Validate signature on EXE with CertGetCertificateChain

Question

I would like to verify a signed executable. The requirement is to validate that the executable itself is valid and where it came from (probably from the subject of the cert). The cert type is PKCS.

I found a similar posting here, http://stackoverflow.com/questions/301024/validate-authenticode-signature-on-exe-c-without-capicom

The Microsoft documentation, among others, appears to point to CertGetCertificateChain, but the examples tend to work with certificates that are in a store. Does anyone know how to validate a signed executable using CertGetCertificateChain and related API's?

Answer 1

can you elaborate? the question you linked to seems to provide all of the answers you should need.

you state that "the examples tend to work with certificates that are in a store", which i take to mean that the executable needs to be signed with a certificate that chains to a root certificate in the machine's trusted store.

this is true; there's no way around that, otherwise there is no way way to trust that the signer is who he says he is, and no way for the provider to revoke the certificate if it's being fraudulently used.

so, WinVerifyTrust is the right way to validate a signed executable. it's a terrible API so be careful. CryptQueryObject and related apis will give you more information such as the name of the person or company that the certificate was issued to.

~jewels

Answer 2

I asked this question some time ago. I had your exact requirements. There's sample code in there that will help you. Have fun!!