OrcLib: Authenticode: add cache for parsed catalogs

DFIR-ORC · May 5, 2023 · dab7e5a · dab7e5a
1 parent 3ab0882
commit dab7e5a
Show file tree

Hide file tree

Showing 7 changed files with 490 additions and 153 deletions.
diff --git a/src/OrcCommand/Command/NTFSInfo/NTFSInfo.h b/src/OrcCommand/Command/NTFSInfo/NTFSInfo.h
@@ -115,6 +115,7 @@ class ORCUTILS_API Main : public UtilitiesMain
     DWORD dwTotalFileTreated;
     DWORD m_dwProgress;
 
+    std::shared_ptr<AuthenticodeCache> m_authenticodeCache;
     Authenticode m_codeVerifier;
 
     HRESULT Prepare();
@@ -213,7 +214,11 @@ class ORCUTILS_API Main : public UtilitiesMain
         , m_TimeLineOutput()
         , m_AttrOutput()
         , m_I30Output()
-        , m_SecDescrOutput() {};
+        , m_SecDescrOutput()
+        , m_authenticodeCache(std::make_shared<AuthenticodeCache>())
+    {
+        m_codeVerifier.SetCache(m_authenticodeCache);
+    }
 
     // implemented in NTFSInfo_Output.cpp
     void PrintUsage();