Visual FoxPro Requires Chilkat v11.7.0+

Verify an EXE or DLL that has Extra Data in its Certificate Table

See more Code Signing Examples

Starting in Chilkat v11.7.0, verifying the Authenticode signature of an EXE or DLL includes a strict check of the PE certificate table, which is not covered by the signature (see CVE-2013-3900). A file with extra data there fails verification. This example shows the codesign-allow-cert-padding option of UncommonOptions, which accepts such a file when it is known to carry the data on purpose, as some installers do. Visual FoxPro

LOCAL lnSuccess
LOCAL lcPath
LOCAL loCodeSign
LOCAL loSigInfo
LOCAL lnValid

lnSuccess = 0

*  This example requires the Chilkat API to have been previously unlocked.
*  See Global Unlock Sample for sample code.

*  The Authenticode signature of an EXE or DLL is stored in the certificate table of the PE file.
*  The certificate table itself is not covered by the signature, so data can be added to it
*  after the file is signed without invalidating the signature (see CVE-2013-3900).
*  
*  Starting in Chilkat v11.7.0, VerifySignature checks the certificate table strictly: it must hold
*  exactly one signature entry, containing exactly the signature that was verified, with no extra data.
*  A file that fails this check is not verified, because anything hidden there is unsigned.

lcPath = "C:/someDir/SomeInstaller.exe"

loCodeSign = CreateObject('Chilkat.CodeSign')
loSigInfo = CreateObject('Chilkat.JsonObject')

lnValid = loCodeSign.VerifySignature(lcPath,loSigInfo)
IF (lnValid = 1) THEN
    ? "The Authenticode signature is valid."
    RELEASE loCodeSign
    RELEASE loSigInfo
    CANCEL
ENDIF

*  The LastErrorText explains why the verification failed.
? loCodeSign.LastErrorText

*  Some installers store configuration data in the certificate table on purpose.
*  If the file is known to be one of these, the codesign-allow-cert-padding option
*  prevents the verification from failing because of the certificate table check alone.
*  
*  The option relaxes only this one check.  The file is still required to match its signature,
*  and the signing certificate is still validated.  Use it only for files that are known to carry such data.
loCodeSign.UncommonOptions = "codesign-allow-cert-padding"

lnValid = loCodeSign.VerifySignature(lcPath,loSigInfo)
IF (lnValid = 0) THEN
    *  The file failed for a reason other than the certificate table check.
    ? loCodeSign.LastErrorText
    RELEASE loCodeSign
    RELEASE loSigInfo
    CANCEL
ENDIF

? "The signature is valid, apart from the extra data in the certificate table."
*  The failed certificate table check is still reported in the LastErrorText.
? loCodeSign.LastErrorText

RELEASE loCodeSign
RELEASE loSigInfo