#Region ;**** Directives created by AutoIt3Wrapper_GUI **** #AutoIt3Wrapper_UseX64=y #EndRegion ;**** Directives created by AutoIt3Wrapper_GUI **** #RequireAdmin ; Author 1: progandy (http://www.autoit.de/index.php?page=Thread&postID=68477#post68477) ; Author 2: Kasty added support for catalogs, UTF-8 paths, WinVerifyTrust return values, Certificate serial number, owner and issuer. ; ; Example 1 (file with embedded signature, without catalogs): ; $filePath = ".\unsigned.exe" ; $signed = False ; If _WinVerifyTrust($filePath) = $ERROR_SUCCESS Then $signed = True ; ConsoleWrite($filepath & " is correctly signed = " & $signed & @LF) ; Example 2 (file without embedded signature, using a catalog instead): ; $filePath = ".\unsigned.zip" ; $fileTag = "File1" ; $catalogPath = ".\catalog.cat" ; $signed = False ; If _WinVerifyTrust($filePath, $catalogPath, $fileTag) = $ERROR_SUCCESS Then $signed = True ; ConsoleWrite($filepath & " is correctly signed = " & $signed & @LF) ; Example 3 (obtaining the serial number, owner and issuer of the certificate used to sign a file): ; $certInfo = _GetSignatureInfo(".\signed.exe") ; ConsoleWrite("Serial Number: " & $certInfo[0] & @LF) ; ConsoleWrite("Owner: " & $certInfo[1] & @LF) ; ConsoleWrite("Issuer: " & $certInfo[2] & @LF) ;================================================================================================= #include #Include #include "C:\Users\scoward\Downloads\autoit\SecurityEx.au3" Global Const $tagWINTRUST_FILE_INFO = _ "DWORD cbStruct;" & _ "ptr pcwszFilePath;" & _ ; LPCWSTR "HWND hFile;" & _ "ptr pgKnownSubject;" ; GUID * Global Const $tagWINTRUST_DATA = _ "DWORD cbStruct;" & _ "ptr pPolicyCallbackData;" & _ "ptr pSIPClientData;" & _ "DWORD dwUIChoice;" & _ "DWORD fdwRevocationChecks;" & _ "DWORD dwUnionChoice;" & _ "ptr pInfoStruct;" & _ "DWORD dwStateAction;" & _ "HWND hWVTStateData;" & _ "ptr pwszURLReference;" & _ ;WCHAR * "DWORD dwProvFlags;" & _ "DWORD dwUIContext;" Global Const $tagWINTRUST_CATALOG_INFO = _ "DWORD cbStruct;" & _ "DWORD dwCatalogVersion;" & _ "ptr pcwszCatalogFilePath;" & _ "ptr pcwszMemberTag;" & _ "ptr pcwszMemberFilePath;" & _ "HANDLE hMemberFile;" & _ "ptr pbCalculatedFileHash;" & _ "DWORD cbCalculatedFileHash;" & _ "ptr pcCatalogContext;" Global $tagCMSG_SIGNER_INFO = _ "DWORD dwVersion;" & _ "DWORD Issuer_cbData;" & _ "ptr Issuer_pbData;" & _ "DWORD SerialNumber_cbData;" & _ "ptr SerialNumber_pbData;" & _ "ptr HashAlgorithm_pszObjId;" & _ "DWORD HashAlgorithm_Parameters_cbData;" & _ "ptr HashAlgorithm_Parameters_pbData;" & _ "ptr HashEncryptionAlgorithm_pszObjId;" & _ "DWORD HashEncryptionAlgorithm_Parameters_cbData;" & _ "ptr HashEncryptionAlgorithm_Parameters_pbData;" & _ "DWORD EncryptedHash_cbData;" & _ "ptr EncryptedHash_pbData;" & _ "DWORD AuthAttrs_cAttr;" & _ "ptr AuthAttrs_rgAttr;" & _ "DWORD UnauthAttrs_cAttr;" & _ "ptr UnauthAttrs_rgAttr;" & _ "DWORD dwUIContext;" If @AutoItX64 Then $tagCMSG_SIGNER_INFO = StringRegExpReplace($tagCMSG_SIGNER_INFO, 'DWORD', 'UINT64') Global $tagCERT_INFO = _ "DWORD dwVersion;" & _ "DWORD SerialNumber_cbData;" & _ "ptr SerialNumber_pbData;" & _ "ptr SignatureAlgorithm_pszObjId;" & _ "DWORD SignatureAlgorithm_Parameters_cbData;" & _ "ptr SignatureAlgorithm_Parameters_pbData;" & _ "DWORD Issuer_cbData;" & _ "ptr Issuer_pbData;" & _ "DWORD NotBefore_dwLowDateTime;" & _ "DWORD NotBefore_dwHighDateTime;" & _ "DWORD NotAfter_dwLowDateTime;" & _ "DWORD NotAfter_dwHighDateTime;" & _ "DWORD Subject_cbData;" & _ "ptr Subject_pbData;" & _ "ptr SubjectPublicKeyInfo_Algorithm_pszObjId;" & _ "DWORD SubjectPublicKeyInfo_Algorithm_Parameters_cbData;" & _ "ptr SubjectPublicKeyInfo_Algorithm_Parameters_pbData;" & _ "DWORD SubjectPublicKeyInfo_PublicKey_cbData;" & _ "ptr SubjectPublicKeyInfo_PublicKey_pbData;" & _ "DWORD IssuerUniqueId_cbData;" & _ "ptr IssuerUniqueId_pbData;" & _ "DWORD SubjectUniqueId_cbData;" & _ "ptr SubjectUniqueId_pbData;" & _ "DWORD cExtension;" & _ "ptr rgExtension;" If @AutoItX64 Then $tagCERT_INFO = StringRegExpReplace($tagCERT_INFO, 'DWORD', 'UINT64') Global Const $WTD_UI_ALL = 1 Global Const $WTD_UI_NONE = 2 Global Const $WTD_UI_NOBAD = 3 Global Const $WTD_UI_NOGOOD = 4 ;~ /* fdwRevocationChecks */ Global Const $WTD_REVOKE_NONE = 0 Global Const $WTD_REVOKE_WHOLECHAIN = 1 ;~ /* dwUnionChoice */ Global Const $WTD_CHOICE_FILE = 1 Global Const $WTD_CHOICE_CATALOG = 2 Global Const $WTD_CHOICE_BLOB = 3 Global Const $WTD_CHOICE_SIGNER = 4 Global Const $WTD_CHOICE_CERT = 5 Global Const $WTD_STATEACTION_IGNORE = 0 Global Const $WTD_STATEACTION_VERIFY = 1 Global Const $WTD_STATEACTION_CLOSE = 2 Global Const $WTD_STATEACTION_AUTO_CACHE = 3 Global Const $WTD_STATEACTION_AUTO_CACHE_FLUSH = 4 Global Const $WTD_PROV_FLAGS_MASK = 0x0000ffff Global Const $WTD_USE_IE4_TRUST_FLAG = 0x00000001 Global Const $WTD_NO_IE4_CHAIN_FLAG = 0x00000002 Global Const $WTD_NO_POLICY_USAGE_FLAG = 0x00000004 Global Const $WTD_REVOCATION_CHECK_NONE = 0x00000010 Global Const $WTD_REVOCATION_CHECK_END_CERT = 0x00000020 Global Const $WTD_REVOCATION_CHECK_CHAIN = 0x00000040 Global Const $WTD_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT = 0x00000080 Global Const $WTD_SAFER_FLAG = 0x00000100 Global Const $WTD_HASH_ONLY_FLAG = 0x00000200 Global Const $WTD_USE_DEFAULT_OSVER_CHECK = 0x00000400 Global Const $WTD_LIFETIME_SIGNING_FLAG = 0x00000800 Global Const $WTD_UICONTEXT_EXECUTE = 0 Global Const $WTD_UICONTEXT_INSTALL = 1 Global Const $ERROR_SUCCESS = 0 Global Const $TRUST_E_SYSTEM_ERROR = (0x80096001) Global Const $TRUST_E_NO_SIGNER_CERT = (0x80096002) Global Const $TRUST_E_COUNTER_SIGNER = (0x80096003) Global Const $TRUST_E_CERT_SIGNATURE = (0x80096004) Global Const $TRUST_E_TIME_STAMP = (0x80096005) Global Const $TRUST_E_BAD_DIGEST = (0x80096010) Global Const $TRUST_E_BASIC_CONSTRAINTS = (0x80096019) Global Const $TRUST_E_FINANCIAL_CRITERIA = (0x8009601E) Global Const $TRUST_E_PROVIDER_UNKNOWN = (0x800B0001) Global Const $TRUST_E_ACTION_UNKNOWN = (0x800B0002) Global Const $TRUST_E_SUBJECT_FORM_UNKNOWN = (0x800B0003) Global Const $TRUST_E_SUBJECT_NOT_TRUSTED = (0x800B0004) Global Const $TRUST_E_NOSIGNATURE = (0x800B0100) Global Const $TRUST_E_FAIL = (0x800B010B) Global Const $TRUST_E_EXPLICIT_DISTRUST = (0x800B0111) ;~ Global Const $TRUST_E_PROVIDER_UNKNOWN = (0x800B0001) Global Const $CRYPT_E_SECURITY_SETTINGS = 0x80092026 Global $WINTRUST_ACTION_GENERIC_VERIFY_V2 = _WinAPI_GUIDFromString("{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}") Global Const $CERT_QUERY_OBJECT_FILE = 0x1 Global Const $CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED = 10 Global Const $CERT_QUERY_CONTENT_FLAG_ALL = 16382 Global Const $CERT_QUERY_CONTENT_FLAG_CERT = 2 Global Const $CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED = 2 ^ $CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED Global Const $CERT_QUERY_FORMAT_BINARY = 0x1 Global Const $CERT_QUERY_FORMAT_FLAG_BINARY = 2 ^ $CERT_QUERY_FORMAT_BINARY Global Const $CMSG_SIGNER_INFO_PARAM = 0x6 Global Const $X509_ASN_ENCODING = 0x00000001 Global Const $PKCS_7_ASN_ENCODING = 0x00010000 Global Const $CERT_FIND_SUBJECT_CERT = 720896 Global Const $CERT_NAME_SIMPLE_DISPLAY_TYPE = 4 Global Const $CERT_NAME_ISSUER_FLAG = 1 Dim $avCurr[2] = [$SE_DEBUG_NAME, $SE_PRIVILEGE_ENABLED] $avPrev = _SetPrivilege($avCurr) $file = FileOpenDialog('',@ScriptDir,'all files(*.*)') $arr = _GetSignatureInfo($file) If @error Then MsgBox(0,@extended,@error) Else _ArrayDisplay($arr) EndIf _SetPrivilege($avPrev) ;================================================================================================= ; $catPath = path to the catalog being used, or empty string if no catalog should be used (i.e. the signature is embedded in the file) ; $catMemberTag = if a catalog is used, this is the tag of the file inside the catalog (see MakeCat at MSDN for options) ; $iCodePage sets the encoding of the file path, see _WinAPI_MultiByteToWideChar for options, default is ANSI ; $dwProvFlags sets the way the signature is checked, see WINTRUST_DATE struct Func _WinVerifyTrust($filePath, $catPath = "", $catMemberTag = "", $dwProvFlags = $WTD_REVOCATION_CHECK_NONE, $iCodePage = 0) If Not FileExists($filePath) Then return -1 If StringLen($filePath) > 1000 Then return -1 Local $wszSourceFile = _WinAPI_MultiByteToWideChar($filePath , $iCodePage , $MB_PRECOMPOSED) If @error Then return -1 If StringLen($catPath) = 0 Then $WINTRUST_FILE_INFO = DllStructCreate($tagWINTRUST_FILE_INFO) DllStructSetData($WINTRUST_FILE_INFO, "cbStruct", DllStructGetSize($WINTRUST_FILE_INFO)) DllStructSetData($WINTRUST_FILE_INFO, "pcwszFilePath", DllStructGetPtr($wszSourceFile)) DllStructSetData($WINTRUST_FILE_INFO, "hFile", 0) DllStructSetData($WINTRUST_FILE_INFO, "pgKnownSubject", 0) $pInfoStruct = DllStructGetPtr($WINTRUST_FILE_INFO) $dwUnionChoice = $WTD_CHOICE_FILE Else $wszCatalogFile = _WinAPI_MultiByteToWideChar($catPath , $iCodePage , $MB_PRECOMPOSED) If @error Then return -1 $wszFileTag = _WinAPI_MultiByteToWideChar($catMemberTag , $iCodePage , $MB_PRECOMPOSED) If @error Then return -1 $WINTRUST_CATALOG_INFO = DllStructCreate($tagWINTRUST_CATALOG_INFO) DllStructSetData($WINTRUST_CATALOG_INFO, "cbStruct", DllStructGetSize($WINTRUST_CATALOG_INFO)) DllStructSetData($WINTRUST_CATALOG_INFO, "dwCatalogVersion", 0) DllStructSetData($WINTRUST_CATALOG_INFO, "pcwszCatalogFilePath", DllStructGetPtr($wszCatalogFile)) DllStructSetData($WINTRUST_CATALOG_INFO, "pcwszMemberTag", DllStructGetPtr($wszFileTag)) DllStructSetData($WINTRUST_CATALOG_INFO, "pcwszMemberFilePath", DllStructGetPtr($wszSourceFile)) DllStructSetData($WINTRUST_CATALOG_INFO, "hMemberFile", 0) DllStructSetData($WINTRUST_CATALOG_INFO, "pbCalculatedFileHash", 0) DllStructSetData($WINTRUST_CATALOG_INFO, "cbCalculatedFileHash", 0) DllStructSetData($WINTRUST_CATALOG_INFO, "pcCatalogContext", 0) $pInfoStruct = DllStructGetPtr($WINTRUST_CATALOG_INFO) $dwUnionChoice = $WTD_CHOICE_CATALOG EndIf $WINTRUST_DATA = DllStructCreate($tagWINTRUST_DATA) DllStructSetData($WINTRUST_DATA, "cbStruct", DllStructGetSize($WINTRUST_DATA)) DllStructSetData($WINTRUST_DATA, "pPolicyCallbackData", 0) DllStructSetData($WINTRUST_DATA, "pSIPClientData", 0) DllStructSetData($WINTRUST_DATA, "dwUIChoice", $WTD_UI_NONE) DllStructSetData($WINTRUST_DATA, "fdwRevocationChecks", $WTD_REVOKE_NONE) DllStructSetData($WINTRUST_DATA, "dwUnionChoice", $dwUnionChoice) DllStructSetData($WINTRUST_DATA, "pInfoStruct", $pInfoStruct) DllStructSetData($WINTRUST_DATA, "dwStateAction", 0) DllStructSetData($WINTRUST_DATA, "hWVTStateData", 0) DllStructSetData($WINTRUST_DATA, "pwszURLReference", 0) DllStructSetData($WINTRUST_DATA, "dwProvFlags", $dwProvFlags) DllStructSetData($WINTRUST_DATA, "dwUIContext", 0) $pGUID=DllStructGetPtr($WINTRUST_ACTION_GENERIC_VERIFY_V2) $pWINTRUST_DATA = DllStructGetPtr($WINTRUST_DATA) $status = DllCall("wintrust.dll","long","WinVerifyTrust","HWND", 0, "ptr", $pGUID, "ptr", $pWINTRUST_DATA) If @error Then return -1 return $status[0] EndFunc ;================================================================================================================== ; $filePath = path of a signed file (may be a catalog) ; $iCodePage = code page, default is ANSI ; Returns: array of 3 elements [certificate serial number, cert. signer, cert. issuer] Func _GetSignatureInfo($filePath, $iCodePage = 0) Dim $empty_answer[3] = [ "", "", "" ] Dim $certInfo[3] = [ "", "", "" ] If Not FileExists($filePath) Then Return $empty_answer Local $wszSourceFile = _WinAPI_MultiByteToWideChar($filePath , $iCodePage , $MB_PRECOMPOSED, True) If @error Then Return SetError(_WinAPI_GetLastError(),1,$empty_answer) Local $aCall = DllCall("Crypt32.dll", "bool", "CryptQueryObject", _ "dword", $CERT_QUERY_OBJECT_FILE, _ "wstr", $wszSourceFile, _ "dword", $CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED, _ "dword", $CERT_QUERY_FORMAT_FLAG_BINARY, _ "dword", 0, _ "dword*", 0, _ "dword*", 0, _ "dword*", 0, _ "handle*", 0, _ "handle*", 0, _ "ptr", 0) If $aCall[0] = 0 Then return SetError(_WinAPI_GetLastError(),2,$empty_answer) Local $iMsgAndCertEncodingType = $aCall[6] Local $iContentType = $aCall[7] Local $iFormatType = $aCall[8] Local $hStore = $aCall[9] Local $hMsg = $aCall[10] Local $ppvContext = $aCall[11] ; Simple check If Not $hMsg Then Return SetExtended(3, $empty_answer) $aCall = DllCall("Crypt32.dll", "bool", "CryptMsgGetParam", _ "handle", $hMsg, _ "dword", $CMSG_SIGNER_INFO_PARAM, _ "dword", 0, _ "ptr", 0, _ "dword*", 0) Local $iSize = $aCall[5] ;~ If @AutoItX64 Then $isize *= 3 ;~ MsgBox(0,'',$isize) Local $pSignerInfo = DllStructCreate("byte[" & $iSize & "]") $aCall = DllCall("Crypt32.dll", "bool", "CryptMsgGetParam", _ "handle", $hMsg, _ "dword", $CMSG_SIGNER_INFO_PARAM, _ "dword", 0, _ "ptr", DllStructGetPtr($pSignerInfo), _ "dword*", DllStructGetSize($pSignerInfo)) ; CMSG_SIGNER_INFO structure Local $CMSG_SIGNER_INFO = DllStructCreate($tagCMSG_SIGNER_INFO, DllStructGetPtr($pSignerInfo)) Local $CERT_INFO = DllStructCreate($tagCERT_INFO) DllStructSetData($CERT_INFO, "Issuer_cbData", DllStructGetData($CMSG_SIGNER_INFO, "Issuer_cbData")) DllStructSetData($CERT_INFO, "Issuer_pbData", DllStructGetData($CMSG_SIGNER_INFO, "Issuer_pbData")) DllStructSetData($CERT_INFO, "SerialNumber_cbData", DllStructGetData($CMSG_SIGNER_INFO, "SerialNumber_cbData")) DllStructSetData($CERT_INFO, "SerialNumber_pbData", DllStructGetData($CMSG_SIGNER_INFO, "SerialNumber_pbData")) $aCall = DllCall("Crypt32.dll", "ptr", "CertFindCertificateInStore", _ "HANDLE", $hStore, _ "DWORD", $X509_ASN_ENCODING + $PKCS_7_ASN_ENCODING, _ "DWORD", 0, _ "DWORD", $CERT_FIND_SUBJECT_CERT, _ "ptr", DllStructGetPtr($CERT_INFO), _ "ptr", 0) If $aCall[0] = 0 Then Return SetError(_WinAPI_GetLastError(),4,$empty_answer) Local $pCertContext = $aCall[0] ; get serial Number Local $serialNumberSize = DllStructGetData($CERT_INFO, "SerialNumber_cbData") Local $_serialNumber = DllStructCreate("BYTE[" & $serialNumberSize & "]", DllStructGetData($CERT_INFO, "SerialNumber_pbData")) Local $invertedSerialNumber = Hex(DllStructGetData($_serialNumber, 1)) Local $serialNumber = "" For $x = 1 To $serialNumberSize*2 Step 2 $serialNumber = $serialNumber & StringMid($invertedSerialNumber, ($serialNumberSize*2) - $x, 2) Next $certInfo[0] = $serialNumber ; get signer $aCall = DllCall("Crypt32.dll", "DWORD", "CertGetNameStringW", "ptr", $pCertContext, "DWORD", $CERT_NAME_SIMPLE_DISPLAY_TYPE, "DWORD", 0, "ptr", 0, "ptr", 0, "DWORD", 0) If $aCall[0] = 0 Then Return SetError(_WinAPI_GetLastError(),5,$empty_answer) Local $dwSize = $aCall[0] Local $szSignerName = DllStructCreate("wchar[" & $dwSize & "]") $aCall = DllCall("Crypt32.dll", "DWORD", "CertGetNameStringW", "ptr", $pCertContext, "DWORD", $CERT_NAME_SIMPLE_DISPLAY_TYPE, "DWORD", 0, "ptr", 0, "ptr", DllStructGetPtr($szSignerName), "DWORD", $dwSize) If $aCall[0] = 0 Then Return SetError(_WinAPI_GetLastError(),6,$empty_answer) $certInfo[1] = DllStructGetData($szSignerName, 1) ; get issuer $aCall = DllCall("Crypt32.dll", "DWORD", "CertGetNameStringW", "ptr", $pCertContext, "DWORD", $CERT_NAME_SIMPLE_DISPLAY_TYPE, "DWORD", $CERT_NAME_ISSUER_FLAG, "ptr", 0, "ptr", 0, "DWORD", 0) If $aCall[0] = 0 Then Return SetError(_WinAPI_GetLastError(),7,$empty_answer) $dwSize = $aCall[0] Local $szIssuerName = DllStructCreate("wchar[" & $dwSize & "]") $aCall = DllCall("Crypt32.dll", "DWORD", "CertGetNameStringW", "ptr", $pCertContext, "DWORD", $CERT_NAME_SIMPLE_DISPLAY_TYPE, "DWORD", $CERT_NAME_ISSUER_FLAG, "ptr", 0, "ptr", DllStructGetPtr($szIssuerName), "DWORD", $dwSize) If $aCall[0] = 0 Then Return SetError(_WinAPI_GetLastError(),1,$empty_answer) $certInfo[2] = DllStructGetData($szIssuerName, 1) return $certInfo EndFunc