6

We deliver an executable to a client-service which starts this executable in a new process after downloading it from our servers.

The executable is signed (authenticode) with the CodeSigning-Certificate of our company and now i'd like to verify, that the downloaded executable is validly signed with this CodeSigning-Certificate to prevent malicious Man-in-the-middle attacks.

But currently i can't find any hints on how to verify this without using "signtool.exe" (which isn't available on the client).

The Download-Service on the client is a .NET 4.0 application written in C#. So i'm searching for a way, to verify the authenticode of the downloaded file and only proceed, if the verification succeeded.

Sven Eppler
  • 1,646
  • 1
  • 15
  • 26
  • 1
    You need to p/invoke WinVerifyTrust: http://stackoverflow.com/questions/6596327/how-to-check-if-a-file-is-signed-in-c – Alex K. Aug 07 '15 at 14:19

1 Answers1

5

Since this question is from 2015 and I assume you can use .NET Standard 2.0, there is another option available:

You can use the NuGet Package Microsoft.Security.Extensions:

using Microsoft.Security.Extensions;

...

using (FileStream fs = File.OpenRead(@"c:\test.exe"))
{
    FileSignatureInfo sigInfo = FileSignatureInfo.GetFromFileStream(fs);

    Console.WriteLine(sigInfo.State); // SignatureState.SignedAndTrusted
}
Important:

Make sure, that you add getfilesiginforedistwrapper.dll and the corresponding native dll of your platform! (getfilesiginforedist.dll)

Source:

I've had a look how Microsoft does this for the PowerShell cmdlet Get-AuthenticodeSignature and found it there

Alternatives:

kapsiR
  • 2,720
  • 28
  • 36
  • 1
    Thanks for your answer to this long standing question. I was unable to verify your solution, since the project is long gone. But since it is used inside powershell, i mark this as the answer. :) – Sven Eppler Feb 01 '23 at 10:06
  • @kapsiR Good Find! It helped. Just adding my two cents. - The api works only on windows 10 and higher. It is not working on windows 7 with dotnetcore. It throws dll not found exception. - The library is not disposing the signatures and the `FileSignatureInfo` class does not exposing Dispose. So we have to manually dispose the certificates `fileSignatureInfo?.SigningCertificate?.Dispose();` `fileSignatureInfo?.TimestampCertificate?.Dispose();` – Prakash P Feb 18 '23 at 12:40