验证 EXE 上的 Authenticode 签名 - 没有 CAPICOM 的 C++
我正在为安装程序 DLL 编写一个函数来验证系统上已安装的 EXE 文件的 Authenticode 签名.
I'm writing a function for an installer DLL to verify the Authenticode signature of EXE files already installed on the system.
函数需要:
A) 验证签名是否有效.
B) 验证签名者是我们的组织.
A) verify that the signature is valid.
B) verify that the signer is our organization.
因为它在安装程序中，并且因为它需要在较旧的 Win2k 安装上运行，所以我不想依赖 CAPICOM.dll，因为它可能不在目标系统上.
Because this is in an installer, and because this needs to run on older Win2k installations, I don't want to rely on CAPICOM.dll, as it may not be on the target system.
WinVerifyTrust API 非常适合解决(一).
The WinVerifyTrust API works great to solve (A).
我需要找到一种方法将已知证书(或其中的属性)与签署相关 EXE 的证书进行比较.
I need to find a way to compare a known certificate (or properties therein) to the one that signed the EXE in question.
推荐答案
你应该使用 CryptQueryObject.
此知识库文章演示了如何使用:如何从 Authenticode 签名的可执行文件中获取信息.
This KB-article demonstrates the use: How To Get Information from Authenticode Signed Executables.
对于询问如何在没有 Windows-API 的情况下执行此操作的评论者，我不知道有任何库可以做到这一点，但格式记录在这里:Windows Authenticode 可移植可执行签名格式
To the commenter that asked about how to do it without the Windows-APIs, I am not aware of any library that can do it, but the format is documented here: Windows Authenticode Portable Executable Signature Format
相关文章