|
Chilkat • HOME • .NET Core C# • Android™ • AutoIt • C • C# • C++ • Chilkat2-Python • CkPython • Classic ASP • DataFlex • Delphi ActiveX • Delphi DLL • Go • Java • Lianja • Mono C# • Node.js • Objective-C • PHP ActiveX • PHP Extension • Perl • PowerBuilder • PowerShell • PureBasic • Ruby • SQL Server • Swift 2 • Swift 3,4,5... • Tcl • Unicode C • Unicode C++ • VB.NET • VBScript • Visual Basic 6.0 • Visual FoxPro • Xojo Plugin
(DataFlex) Verify Authenticode Signature of EXE or DLLSee more Code Signing ExamplesDemonstrates how to verify an Authenticode signed EXE or DLL. Note: Chilkat's code signing class was added in v9.5.0.97
Use ChilkatAx-9.5.0-win32.pkg Procedure Test String sPath Variant vJson Handle hoJson Handle hoValidator Boolean iValid String sIssuerCN String sSerial Variant vGenTime Handle hoGenTime Handle hoDt Integer i Integer iCount_i Integer iNumSigners Boolean iSuccess String sTemp1 Boolean bTemp1 // This example requires the Chilkat API to have been previously unlocked. // See Global Unlock Sample for sample code. // You can verify a signed DLL or EXE. Move "c:/someDir/something.dll" To sPath // The verify method returns an overall indicator of whether // the EXE or DLL can be trusted or not. // The details of the signature are emitted to the JSON object // passed in the last argument. Get Create (RefClass(cComChilkatJsonObject)) To hoJson If (Not(IsComObjectCreated(hoJson))) Begin Send CreateComObject of hoJson End Set ComEmitCompact Of hoJson To False Get Create (RefClass(cComChilkatCodeSign)) To hoValidator If (Not(IsComObjectCreated(hoValidator))) Begin Send CreateComObject of hoValidator End Get pvComObject of hoJson to vJson Get ComVerifySignature Of hoValidator sPath vJson To iValid If (iValid = False) Begin // Validation failed. Get ComLastErrorText Of hoValidator To sTemp1 Showln sTemp1 // You can also examine the details of the validation (see below) Get ComEmit Of hoJson To sTemp1 Showln sTemp1 Procedure_Return End // Examine the details of the Authenticode signature // println json.Emit(); // An example of the JSON details of an authenticode signature, with selected parsing code, is shown below. // // Use this online tool to generate parsing code from sample JSON: // Generate Parsing Code from JSON // { // "pkcs7": { // "verify": { // "peFile": { // "hashOid": "2.16.840.1.101.3.4.2.1", // "hash": "q9tzWEcea8f8kaMXG8LpWNPe9JIW7aKccYWuL3mrCBw=" // }, // "certs": [ // { // "issuerCN": "AAA Certificate Services", // "serial": "48FC93B46055948D36A7C98A89D69416" // }, // { // "issuerCN": "Sectigo Public Code Signing Root R46", // "serial": "621D6D0C52019E3B9079152089211C0A" // }, // { // "issuerCN": "Sectigo Public Code Signing CA R36", // "serial": "3FF5B69109BFD4046C92CC0D18EE23C2" // } // ], // "digestAlgorithms": [ // "sha256" // ], // "signerInfo": [ // { // "cert": { // "serialNumber": "3FF5B69109BFD4046C92CC0D18EE23C2", // "issuerCN": "Sectigo Public Code Signing CA R36", // "digestAlgOid": "2.16.840.1.101.3.4.2.1", // "digestAlgName": "SHA256" // }, // "contentType": "1.3.6.1.4.1.311.2.1.4", // "messageDigest": "4MkPVkY4qdwoVAj5JcCvn3ISSS5yqtf1+KmIs/Ckni4=", // "signingAlgOid": "1.2.840.113549.1.1.1", // "signingAlgName": "RSA-PKCSV-1_5", // "authAttr": { // "1.3.6.1.4.1.311.2.1.12": { // "der": "MAA=" // }, // "1.2.840.113549.1.9.3": { // "name": "contentType", // "oid": "1.3.6.1.4.1.311.2.1.4" // }, // "1.3.6.1.4.1.311.2.1.11": { // "der": "MAwGCisGAQQBgjcCARU=" // }, // "1.2.840.113549.1.9.4": { // "name": "messageDigest", // "digest": "4MkPVkY4qdwoVAj5JcCvn3ISSS5yqtf1+KmIs/Ckni4=" // } // }, // "unauthAttr": { // "1.3.6.1.4.1.311.3.3.1": { // "name": "timestampToken", // "der": "MIIXJwY ... QZej", // "verify": { // "digestAlgorithms": [ // "sha256" // ], // "signerInfo": [ // { // "cert": { // "serialNumber": "0544AFF3949D0839A6BFDB3F5FE56116", // "issuerCN": "DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA", // "digestAlgOid": "2.16.840.1.101.3.4.2.1", // "digestAlgName": "SHA256" // }, // "contentType": "1.2.840.113549.1.9.16.1.4", // "signingTime": "240117124047Z", // "messageDigest": "y6cKjJoRfgJwW+Dj29w3tEfWqVybz7Sg+d8opKQxCjM=", // "signingAlgOid": "1.2.840.113549.1.1.1", // "signingAlgName": "RSA-PKCSV-1_5", // "authAttr": { // "1.2.840.113549.1.9.3": { // "name": "contentType", // "oid": "1.2.840.113549.1.9.16.1.4" // }, // "1.2.840.113549.1.9.5": { // "name": "signingTime", // "utctime": "240117124047Z" // }, // "1.2.840.113549.1.9.16.2.12": { // "name": "signingCertificate", // "der": "MBowGDAWBBRm8CsywsLJD4JdzqqKycZPGZzPQA==" // }, // "1.2.840.113549.1.9.4": { // "name": "messageDigest", // "digest": "y6cKjJoRfgJwW+Dj29w3tEfWqVybz7Sg+d8opKQxCjM=" // }, // "1.2.840.113549.1.9.16.2.47": { // "name": "signingCertificateV2", // "der": "MCYwJDAiBCDS9uRt7XQizNHUQFdoQTZvgoraVZquMxavTRqa1Ax4KA==" // } // } // } // ], // "uncommonOptions": "NO_SIGCERTV2_OID,NoSigningCertV2IssuerSerial" // }, // "timestampSignatureVerified": true, // "tstInfo": { // "tsaPolicyId": "2.16.840.1.114412.7.1", // "messageImprint": { // "hashAlg": "sha256", // "digest": "JqY7U+30qScMnRQwnDfUYEikZwOLHMhKX0oo5zo4ils=", // "digestMatches": true // }, // "serialNumber": "6E4597E574BC909213565DAEBC0E4888", // "genTime": "20240117124047Z" // } // } // } // } // ], // "pkcs7": { // "verify": { // "certs": [ // { // "issuerCN": "DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA", // "serial": "0544AFF3949D0839A6BFDB3F5FE56116" // }, // { // "issuerCN": "DigiCert Trusted Root G4", // "serial": "073637B724547CD847ACFD28662A5E5B" // }, // { // "issuerCN": "DigiCert Assured ID Root CA", // "serial": "0E9B188EF9D02DE7EFDB50E20840185A" // } // ] // } // } // } // } // } Get Create (RefClass(cComChilkatDtObj)) To hoGenTime If (Not(IsComObjectCreated(hoGenTime))) Begin Send CreateComObject of hoGenTime End Get Create (RefClass(cComCkDateTime)) To hoDt If (Not(IsComObjectCreated(hoDt))) Begin Send CreateComObject of hoDt End // Show the certificates embedded in the PKCS7 signature. Showln "Certificates contained in the PKCS7 signature:" Move 0 To i Get ComSizeOfArray Of hoJson "pkcs7.verify.certs" To iCount_i While (i < iCount_i) Set ComI Of hoJson To i Get ComStringOf Of hoJson "pkcs7.verify.certs[i].issuerCN" To sIssuerCN Get ComStringOf Of hoJson "pkcs7.verify.certs[i].serial" To sSerial Showln sIssuerCN ", " sSerial Move (i + 1) To i Loop // Show details about the signing certificate(s) Get ComSizeOfArray Of hoJson "pkcs7.verify.signerInfo" To iNumSigners Move 0 To i While (i < iNumSigners) Set ComI Of hoJson To i Showln "---- Signing Certificate ----" Get ComStringOf Of hoJson "pkcs7.verify.signerInfo[i].cert.serialNumber" To sTemp1 Showln "serial number: " sTemp1 Get ComStringOf Of hoJson "pkcs7.verify.signerInfo[i].cert.issuerCN" To sTemp1 Showln "issuerCN: " sTemp1 Get ComStringOf Of hoJson "pkcs7.verify.signerInfo[i].cert.digestAlgName" To sTemp1 Showln "hash algorithm: " sTemp1 Get ComStringOf Of hoJson "pkcs7.verify.signerInfo[i].signingAlgName" To sTemp1 Showln "signing algorithm: " sTemp1 // If this signature includes a timestamp token, get information about it. Get ComHasMember Of hoJson 'pkcs7.verify.signerInfo[i].unauthAttr."1.3.6.1.4.1.311.3.3.1"' To bTemp1 If (bTemp1 = True) Begin // We're going to assume the timestamp token had only 1 signer.. Showln "--- Timestamp Token ----" Get ComStringOf Of hoJson 'pkcs7.verify.signerInfo[i].unauthAttr."1.3.6.1.4.1.311.3.3.1".verify.digestAlgorithms[0]' To sTemp1 Showln "TS hash algorithm: " sTemp1 Get ComStringOf Of hoJson 'pkcs7.verify.signerInfo[i].unauthAttr."1.3.6.1.4.1.311.3.3.1".verify.signerInfo[0].cert.serialNumber' To sTemp1 Showln "TS certificate serial: " sTemp1 Get ComStringOf Of hoJson 'pkcs7.verify.signerInfo[i].unauthAttr."1.3.6.1.4.1.311.3.3.1".verify.signerInfo[0].cert.issuerCN' To sTemp1 Showln "TS certificate issuerCN: " sTemp1 Get ComBoolOf Of hoJson 'pkcs7.verify.signerInfo[i].unauthAttr."1.3.6.1.4.1.311.3.3.1".timestampSignatureVerified' To bTemp1 Showln "timestamp signature verified: " bTemp1 Get pvComObject of hoGenTime to vGenTime Get ComDtOf Of hoJson 'pkcs7.verify.signerInfo[i].unauthAttr."1.3.6.1.4.1.311.3.3.1".tstInfo.genTime' False vGenTime To iSuccess Get pvComObject of hoGenTime to vGenTime Get ComSetFromDtObj Of hoDt vGenTime To iSuccess Get ComGetAsRfc822 Of hoDt True To sTemp1 Showln "timestamp date/time: " sTemp1 End Move (i + 1) To i Loop Showln "The Authenticode signature is valid." // Sample output: // Certificates contained in the PKCS7 signature: // AAA Certificate Services, 48FC93B46055948D36A7C98A89D69416 // Sectigo Public Code Signing Root R46, 621D6D0C52019E3B9079152089211C0A // Sectigo Public Code Signing CA R36, 3FF5B69109BFD4046C92CC0D18EE23C2 // ---- Signing Certificate ---- // serial number: 3FF5B69109BFD4046C92CC0D18EE23C2 // issuerCN: Sectigo Public Code Signing CA R36 // hash algorithm: SHA256 // signing algorithm: RSA-PKCSV-1_5 // --- Timestamp Token ---- // TS hash algorithm: sha256 // TS certificate serial: 0544AFF3949D0839A6BFDB3F5FE56116 // TS certificate issuerCN: DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA // timestamp signature verified: True // timestamp date/time: Wed, 17 Jan 2024 06:40:47 -0600 // The Authenticode signature is valid. End_Procedure |
||||
© 2000-2024 Chilkat Software, Inc. All Rights Reserved.