判断PE文件的数字签名信息
工作中碰到需要判断一个PE文件是否是所确认的文件，而不是被替换过的。直接判断文件名的话有些不保险，别人只要修改下文件名，就可以以假乱真。
因而需要判断额外的信息；由于文件有数字签名，判断数字签名因而是一个比较好的方法，但是如果只是判断数字签名是否有效也不够，别人只要用自己的证书重新签名就可以了，所以需要判断证书签名者信息。
验证文件数字签名是否有效可以使用函数 WinVerifyTrust
取得文件数字签名证书信息需要使用函数 CryptQueryObject。
下面是一段从网上搜到的获得文件数字签名证书信息的代码：
1
#include
<
windows.h
>
2
#include
<
wincrypt.h
>
3
#include
<
wintrust.h
>
4
#include
<
stdio.h
>
5
#include
<
tchar.h
>
6
#pragma
comment(lib, "crypt32.lib")
7
#define
ENCODING (X509_ASN_ENCODING | PKCS_7_ASN_ENCODING)
8
typedef
struct
{
9
LPWSTR lpszProgramName;
10
LPWSTR lpszPublisherLink;
11
LPWSTR lpszMoreInfoLink;
12
} SPROG_PUBLISHERINFO,
*
PSPROG_PUBLISHERINFO;
13
BOOL GetProgAndPublisherInfo(PCMSG_SIGNER_INFO pSignerInfo,
14
PSPROG_PUBLISHERINFO Info);
15
BOOL GetDateOfTimeStamp(PCMSG_SIGNER_INFO pSignerInfo, SYSTEMTIME
*
st);
16
BOOL PrintCertificateInfo(PCCERT_CONTEXT pCertContext);
17
BOOL GetTimeStampSignerInfo(PCMSG_SIGNER_INFO pSignerInfo,
18
PCMSG_SIGNER_INFO
*
pCounterSignerInfo);
19
int
_tmain(
int
argc, TCHAR
*
argv[])
20
{
21
WCHAR szFileName[MAX_PATH];
22
HCERTSTORE hStore
=
NULL;
23
HCRYPTMSG hMsg
=
NULL;
24
PCCERT_CONTEXT pCertContext
=
NULL;
25
BOOL fResult;
26
DWORD dwEncoding, dwContentType, dwFormatType;
27
PCMSG_SIGNER_INFO pSignerInfo
=
NULL;
28
PCMSG_SIGNER_INFO pCounterSignerInfo
=
NULL;
29
DWORD dwSignerInfo;
30
CERT_INFO CertInfo;
31
SPROG_PUBLISHERINFO ProgPubInfo;
32
SYSTEMTIME st;
33
ZeroMemory(
&
ProgPubInfo,
sizeof
(ProgPubInfo));
34
__try
35
{
36
if
(argc
!=
2
)
37
{
38
_tprintf(_T(
"
Usage: SignedFileInfo <filename>\n
"
));
39
return
0
;
40
}
41
#ifdef UNICODE
42
lstrcpynW(szFileName, argv[
1
], MAX_PATH);
43
#else
44
if
(mbstowcs(szFileName, argv[
1
], MAX_PATH)
==
-
1
)
45
{
46
printf(
"
Unable to convert to unicode.\n
"
);
47
__leave;
48
}
49
#endif
50
//
Get message handle and store handle from the signed file.
51
fResult
=
CryptQueryObject(CERT_QUERY_OBJECT_FILE,
52
szFileName,
53
CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED,
54
CERT_QUERY_FORMAT_FLAG_BINARY,
55
0
,
56
&
dwEncoding,
57
&
dwContentType,
58
&
dwFormatType,
59
&
hStore,
60
&
hMsg,
61
NULL);
62
if
(
!
fResult)
63
{
64
_tprintf(_T(
"
CryptQueryObject failed with %x\n
"
), GetLastError());
65
__leave;
66
}
67
//
Get signer information size.
68
fResult
=
CryptMsgGetParam(hMsg,
69
CMSG_SIGNER_INFO_PARAM,
70
0
,
71
NULL,
72
&
dwSignerInfo);
73
if
(
!
fResult)
74
{
75
_tprintf(_T(
"
CryptMsgGetParam failed with %x\n
"
), GetLastError());
76
__leave;
77
}
78
//
Allocate memory for signer information.
79
pSignerInfo
=
(PCMSG_SIGNER_INFO)LocalAlloc(LPTR, dwSignerInfo);
80
if
(
!
pSignerInfo)
81
{
82
_tprintf(_T(
"
Unable to allocate memory for Signer Info.\n
"
));
83
__leave;
84
}
85
//
Get Signer Information.
86
fResult
=
CryptMsgGetParam(hMsg,
87
CMSG_SIGNER_INFO_PARAM,
88
0
,
89
(PVOID)pSignerInfo,
90
&
dwSignerInfo);
91
if
(
!
fResult)
92
{
93
_tprintf(_T(
"
CryptMsgGetParam failed with %x\n
"
), GetLastError());
94
__leave;
95
}
96
//
Get program name and publisher information from
97
//
signer info structure.
98
if
(GetProgAndPublisherInfo(pSignerInfo,
&
ProgPubInfo))
99
{
100
if
(ProgPubInfo.lpszProgramName
!=
NULL)
101
{
102
wprintf(L
"
Program Name : %s\n
"
,
103
ProgPubInfo.lpszProgramName);
104
}
105
if
(ProgPubInfo.lpszPublisherLink
!=
NULL)
106
{
107
wprintf(L
"
Publisher Link : %s\n
"
,
108
ProgPubInfo.lpszPublisherLink);
109
}
110
if
(ProgPubInfo.lpszMoreInfoLink
!=
NULL)
111
{
112
wprintf(L
"
MoreInfo Link : %s\n
"
,
113
ProgPubInfo.lpszMoreInfoLink);
114
}
115
}
116
_tprintf(_T(
"
\n
"
));
117
//
Search for the signer certificate in the temporary
118
//
certificate store.
119
CertInfo.Issuer
=
pSignerInfo
->
Issuer;
120
CertInfo.SerialNumber
=
pSignerInfo
->
SerialNumber;
121
pCertContext
=
CertFindCertificateInStore(hStore,
122
ENCODING,
123
0
,
124
CERT_FIND_SUBJECT_CERT,
125
(PVOID)
&
CertInfo,
126
NULL);
127
if
(
!
pCertContext)
128
{
129
_tprintf(_T(
"
CertFindCertificateInStore failed with %x\n
"
),
130
GetLastError());
131
__leave;
132
}
133
//
Print Signer certificate information.
134
_tprintf(_T(
"
Signer Certificate:\n\n
"
));
135
PrintCertificateInfo(pCertContext);
136
_tprintf(_T(
"
\n
"
));
137
//
Get the timestamp certificate signerinfo structure.
138
if
(GetTimeStampSignerInfo(pSignerInfo,
&
pCounterSignerInfo))
139
{
140
//
Search for Timestamp certificate in the temporary
141
//
certificate store.
142
CertInfo.Issuer
=
pCounterSignerInfo
->
Issuer;
143
CertInfo.SerialNumber
=
pCounterSignerInfo
->
SerialNumber;
144
pCertContext
=
CertFindCertificateInStore(hStore,
145
ENCODING,
146
0
,
147
CERT_FIND_SUBJECT_CERT,
148
(PVOID)
&
CertInfo,
149
NULL);
150
if
(
!
pCertContext)
151
{
152
_tprintf(_T(
"
CertFindCertificateInStore failed with %x\n
"
),
153
GetLastError());
154
__leave;
155
}
156
//
Print timestamp certificate information.
157
_tprintf(_T(
"
TimeStamp Certificate:\n\n
"
));
158
PrintCertificateInfo(pCertContext);
159
_tprintf(_T(
"
\n
"
));
160
//
Find Date of timestamp.
161
if
(GetDateOfTimeStamp(pCounterSignerInfo,
&
st))
162
{
163
_tprintf(_T(
"
Date of TimeStamp : %02d/%02d/%04d %02d:%02d\n
"
),
164
st.wMonth,
165
st.wDay,
166
st.wYear,
167
st.wHour,
168
st.wMinute);
169
}
170
_tprintf(_T(
"
\n
"
));
171
}
172
}
173
__finally
174
{
175
//
Clean up.
176
if
(ProgPubInfo.lpszProgramName
!=
NULL)
177
LocalFree(ProgPubInfo.lpszProgramName);
178
if
(ProgPubInfo.lpszPublisherLink
!=
NULL)
179
LocalFree(ProgPubInfo.lpszPublisherLink);
180
if
(ProgPubInfo.lpszMoreInfoLink
!=
NULL)
181
LocalFree(ProgPubInfo.lpszMoreInfoLink);
182
if
(pSignerInfo
!=
NULL) LocalFree(pSignerInfo);
183
if
(pCounterSignerInfo
!=
NULL) LocalFree(pCounterSignerInfo);
184
if
(pCertContext
!=
NULL) CertFreeCertificateContext(pCertContext);
185
if
(hStore
!=
NULL) CertCloseStore(hStore,
0
);
186
if
(hMsg
!=
NULL) CryptMsgClose(hMsg);
187
}
188
return
0
;
189
}
190
BOOL PrintCertificateInfo(PCCERT_CONTEXT pCertContext)
191
{
192
BOOL fReturn
=
FALSE;
193
LPTSTR szName
=
NULL;
194
DWORD dwData;
195
__try
196
{
197
//
Print Serial Number.
198
_tprintf(_T(
"
Serial Number:
"
));
199
dwData
=
pCertContext
->
pCertInfo
->
SerialNumber.cbData;
200
for
(DWORD n
=
0
; n
<
dwData; n
++
)
201
{
202
_tprintf(_T(
"
%02x
"
),
203
pCertContext
->
pCertInfo
->
SerialNumber.pbData[dwData
-
(n
+
1
)]);
204
}
205
_tprintf(_T(
"
\n
"
));
206
//
Get Issuer name size.
207
if
(
!
(dwData
=
CertGetNameString(pCertContext,
208
CERT_NAME_SIMPLE_DISPLAY_TYPE,
209
CERT_NAME_ISSUER_FLAG,
210
NULL,
211
NULL,
212
0
)))
213
{
214
_tprintf(_T(
"
CertGetNameString failed.\n
"
));
215
__leave;
216
}
217
//
Allocate memory for Issuer name.
218
szName
=
(LPTSTR)LocalAlloc(LPTR, dwData
*
sizeof
(TCHAR));
219
if
(
!
szName)
220
{
221
_tprintf(_T(
"
Unable to allocate memory for issuer name.\n
"
));
222
__leave;
223
}
224
//
Get Issuer name.
225
if
(
!
(CertGetNameString(pCertContext,
226
CERT_NAME_SIMPLE_DISPLAY_TYPE,
227
CERT_NAME_ISSUER_FLAG,
228
NULL,
229
szName,
230
dwData)))
231
{
232
_tprintf(_T(
"
CertGetNameString failed.\n
"
));
233
__leave;
234
}
235
//
print Issuer name.
236
_tprintf(_T(
"
Issuer Name: %s\n
"
), szName);
237
LocalFree(szName);
238
szName
=
NULL;
239
//
Get Subject name size.
240
if
(
!
(dwData
=
CertGetNameString(pCertContext,
241
CERT_NAME_SIMPLE_DISPLAY_TYPE,
242
0
,
243
NULL,
244
NULL,
245
0
)))
246
{
247
_tprintf(_T(
"
CertGetNameString failed.\n
"
));
248
__leave;
249
}
250
//
Allocate memory for subject name.
251
szName
=
(LPTSTR)LocalAlloc(LPTR, dwData
*
sizeof
(TCHAR));
252
if
(
!
szName)
253
{
254
_tprintf(_T(
"
Unable to allocate memory for subject name.\n
"
));
255
__leave;
256
}
257
//
Get subject name.
258
if
(
!
(CertGetNameString(pCertContext,
259
CERT_NAME_SIMPLE_DISPLAY_TYPE,
260
0
,
261
NULL,
262
szName,
263
dwData)))
264
{
265
_tprintf(_T(
"
CertGetNameString failed.\n
"
));
266
__leave;
267
}
268
//
Print Subject Name.
269
_tprintf(_T(
"
Subject Name: %s\n
"
), szName);
270
fReturn
=
TRUE;
271
}
272
__finally
273
{
274
if
(szName
!=
NULL) LocalFree(szName);
275
}
276
return
fReturn;
277
}
278
LPWSTR AllocateAndCopyWideString(LPCWSTR inputString)
279
{
280
LPWSTR outputString
=
NULL;
281
outputString
=
(LPWSTR)LocalAlloc(LPTR,
282
(wcslen(inputString)
+
1
)
*
sizeof
(WCHAR));
283
if
(outputString
!=
NULL)
284
{
285
lstrcpyW(outputString, inputString);
286
}
287
return
outputString;
288
}
289
BOOL GetProgAndPublisherInfo(PCMSG_SIGNER_INFO pSignerInfo,
290
PSPROG_PUBLISHERINFO Info)
291
{
292
BOOL fReturn
=
FALSE;
293
PSPC_SP_OPUS_INFO OpusInfo
=
NULL;
294
DWORD dwData;
295
BOOL fResult;
296
__try
297
{
298
//
Loop through authenticated attributes and find
299
//
SPC_SP_OPUS_INFO_OBJID OID.
300
for
(DWORD n
=
0
; n
<
pSignerInfo
->
AuthAttrs.cAttr; n
++
)
301
{
302
if
(lstrcmpA(SPC_SP_OPUS_INFO_OBJID,
303
pSignerInfo
->
AuthAttrs.rgAttr[n].pszObjId)
==
0
)
304
{
305
//
Get Size of SPC_SP_OPUS_INFO structure.
306
fResult
=
CryptDecodeObject(ENCODING,
307
SPC_SP_OPUS_INFO_OBJID,
308
pSignerInfo
->
AuthAttrs.rgAttr[n].rgValue[
0
].pbData,
309
pSignerInfo
->
AuthAttrs.rgAttr[n].rgValue[
0
].cbData,
310
0
,
311
NULL,
312
&
dwData);
313
if
(
!
fResult)
314
{
315
_tprintf(_T(
"
CryptDecodeObject failed with %x\n
"
),
316
GetLastError());
317
__leave;
318
}
319
//
Allocate memory for SPC_SP_OPUS_INFO structure.
320
OpusInfo
=
(PSPC_SP_OPUS_INFO)LocalAlloc(LPTR, dwData);
321
if
(
!
OpusInfo)
322
{
323
_tprintf(_T(
"
Unable to allocate memory for Publisher Info.\n
"
));
324
__leave;
325
}
326
//
Decode and get SPC_SP_OPUS_INFO structure.
327
fResult
=
CryptDecodeObject(ENCODING,
328
SPC_SP_OPUS_INFO_OBJID,
329
pSignerInfo
->
AuthAttrs.rgAttr[n].rgValue[
0
].pbData,
330
pSignerInfo
->
AuthAttrs.rgAttr[n].rgValue[
0
].cbData,
331
0
,
332
OpusInfo,
333
&
dwData);
334
if
(
!
fResult)
335
{
336
_tprintf(_T(
"
CryptDecodeObject failed with %x\n
"
),
337
GetLastError());
338
__leave;
339
}
340
//
Fill in Program Name if present.
341
if
(OpusInfo
->
pwszProgramName)
342
{
343
Info
->
lpszProgramName
=
344
AllocateAndCopyWideString(OpusInfo
->
pwszProgramName);
345
}
346
else
347
Info
->
lpszProgramName
=
NULL;
348
//
Fill in Publisher Information if present.
349
if
(OpusInfo
->
pPublisherInfo)
350
{
351
switch
(OpusInfo
->
pPublisherInfo
->
dwLinkChoice)
352
{
353
case
SPC_URL_LINK_CHOICE:
354
Info
->
lpszPublisherLink
=
355
AllocateAndCopyWideString(OpusInfo
->
pPublisherInfo
->
pwszUrl);
356
break
;
357
case
SPC_FILE_LINK_CHOICE:
358
Info
->
lpszPublisherLink
=
359
AllocateAndCopyWideString(OpusInfo
->
pPublisherInfo
->
pwszFile);
360
break
;
361
default
:
362
Info
->
lpszPublisherLink
=
NULL;
363
break
;
364
}
365
}
366
else
367
{
368
Info
->
lpszPublisherLink
=
NULL;
369
}
370
//
Fill in More Info if present.
371
if
(OpusInfo
->
pMoreInfo)
372
{
373
switch
(OpusInfo
->
pMoreInfo
->
dwLinkChoice)
374
{
375
case
SPC_URL_LINK_CHOICE:
376
Info
->
lpszMoreInfoLink
=
377
AllocateAndCopyWideString(OpusInfo
->
pMoreInfo
->
pwszUrl);
378
break
;
379
case
SPC_FILE_LINK_CHOICE:
380
Info
->
lpszMoreInfoLink
=
381
AllocateAndCopyWideString(OpusInfo
->
pMoreInfo
->
pwszFile);
382
break
;
383
default
:
384
Info
->
lpszMoreInfoLink
=
NULL;
385
break
;
386
}
387
}
388
else
389
{
390
Info
->
lpszMoreInfoLink
=
NULL;
391
}
392
fReturn
=
TRUE;
393
break
;
//
Break from for loop.
394
}
//
lstrcmp SPC_SP_OPUS_INFO_OBJID
395
}
//
for
396
}
397
__finally
398
{
399
if
(OpusInfo
!=
NULL) LocalFree(OpusInfo);
400
}
401
return
fReturn;
402
}
403
BOOL GetDateOfTimeStamp(PCMSG_SIGNER_INFO pSignerInfo, SYSTEMTIME
*
st)
404
{
405
BOOL fResult;
406
FILETIME lft, ft;
407
DWORD dwData;
408
BOOL fReturn
=
FALSE;
409
//
Loop through authenticated attributes and find
410
//
szOID_RSA_signingTime OID.
411
for
(DWORD n
=
0
; n
<
pSignerInfo
->
AuthAttrs.cAttr; n
++
)
412
{
413
if
(lstrcmpA(szOID_RSA_signingTime,
414
pSignerInfo
->
AuthAttrs.rgAttr[n].pszObjId)
==
0
)
415
{
416
//
Decode and get FILETIME structure.
417
dwData
=
sizeof
(ft);
418
fResult
=
CryptDecodeObject(ENCODING,
419
szOID_RSA_signingTime,
420
pSignerInfo
->
AuthAttrs.rgAttr[n].rgValue[
0
].pbData,
421
pSignerInfo
->
AuthAttrs.rgAttr[n].rgValue[
0
].cbData,
422
0
,
423
(PVOID)
&
ft,
424
&
dwData);
425
if
(
!
fResult)
426
{
427
_tprintf(_T(
"
CryptDecodeObject failed with %x\n
"
),
428
GetLastError());
429
break
;
430
}
431
//
Convert to local time.
432
FileTimeToLocalFileTime(
&
ft,
&
lft);
433
FileTimeToSystemTime(
&
lft, st);
434
fReturn
=
TRUE;
435
break
;
//
Break from for loop.
436
}
//
lstrcmp szOID_RSA_signingTime
437
}
//
for
438
return
fReturn;
439
}
440
BOOL GetTimeStampSignerInfo(PCMSG_SIGNER_INFO pSignerInfo, PCMSG_SIGNER_INFO
*
pCounterSignerInfo)
441
{
442
PCCERT_CONTEXT pCertContext
=
NULL;
443
BOOL fReturn
=
FALSE;
444
BOOL fResult;
445
DWORD dwSize;
446
__try
447
{
448
*
pCounterSignerInfo
=
NULL;
449
//
Loop through unathenticated attributes for
450
//
szOID_RSA_counterSign OID.
451
for
(DWORD n
=
0
; n
<
pSignerInfo
->
UnauthAttrs.cAttr; n
++
)
452
{
453
if
(lstrcmpA(pSignerInfo
->
UnauthAttrs.rgAttr[n].pszObjId,
454
szOID_RSA_counterSign)
==
0
)
455
{
456
//
Get size of CMSG_SIGNER_INFO structure.
457
fResult
=
CryptDecodeObject(ENCODING,
458
PKCS7_SIGNER_INFO,
459
pSignerInfo
->
UnauthAttrs.rgAttr[n].rgValue[
0
].pbData,
460
pSignerInfo
->
UnauthAttrs.rgAttr[n].rgValue[
0
].cbData,
461
0
,
462
NULL,
463
&
dwSize);
464
if
(
!
fResult)
465
{
466
_tprintf(_T(
"
CryptDecodeObject failed with %x\n
"
),
467
GetLastError());
468
__leave;
469
}
470
//
Allocate memory for CMSG_SIGNER_INFO.
471
*
pCounterSignerInfo
=
(PCMSG_SIGNER_INFO)LocalAlloc(LPTR, dwSize);
472
if
(
!*
pCounterSignerInfo)
473
{
474
_tprintf(_T(
"
Unable to allocate memory for timestamp info.\n
"
));
475
__leave;
476
}
477
//
Decode and get CMSG_SIGNER_INFO structure
478
//
for timestamp certificate.
479
fResult
=
CryptDecodeObject(ENCODING,
480
PKCS7_SIGNER_INFO,
481
pSignerInfo
->
UnauthAttrs.rgAttr[n].rgValue[
0
].pbData,
482
pSignerInfo
->
UnauthAttrs.rgAttr[n].rgValue[
0
].cbData,
483
0
,
484
(PVOID)
*
pCounterSignerInfo,
485
&
dwSize);
486
if
(
!
fResult)
487
{
488
_tprintf(_T(
"
CryptDecodeObject failed with %x\n
"
),
489
GetLastError());
490
__leave;
491
}
492
fReturn
=
TRUE;
493
break
;
//
Break from for loop.
494
}
495
}
496
}
497
__finally
498
{
499
//
Clean up.
500
if
(pCertContext
!=
NULL) CertFreeCertificateContext(pCertContext);
501
}
502
return
fReturn;
503
}