CODEWITHSUNDEEP
c++winapicryptographyauthenticode
Brian Gillespie
Brian Gillespie

Reputation: 3273

Validate Authenticode signature on EXE - C++ without CAPICOM

I'm writing a function for an installer DLL to verify the Authenticode signature of EXE files already installed on the system.

The function needs to:

A) verify that the signature is valid.
B) verify that the signer is our organization.

Because this is in an installer, and because this needs to run on older Win2k installations, I don't want to rely on CAPICOM.dll, as it may not be on the target system.

The WinVerifyTrust API works great to solve (A).

I need to find a way to compare a known certificate (or properties therein) to the one that signed the EXE in question.

Upvotes: 16

Views: 14250

Answers (2)

Rasmus Faber
Rasmus Faber

Reputation: 49677

You should use CryptQueryObject.

This KB-article demonstrates the use: How To Get Information from Authenticode Signed Executables.

To the commenter that asked about how to do it without the Windows-APIs, I am not aware of any library that can do it, but the format is documented here: Windows Authenticode Portable Executable Signature Format

Upvotes: 25

MSalters
MSalters

Reputation: 180145

If the signature is valid, its certificate chain will contain your certificate. CertGetCertificateChain will get that chain.

Upvotes: 0

Related Questions