DataFlex
DataFlex
Verify Authenticode Signature of EXE or DLL
See more Code Signing Examples
Demonstrates how to verify an Authenticode signed EXE or DLL.Note: Chilkat's code signing class was added in v9.5.0.97
Chilkat DataFlex Downloads
Use ChilkatAx-win32.pkg
Procedure Test
String sPath
Variant vJson
Handle hoJson
Handle hoValidator
Boolean iValid
String sIssuerCN
String sSerial
Variant vGenTime
Handle hoGenTime
Handle hoDt
Integer i
Integer iCount_i
Integer iNumSigners
Boolean iSuccess
String sTemp1
Boolean bTemp1
// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.
// You can verify a signed DLL or EXE.
Move "c:/someDir/something.dll" To sPath
// The verify method returns an overall indicator of whether
// the EXE or DLL can be trusted or not.
// The details of the signature are emitted to the JSON object
// passed in the last argument.
Get Create (RefClass(cComChilkatJsonObject)) To hoJson
If (Not(IsComObjectCreated(hoJson))) Begin
Send CreateComObject of hoJson
End
Set ComEmitCompact Of hoJson To False
Get Create (RefClass(cComChilkatCodeSign)) To hoValidator
If (Not(IsComObjectCreated(hoValidator))) Begin
Send CreateComObject of hoValidator
End
Get pvComObject of hoJson to vJson
Get ComVerifySignature Of hoValidator sPath vJson To iValid
If (iValid = False) Begin
// Validation failed.
Get ComLastErrorText Of hoValidator To sTemp1
Showln sTemp1
// You can also examine the details of the validation (see below)
Get ComEmit Of hoJson To sTemp1
Showln sTemp1
Procedure_Return
End
// Examine the details of the Authenticode signature
// println json.Emit();
// An example of the JSON details of an authenticode signature, with selected parsing code, is shown below.
//
// Use this online tool to generate parsing code from sample JSON:
// Generate Parsing Code from JSON
// {
// "pkcs7": {
// "verify": {
// "peFile": {
// "hashOid": "2.16.840.1.101.3.4.2.1",
// "hash": "q9tzWEcea8f8kaMXG8LpWNPe9JIW7aKccYWuL3mrCBw="
// },
// "certs": [
// {
// "issuerCN": "AAA Certificate Services",
// "serial": "48FC93B46055948D36A7C98A89D69416"
// },
// {
// "issuerCN": "Sectigo Public Code Signing Root R46",
// "serial": "621D6D0C52019E3B9079152089211C0A"
// },
// {
// "issuerCN": "Sectigo Public Code Signing CA R36",
// "serial": "3FF5B69109BFD4046C92CC0D18EE23C2"
// }
// ],
// "digestAlgorithms": [
// "sha256"
// ],
// "signerInfo": [
// {
// "cert": {
// "serialNumber": "3FF5B69109BFD4046C92CC0D18EE23C2",
// "issuerCN": "Sectigo Public Code Signing CA R36",
// "digestAlgOid": "2.16.840.1.101.3.4.2.1",
// "digestAlgName": "SHA256"
// },
// "contentType": "1.3.6.1.4.1.311.2.1.4",
// "messageDigest": "4MkPVkY4qdwoVAj5JcCvn3ISSS5yqtf1+KmIs/Ckni4=",
// "signingAlgOid": "1.2.840.113549.1.1.1",
// "signingAlgName": "RSA-PKCSV-1_5",
// "authAttr": {
// "1.3.6.1.4.1.311.2.1.12": {
// "der": "MAA="
// },
// "1.2.840.113549.1.9.3": {
// "name": "contentType",
// "oid": "1.3.6.1.4.1.311.2.1.4"
// },
// "1.3.6.1.4.1.311.2.1.11": {
// "der": "MAwGCisGAQQBgjcCARU="
// },
// "1.2.840.113549.1.9.4": {
// "name": "messageDigest",
// "digest": "4MkPVkY4qdwoVAj5JcCvn3ISSS5yqtf1+KmIs/Ckni4="
// }
// },
// "unauthAttr": {
// "1.3.6.1.4.1.311.3.3.1": {
// "name": "timestampToken",
// "der": "MIIXJwY ... QZej",
// "verify": {
// "digestAlgorithms": [
// "sha256"
// ],
// "signerInfo": [
// {
// "cert": {
// "serialNumber": "0544AFF3949D0839A6BFDB3F5FE56116",
// "issuerCN": "DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA",
// "digestAlgOid": "2.16.840.1.101.3.4.2.1",
// "digestAlgName": "SHA256"
// },
// "contentType": "1.2.840.113549.1.9.16.1.4",
// "signingTime": "240117124047Z",
// "messageDigest": "y6cKjJoRfgJwW+Dj29w3tEfWqVybz7Sg+d8opKQxCjM=",
// "signingAlgOid": "1.2.840.113549.1.1.1",
// "signingAlgName": "RSA-PKCSV-1_5",
// "authAttr": {
// "1.2.840.113549.1.9.3": {
// "name": "contentType",
// "oid": "1.2.840.113549.1.9.16.1.4"
// },
// "1.2.840.113549.1.9.5": {
// "name": "signingTime",
// "utctime": "240117124047Z"
// },
// "1.2.840.113549.1.9.16.2.12": {
// "name": "signingCertificate",
// "der": "MBowGDAWBBRm8CsywsLJD4JdzqqKycZPGZzPQA=="
// },
// "1.2.840.113549.1.9.4": {
// "name": "messageDigest",
// "digest": "y6cKjJoRfgJwW+Dj29w3tEfWqVybz7Sg+d8opKQxCjM="
// },
// "1.2.840.113549.1.9.16.2.47": {
// "name": "signingCertificateV2",
// "der": "MCYwJDAiBCDS9uRt7XQizNHUQFdoQTZvgoraVZquMxavTRqa1Ax4KA=="
// }
// }
// }
// ],
// "uncommonOptions": "NO_SIGCERTV2_OID,NoSigningCertV2IssuerSerial"
// },
// "timestampSignatureVerified": true,
// "tstInfo": {
// "tsaPolicyId": "2.16.840.1.114412.7.1",
// "messageImprint": {
// "hashAlg": "sha256",
// "digest": "JqY7U+30qScMnRQwnDfUYEikZwOLHMhKX0oo5zo4ils=",
// "digestMatches": true
// },
// "serialNumber": "6E4597E574BC909213565DAEBC0E4888",
// "genTime": "20240117124047Z"
// }
// }
// }
// }
// ],
// "pkcs7": {
// "verify": {
// "certs": [
// {
// "issuerCN": "DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA",
// "serial": "0544AFF3949D0839A6BFDB3F5FE56116"
// },
// {
// "issuerCN": "DigiCert Trusted Root G4",
// "serial": "073637B724547CD847ACFD28662A5E5B"
// },
// {
// "issuerCN": "DigiCert Assured ID Root CA",
// "serial": "0E9B188EF9D02DE7EFDB50E20840185A"
// }
// ]
// }
// }
// }
// }
// }
Get Create (RefClass(cComChilkatDtObj)) To hoGenTime
If (Not(IsComObjectCreated(hoGenTime))) Begin
Send CreateComObject of hoGenTime
End
Get Create (RefClass(cComCkDateTime)) To hoDt
If (Not(IsComObjectCreated(hoDt))) Begin
Send CreateComObject of hoDt
End
// Show the certificates embedded in the PKCS7 signature.
Showln "Certificates contained in the PKCS7 signature:"
Move 0 To i
Get ComSizeOfArray Of hoJson "pkcs7.verify.certs" To iCount_i
While (i < iCount_i)
Set ComI Of hoJson To i
Get ComStringOf Of hoJson "pkcs7.verify.certs[i].issuerCN" To sIssuerCN
Get ComStringOf Of hoJson "pkcs7.verify.certs[i].serial" To sSerial
Showln sIssuerCN ", " sSerial
Move (i + 1) To i
Loop
// Show details about the signing certificate(s)
Get ComSizeOfArray Of hoJson "pkcs7.verify.signerInfo" To iNumSigners
Move 0 To i
While (i < iNumSigners)
Set ComI Of hoJson To i
Showln "---- Signing Certificate ----"
Get ComStringOf Of hoJson "pkcs7.verify.signerInfo[i].cert.serialNumber" To sTemp1
Showln "serial number: " sTemp1
Get ComStringOf Of hoJson "pkcs7.verify.signerInfo[i].cert.issuerCN" To sTemp1
Showln "issuerCN: " sTemp1
Get ComStringOf Of hoJson "pkcs7.verify.signerInfo[i].cert.digestAlgName" To sTemp1
Showln "hash algorithm: " sTemp1
Get ComStringOf Of hoJson "pkcs7.verify.signerInfo[i].signingAlgName" To sTemp1
Showln "signing algorithm: " sTemp1
// If this signature includes a timestamp token, get information about it.
Get ComHasMember Of hoJson 'pkcs7.verify.signerInfo[i].unauthAttr."1.3.6.1.4.1.311.3.3.1"' To bTemp1
If (bTemp1 = True) Begin
// We're going to assume the timestamp token had only 1 signer..
Showln "--- Timestamp Token ----"
Get ComStringOf Of hoJson 'pkcs7.verify.signerInfo[i].unauthAttr."1.3.6.1.4.1.311.3.3.1".verify.digestAlgorithms[0]' To sTemp1
Showln "TS hash algorithm: " sTemp1
Get ComStringOf Of hoJson 'pkcs7.verify.signerInfo[i].unauthAttr."1.3.6.1.4.1.311.3.3.1".verify.signerInfo[0].cert.serialNumber' To sTemp1
Showln "TS certificate serial: " sTemp1
Get ComStringOf Of hoJson 'pkcs7.verify.signerInfo[i].unauthAttr."1.3.6.1.4.1.311.3.3.1".verify.signerInfo[0].cert.issuerCN' To sTemp1
Showln "TS certificate issuerCN: " sTemp1
Get ComBoolOf Of hoJson 'pkcs7.verify.signerInfo[i].unauthAttr."1.3.6.1.4.1.311.3.3.1".timestampSignatureVerified' To bTemp1
Showln "timestamp signature verified: " bTemp1
Get pvComObject of hoGenTime to vGenTime
Get ComDtOf Of hoJson 'pkcs7.verify.signerInfo[i].unauthAttr."1.3.6.1.4.1.311.3.3.1".tstInfo.genTime' False vGenTime To iSuccess
Get pvComObject of hoGenTime to vGenTime
Get ComSetFromDtObj Of hoDt vGenTime To iSuccess
Get ComGetAsRfc822 Of hoDt True To sTemp1
Showln "timestamp date/time: " sTemp1
End
Move (i + 1) To i
Loop
Showln "The Authenticode signature is valid."
// Sample output:
// Certificates contained in the PKCS7 signature:
// AAA Certificate Services, 48FC93B46055948D36A7C98A89D69416
// Sectigo Public Code Signing Root R46, 621D6D0C52019E3B9079152089211C0A
// Sectigo Public Code Signing CA R36, 3FF5B69109BFD4046C92CC0D18EE23C2
// ---- Signing Certificate ----
// serial number: 3FF5B69109BFD4046C92CC0D18EE23C2
// issuerCN: Sectigo Public Code Signing CA R36
// hash algorithm: SHA256
// signing algorithm: RSA-PKCSV-1_5
// --- Timestamp Token ----
// TS hash algorithm: sha256
// TS certificate serial: 0544AFF3949D0839A6BFDB3F5FE56116
// TS certificate issuerCN: DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA
// timestamp signature verified: True
// timestamp date/time: Wed, 17 Jan 2024 06:40:47 -0600
// The Authenticode signature is valid.
End_Procedure