"CiInitialize",
|
|
"CiSetTrustedOriginClaimId",
|
|
"CiValidateFileObject",
|
|
"CiVerifyHashInCatalog"
|
|
],
|
|
"ordinal_only_export_count": 3,
|
|
"api_presence": {
|
|
"CiCheckSignedFile": true,
|
|
"CiFindPageHashesInCatalog": true,
|
|
"CiFindPageHashesInSignedFile": true,
|
|
"CiFreePolicyInfo": true,
|
|
"CiGetCertPublisherName": false,
|
|
"CiGetPEInformation": true,
|
|
"CiInitialize": true,
|
|
"CiSetTrustedOriginClaimId": true,
|
|
"CiValidateFileObject": true,
|
|
"CiVerifyHashInCatalog": true
|
|
}
|
|
},
|
|
{
|
|
"label": "Windows 10 1803",
|
|
"ci_file_version": "10.0.17134.1130",
|
|
"architecture": "x64",
|
|
"sha256": "8ce3b8fe38c23b699f30b045383640019a429d3a9d513285c655bffe03a796d9",
|
|
"source": "corpus-index.json",
|
|
"named_exports": [
|
|
"CiCheckSignedFile",
|
|
"CiFindPageHashesInCatalog",
|
|
"CiFindPageHashesInSignedFile",
|
|
"CiFreePolicyInfo",
|
|
"CiGetPEInformation",
|
|
"CiInitialize",
|
|
"CiSetTrustedOriginClaimId",
|
|
"CiValidateFileObject",
|
|
"CiVerifyHashInCatalog"
|
|
],
|
|
"ordinal_only_export_count": 3,
|
|
"api_presence": {
|
|
"CiCheckSignedFile": true,
|
|
"CiFindPageHashesInCatalog": true,
|
|
"CiFindPageHashesInSignedFile": true,
|
|
"CiFreePolicyInfo": true,
|
|
"CiGetCertPublisherName": false,
|
|
"CiGetPEInformation": true,
|
|
"CiInitialize": true,
|
|
"CiSetTrustedOriginClaimId": true,
|
|
"CiValidateFileObject": true,
|
|
"CiVerifyHashInCatalog": true
|
|
}
|
|
},
|
|
{
|
|
"label": "Windows 10 2004 ISO",
|
|
"ci_file_version": "10.0.19041.1",
|
|
"architecture": "x64",
|
|
"sha256": "2955710d34db26e352e62b20861ba338f0216cc36b378d128057be955e184282",
|
|
"source": "iso-corpus-index.json",
|
|
"named_exports": [
|
|
"CiCheckSignedFile",
|
|
"CiFindPageHashesInCatalog",
|
|
"CiFindPageHashesInSignedFile",
|
|
"CiFreePolicyInfo",
|
|
"CiGetPEInformation",
|
|
"CiInitialize",
|
|
"CiSetTrustedOriginClaimId",
|
|
"CiValidateFileObject",
|
|
"CiVerifyHashInCatalog"
|
|
],
|
|
"ordinal_only_export_count": 3,
|
|
"api_presence": {
|
|
"CiCheckSignedFile": true,
|
|
"CiFindPageHashesInCatalog": true,
|
|
"CiFindPageHashesInSignedFile": true,
|
|
"CiFreePolicyInfo": true,
|
|
"CiGetCertPublisherName": false,
|
|
"CiGetPEInformation": true,
|
|
"CiInitialize": true,
|
|
"CiSetTrustedOriginClaimId": true,
|
|
"CiValidateFileObject": true,
|
|
"CiVerifyHashInCatalog": true
|
|
}
|
|
},
|
|
{
|
|
"label": "Windows 10 22H2 consumer ISO",
|
|
"ci_file_version": "10.0.19041.1865",
|
|
"architecture": "x64",
|
|
"sha256": "d0408a9f64eafb72e8aa1cf127d07d919f0cab38a6bdf2b406255909c85e3a8d",
|
|
"source": "iso-corpus-index.json",
|
|
"named_exports": [
|
|
"CiCheckSignedFile",
|
|
"CiFindPageHashesInCatalog",
|
|
"CiFindPageHashesInSignedFile",
|
|
"CiFreePolicyInfo",
|
|
"CiGetCertPublisherName",
|
|
"CiGetPEInformation",
|
|
"CiInitialize",
|
|
"CiSetTrustedOriginClaimId",
|
|
"CiValidateFileObject",
|
|
"CiVerifyHashInCatalog"
|
|
],
|
|
"ordinal_only_export_count": 3,
|
|
"api_presence": {
|
|
"CiCheckSignedFile": true,
|
|
"CiFindPageHashesInCatalog": true,
|
|
"CiFindPageHashesInSignedFile": true,
|
|
"CiFreePolicyInfo": true,
|
|
"CiGetCertPublisherName": true,
|
|
"CiGetPEInformation": true,
|
|
"CiInitialize": true,
|
|
"CiSetTrustedOriginClaimId": true,
|
|
"CiValidateFileObject": true,
|
|
"CiVerifyHashInCatalog": true
|
|
}
|
|
},
|
|
{
|
|
"label": "Windows 11 English x64 v1 ISO",
|
|
"ci_file_version": "10.0.22000.318",
|
|
"architecture": "x64",
|
|
"sha256": "301ae49ac5b87cf1cbe07d9d3c6486a066d045b6bf55fc8eb392d52951ec69ff",
|
|
"source": "iso-corpus-index.json",
|
|
"named_exports": [
|
|
"CiCheckSignedFile",
|
|
"CiFindPageHashesInCatalog",
|
|
"CiFindPageHashesInSignedFile",
|
|
"CiFreePolicyInfo",
|
|
"CiGetCertPublisherName",
|
|
"CiGetPEInformation",
|
|
"CiInitialize",
|
|
"CiSetTrustedOriginClaimId",
|
|
"CiValidateFileObject",
|
|
"CiVerifyHashInCatalog"
|
|
],
|
|
"ordinal_only_export_count": 3,
|
|
"api_presence": {
|
|
"CiCheckSignedFile": true,
|
|
"CiFindPageHashesInCatalog": true,
|
|
"CiFindPageHashesInSignedFile": true,
|
|
"CiFreePolicyInfo": true,
|
|
"CiGetCertPublisherName": true,
|
|
"CiGetPEInformation": true,
|
|
"CiInitialize": true,
|
|
"CiSetTrustedOriginClaimId": true,
|
|
"CiValidateFileObject": true,
|
|
"CiVerifyHashInCatalog": true
|
|
}
|
|
},
|
|
{
|
|
"label": "Windows 11 24H2 sample",
|
|
"ci_file_version": "10.0.26100.8328",
|
|
"architecture": "x64",
|
|
"sha256": "c7d23814f3202c51fb23e3ca3d4328855787383cee5d14c4a986a13ec2aeda0b",
|
|
"source": "ci-26100.8328-evidence.json",
|
|
"named_exports": [
|
|
"CiCheckSignedFile",
|
|
"CiFindPageHashesInCatalog",
|
|
"CiFindPageHashesInSignedFile",
|
|
"CiFreePolicyInfo",
|
|
"CiGetCertPublisherName",
|
|
"CiGetPEInformation",
|
|
"CiInitialize",
|
|
"CiSetTrustedOriginClaimId",
|
|
"CiValidateFileObject",
|
|
"CiVerifyHashInCatalog"
|
|
],
|
|
"ordinal_only_export_count": 3,
|
|
"api_presence": {
|
|
"CiCheckSignedFile": true,
|
|
"CiFindPageHashesInCatalog": true,
|
|
"CiFindPageHashesInSignedFile": true,
|
|
"CiFreePolicyInfo": true,
|
|
"CiGetCertPublisherName": true,
|
|
"CiGetPEInformation": true,
|
|
"CiInitialize": true,
|
|
"CiSetTrustedOriginClaimId": true,
|
|
"CiValidateFileObject": true,
|
|
"CiVerifyHashInCatalog": true
|
|
}
|
|
}
|
|
]
|
|
}
|