@@ -255,6 +255,7 @@ void help(void)

     mprintf("    --detect-broken[=yes/no(*)]          Try to detect broken executable files\n");

     mprintf("    --block-encrypted[=yes/no(*)]        Block encrypted archives\n");

     mprintf("    --nocerts                            Disable authenticode certificate chain verification in PE files\n");

+    mprintf("    --dumpcerts                          Dump authenticode certificate chain in PE files\n");

     mprintf("\n");

     mprintf("    --max-filesize=#n                    Files larger than this will be skipped and assumed clean\n");

     mprintf("    --max-scansize=#n                    The maximum amount of data to scan for each container file (**)\n");

@@ -697,6 +697,9 @@ int scanmanager(const struct optstruct *opts)

     if (optget(opts, "nocerts")->enabled)

         engine->dconf->pe |= PE_CONF_DISABLECERT;

+    if (optget(opts, "dumpcerts")->enabled)

+        engine->dconf->pe |= PE_CONF_DUMPCERT;

+

     /* set limits */

     if((opt = optget(opts, "max-scansize"))->active) {

@@ -740,7 +740,7 @@ static int asn1_get_x509(fmap_t *map, const void **asn1data, unsigned int *size,

     return 1;

 }

-static int asn1_parse_mscat(fmap_t *map, size_t offset, unsigned int size, crtmgr *cmgr, int embedded, const void **hashes, unsigned int *hashes_size) {

+static int asn1_parse_mscat(fmap_t *map, size_t offset, unsigned int size, crtmgr *cmgr, int embedded, const void **hashes, unsigned int *hashes_size, struct cl_engine *engine) {

     struct cli_asn1 asn1, deep, deeper;

     uint8_t sha1[SHA1_HASH_SIZE], issuer[SHA1_HASH_SIZE], md[SHA1_HASH_SIZE], serial[SHA1_HASH_SIZE];

     const uint8_t *message, *attrs;

@@ -840,6 +840,21 @@ static int asn1_parse_mscat(fmap_t *map, size_t offset, unsigned int size, crtmg

 		x509 = newcerts.crts;

 		cli_dbgmsg("asn1_parse_mscat: %u new certificates collected\n", newcerts.items);

 		while(x509) {

+            if (engine->dconf->pe & PE_CONF_DUMPCERT) {

+                char issuer[SHA1_HASH_SIZE*2+1], subject[SHA1_HASH_SIZE*2+1], serial[SHA1_HASH_SIZE*2+1];

+                char mod[1024], exp[1024];

+                int j=1024;

+

+                fp_toradix_n(&x509->n, mod, 16, j);

+                fp_toradix_n(&x509->e, exp, 16, j);

+                for (j=0; j < SHA1_HASH_SIZE; j++) {

+                    sprintf(&issuer[j*2], "%02x", x509->issuer[j]);

+                    sprintf(&subject[j*2], "%02x", x509->subject[j]);

+                    sprintf(&serial[j*2], "%02x", x509->serial[j]);

+                }

+

+                cli_dbgmsg_internal("cert subject:%s serial:%s pubkey:%s i:%s %lu->%lu %s %s %s\n", subject, serial, mod, issuer, (unsigned long)x509->not_before, (unsigned long)x509->not_after, x509->certSign ? "cert" : "", x509->codeSign ? "code" : "", x509->timeSign ? "time" : "");

+            }

 		    cli_crt *parent = crtmgr_verify_crt(cmgr, x509);

 		    if(parent) {

                 if (parent->isBlacklisted)

@@ -1297,7 +1312,7 @@ int asn1_load_mscat(fmap_t *map, struct cl_engine *engine) {

     struct cli_matcher *db;

     int i;

-    if(asn1_parse_mscat(map, 0, map->len, &engine->cmgr, 0, &c.next, &size))

+    if(asn1_parse_mscat(map, 0, map->len, &engine->cmgr, 0, &c.next, &size, engine))

         return 1;

     if(asn1_expect_objtype(map, c.next, &size, &c, 0x30))

@@ -1454,7 +1469,7 @@ int asn1_check_mscat(struct cl_engine *engine, fmap_t *map, size_t offset, unsig

 	crtmgr_free(&certs);

 	return CL_VIRUS;

     }

-    ret = asn1_parse_mscat(map, offset, size, &certs, 1, &content, &content_size);

+    ret = asn1_parse_mscat(map, offset, size, &certs, 1, &content, &content_size, engine);

     crtmgr_free(&certs);

     if(ret)

 	return CL_VIRUS;

@@ -137,24 +137,6 @@ int crtmgr_add(crtmgr *m, cli_crt *x509) {

 	m->crts->prev = i;

     m->crts = i;

-    if(cli_debug_flag) {

-        char issuer[SHA1_HASH_SIZE*2+1], subject[SHA1_HASH_SIZE*2+1], serial[SHA1_HASH_SIZE*2+1];

-        char mod[1024], exp[1024];

-        int j=1024;

-        // mod first

-        fp_toradix_n(&i->n, mod, 16, j);

-        // exp next

-        fp_toradix_n(&i->e, exp, 16, j);

-        // subject and issuer hashes

-        for(j=0; j<SHA1_HASH_SIZE; j++) {

-            sprintf(&issuer[j*2], "%02x", i->issuer[j]);

-            sprintf(&subject[j*2], "%02x", i->subject[j]);

-            sprintf(&serial[j*2], "%02x", i->serial[j]);

-        }

-        // printing lines, broken up to minimize truncation

-        cli_dbgmsg("crtmgr_add: added cert subject:%s serial:%s pubkey:%s i:%s %lu->%lu %s%s%s\n", subject, serial, mod, issuer, (unsigned long)i->not_before, (unsigned long)i->not_after, i->certSign ? "cert ":"", i->codeSign ? "code ":"", i->timeSign ? "time":"");

-        cli_dbgmsg("crtmgr_add: e:%s \n", exp);

-    }

     m->items++;

     return 0;

 }

@@ -72,6 +72,7 @@ static struct dconf_module modules[] = {

     { "PE",	    "ASPACK",	    PE_CONF_ASPACK,	    1 },

     { "PE",	    "CATALOG",	    PE_CONF_CATALOG,	    1 },

     { "PE",     "DISABLECERT",  PE_CONF_DISABLECERT,    0 },

+    { "PE",     "DUMPCERT",     PE_CONF_DUMPCERT,       0 },

     { "ELF",	    NULL,	    0x1,		    1 },

@@ -61,6 +61,7 @@ struct cli_dconf {

 #define PE_CONF_ASPACK	    0x8000

 #define PE_CONF_CATALOG	    0x10000

 #define PE_CONF_DISABLECERT 0x20000

+#define PE_CONF_DUMPCERT    0x40000

 /* Archive flags */

 #define ARCH_CONF_RAR	    0x1

@@ -68,6 +68,7 @@ const struct clam_option __clam_options[] = {

     { NULL, "version", 'V', TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_FRESHCLAM | OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_SIGTOOL | OPT_MILTER | OPT_CLAMCONF | OPT_CLAMDTOP | OPT_CLAMBC, "", "" },

     { NULL, "debug", 0, TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMBC | OPT_CLAMD | OPT_FRESHCLAM | OPT_CLAMSCAN | OPT_SIGTOOL, "", "" },

     { NULL, "verbose", 'v', TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_FRESHCLAM | OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_SIGTOOL, "", "" },

+    { NULL, "dumpcerts", 0, TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMSCAN, "Dump authenticode certificate chain.", "" },

     { NULL, "quiet", 0, TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_FRESHCLAM | OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_SIGTOOL, "", "" },

     { NULL, "leave-temps", 0, TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMSCAN, "", "" },

     { NULL, "no-warnings", 0, TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_FRESHCLAM, "", "" },