Win32 API功能封装
+ -
Windows下隐藏盘符
使用临界区封装的自解锁CAutoLock

获取应用程序数字签名

2021-08-30 261 0

一般的应用程序在正式发布前都会进行数字签名。
如我们经常听歌的酷狗音乐，其通过查看文件属性，可以看到数字签名如下：

数字签名

那么怎么通过编程来获取数字签名的内容？
数字签名的获取一般是需要动态载入以下DLL:

  • Wintrust.dll
  • Crypt32.dll

相关的函数

  1. #define C_WinVerifyTrust    "WinVerifyTrust"
  2. #define C_WTHelperProvDataFromStateData    "WTHelperProvDataFromStateData"
  3. #define C_WTHelperGetProvSignerFromChain    "WTHelperGetProvSignerFromChain"
  4. #define C_WTHelperGetProvCertFromChain        "WTHelperGetProvCertFromChain"
  5. #define C_CertGetNameStringA                "CertGetNameStringA"

函数原型：

  1. typedef    LONG(__stdcall *FUN_WinVerifyTrust)(HWND hwnd, GUID *pgActionID, LPVOID pWVTData);
  2. typedef CRYPT_PROVIDER_DATA* (__stdcall *FUN_WTHelperProvDataFromStateData)(HANDLE hStateData);
  3. typedef CRYPT_PROVIDER_SGNR * (__stdcall *FUN_WTHelperGetProvSignerFromChain)(CRYPT_PROVIDER_DATA *pProvData, DWORD idxSigner, BOOL fCounterSigner, DWORD idxCounterSigner);
  4. typedef CRYPT_PROVIDER_CERT * (__stdcall *FUN_WTHelperGetProvCertFromChain)(CRYPT_PROVIDER_SGNR *pSgnr,    DWORD idxCert);
  6. typedef WINCRYPT32API DWORD(__stdcall * FUN_CertGetNameStringA)(PCCERT_CONTEXT pCertContext,DWORD dwType,DWORD dwFlags,void *pvTypePara,LPSTR pszNameString,DWORD cchNameString);
  8. typedef HMODULE (__stdcall *FUN_LoadLibraryA)(LPCSTR lpLibFileName);
  9. typedef PVOID(__stdcall *FUN_GetProcAddress)(HMODULE hModule, LPCSTR lpProcName);

全部代码如下：

  2. #include <windows.h>
  3. #include <Softpub.h>
  4. #include <Wincrypt.h>
  7. #define DLL_WINTRUST    "Wintrust.dll"
  8. #define    DLL_CRYPT32        "Crypt32.dll"
  10. #define C_WinVerifyTrust    "WinVerifyTrust"
  11. #define C_WTHelperProvDataFromStateData    "WTHelperProvDataFromStateData"
  12. #define C_WTHelperGetProvSignerFromChain    "WTHelperGetProvSignerFromChain"
  13. #define C_WTHelperGetProvCertFromChain        "WTHelperGetProvCertFromChain"
  14. #define C_CertGetNameStringA                "CertGetNameStringA"
  17. typedef    LONG(__stdcall *FUN_WinVerifyTrust)(HWND hwnd, GUID *pgActionID, LPVOID pWVTData);
  18. typedef CRYPT_PROVIDER_DATA* (__stdcall *FUN_WTHelperProvDataFromStateData)(HANDLE hStateData);
  19. typedef CRYPT_PROVIDER_SGNR * (__stdcall *FUN_WTHelperGetProvSignerFromChain)(CRYPT_PROVIDER_DATA *pProvData, DWORD idxSigner, BOOL fCounterSigner, DWORD idxCounterSigner);
  20. typedef CRYPT_PROVIDER_CERT * (__stdcall *FUN_WTHelperGetProvCertFromChain)(CRYPT_PROVIDER_SGNR *pSgnr,    DWORD idxCert);
  22. typedef WINCRYPT32API DWORD(__stdcall * FUN_CertGetNameStringA)(PCCERT_CONTEXT pCertContext,DWORD dwType,DWORD dwFlags,void *pvTypePara,LPSTR pszNameString,DWORD cchNameString);
  25. typedef HMODULE (__stdcall *FUN_LoadLibraryA)(LPCSTR lpLibFileName);
  26. typedef PVOID(__stdcall *FUN_GetProcAddress)(HMODULE hModule, LPCSTR lpProcName);
  28. typedef struct _DLL_STRUCT
  29. {
  30.     FUN_LoadLibraryA pLoadLibraryA;
  31.     FUN_GetProcAddress pGetProcAddress;
  32.     char StrBuff[128];
  34.     ULONG WinTrusDll;
  35.     ULONG Crypt32Dll;
  36.     ULONG WinVerifyTrust;
  37.     ULONG WTHelperProvDataFromStateData;
  38.     ULONG WTHelperGetProvSignerFromChain;
  39.     ULONG WTHelperGetProvCertFromChain;
  40.     ULONG CertGetNameStringA;
  41. }DLL_STRUCT,*PDLL_STRUCT;
  43. BOOL CheckProcessValid(WCHAR* pProcessName, PDLL_STRUCT pDllST)
  44. {
  45.     GUID guidAction = WINTRUST_ACTION_GENERIC_VERIFY_V2;
  46.     WINTRUST_FILE_INFO sWintrustFileInfo;
  47.     WINTRUST_DATA      sWintrustData;
  48.     HRESULT            hr = 0;
  51.     sWintrustFileInfo.cbStruct = 0;
  52.     sWintrustFileInfo.hFile = 0;
  53.     sWintrustFileInfo.pcwszFilePath = 0;
  54.     sWintrustFileInfo.pgKnownSubject = 0;
  56.     sWintrustData.cbStruct = 0;
  57.     sWintrustData.dwProvFlags = 0;
  58.     sWintrustData.dwStateAction = 0;
  59.     sWintrustData.dwUIChoice = 0;
  60.     sWintrustData.dwUnionChoice = 0;
  61.     sWintrustData.fdwRevocationChecks = 0;
  62.     sWintrustData.hWVTStateData = 0;
  63.     sWintrustData.pBlob = 0;
  64.     sWintrustData.pCatalog = 0;
  65.     sWintrustData.pCert = 0;
  66.     sWintrustData.pFile = 0;
  67.     sWintrustData.pPolicyCallbackData = 0;
  68.     sWintrustData.pSgnr = 0;
  69.     sWintrustData.pSignatureSettings = 0;
  70.     sWintrustData.pSIPClientData = 0;
  71.     sWintrustData.pwszURLReference = 0;
  75.     sWintrustFileInfo.cbStruct = sizeof(WINTRUST_FILE_INFO);
  76.     sWintrustFileInfo.pcwszFilePath = pProcessName;
  77.     sWintrustFileInfo.hFile = NULL;
  79.     sWintrustData.cbStruct = sizeof(WINTRUST_DATA);
  80.     sWintrustData.dwUIChoice = WTD_UI_NONE;
  81.     sWintrustData.fdwRevocationChecks = WTD_REVOKE_NONE;
  82.     sWintrustData.dwUnionChoice = WTD_CHOICE_FILE;
  83.     sWintrustData.pFile = &sWintrustFileInfo;
  84.     sWintrustData.dwStateAction = WTD_STATEACTION_VERIFY;
  88.     HMODULE hWintrust = pDllST->pLoadLibraryA(DLL_WINTRUST);
  89.     FUN_WinVerifyTrust pFUN_WinVerifyTrust = NULL;
  90.     FUN_WTHelperProvDataFromStateData pWTHelperProvDataFromStateData = NULL;
  91.     FUN_WTHelperGetProvSignerFromChain pWTHelperGetProvSignerFromChain = NULL;
  92.     FUN_WTHelperGetProvCertFromChain pWTHelperGetProvCertFromChain = NULL;
  94.     HMODULE hCrypt32 = pDllST->pLoadLibraryA(DLL_CRYPT32);
  95.     FUN_CertGetNameStringA pCertGetNameStringA = NULL;
  97.     do
  98.     {
  99.         if (hWintrust == NULL)
  100.         {
  101.             break;;
  102.         }
  104.         pFUN_WinVerifyTrust = (FUN_WinVerifyTrust)pDllST->pGetProcAddress(hWintrust, C_WinVerifyTrust);
  105.         if (pFUN_WinVerifyTrust == NULL)
  106.         {
  107.             break;
  108.         }
  109.         pWTHelperProvDataFromStateData = (FUN_WTHelperProvDataFromStateData)pDllST->pGetProcAddress(hWintrust, C_WTHelperProvDataFromStateData);
  110.         if (pWTHelperProvDataFromStateData == NULL)
  111.         {
  112.             break;
  113.         }
  115.         pWTHelperGetProvSignerFromChain = (FUN_WTHelperGetProvSignerFromChain)pDllST->pGetProcAddress(hWintrust, C_WTHelperGetProvSignerFromChain);
  116.         if (pWTHelperGetProvSignerFromChain == NULL)
  117.         {
  118.             break;
  119.         }
  121.         pWTHelperGetProvCertFromChain = (FUN_WTHelperGetProvCertFromChain)pDllST->pGetProcAddress(hWintrust, C_WTHelperGetProvCertFromChain);
  122.         if (pWTHelperGetProvCertFromChain == NULL)
  123.         {
  124.             break;
  125.         }
  128.         if (hCrypt32 == NULL)
  129.         {
  130.             break;
  131.         }
  132.         pCertGetNameStringA = (FUN_CertGetNameStringA)pDllST->pGetProcAddress(hCrypt32, C_CertGetNameStringA);
  133.         if (pCertGetNameStringA == NULL)
  134.         {
  135.             break;
  136.         }
  139.         hr = pFUN_WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &guidAction, &sWintrustData);
  141.         if (TRUST_E_NOSIGNATURE == hr)
  142.         {
  143.         //    _tprintf(_T("No signature found on the file.\n"));
  144.             break;
  145.         }
  146.         else if (TRUST_E_BAD_DIGEST == hr)
  147.         {
  148.             //_tprintf(_T("The signature of the file is invalid\n"));
  149.             break;
  150.         }
  151.         else if (TRUST_E_PROVIDER_UNKNOWN == hr)
  152.         {
  153.             //_tprintf(_T("No trust provider on this machine can verify this type of files.\n"));
  154.             break;
  155.         }
  156.         else if (S_OK != hr)
  157.         {
  158.         //    _tprintf(_T("WinVerifyTrust failed with error 0x%.8X\n"), hr);
  159.             break;
  160.         }
  161.         else
  162.         {
  164.             // retreive the signer certificate and display its information
  165.             CRYPT_PROVIDER_DATA const *psProvData = NULL;
  166.             CRYPT_PROVIDER_SGNR       *psProvSigner = NULL;
  167.             CRYPT_PROVIDER_CERT       *psProvCert = NULL;
  168.             FILETIME                   localFt;
  169.             SYSTEMTIME                 sysTime;
  171.             psProvData = pWTHelperProvDataFromStateData(sWintrustData.hWVTStateData);
  172.             if (psProvData)
  173.             {
  174.                 psProvSigner = pWTHelperGetProvSignerFromChain((PCRYPT_PROVIDER_DATA)psProvData, 0, FALSE, 0);
  175.                 if (psProvSigner)
  176.                 {
  177.                     FileTimeToLocalFileTime(&psProvSigner->sftVerifyAsOf, &localFt);
  178.                     FileTimeToSystemTime(&localFt, &sysTime);
  180.                     _tprintf(_T("Signature Date = %.2d/%.2d/%.4d at %.2d:%2.d:%.2d\n"), sysTime.wDay, sysTime.wMonth, sysTime.wYear, sysTime.wHour, sysTime.wMinute, sysTime.wSecond);
  182.                     psProvCert = pWTHelperGetProvCertFromChain(psProvSigner, 0);
  183.                     if (psProvCert)
  184.                     {
  185.                         DWORD dwStrType;
  186.                         DWORD dwCount;
  187.                         LPTSTR szSubjectRDN = NULL;
  188.                         char buff[2048] = { 0 };
  190.                         dwStrType = CERT_X500_NAME_STR;
  191.                         dwCount = pCertGetNameStringA(psProvCert->pCert,
  192.                             CERT_NAME_RDN_TYPE,
  193.                             0,
  194.                             &dwStrType,
  195.                             buff,
  196.                             sizeof(buff));
  197.                         printf("%s\n", buff);
  198.                         dwCount = dwCount;
  199.                     }
  202.                 }
  203.             }
  204.         }
  206.     } while (0);
  208.     if (hWintrust)
  209.     {
  210.         FreeLibrary(hWintrust);
  211.     }
  213.     return TRUE;
  214. }
  216. int _tmain(int argc, _TCHAR* argv[])
  217. {
  218.     PWCHAR pProcessName = L"D:\\KuGou.exe";
  220.     DLL_STRUCT dll;
  221.     dll.pLoadLibraryA = LoadLibraryA;
  222.     dll.pGetProcAddress = (FUN_GetProcAddress)GetProcAddress;
  223.     dll.WinTrusDll = 0;
  224.     memcpy(dll.StrBuff + 0, DLL_WINTRUST, (ULONG)strlen(DLL_WINTRUST) + 1);
  226.     dll.Crypt32Dll = dll.WinTrusDll + (ULONG)strlen(DLL_WINTRUST) + 1;
  227.     memcpy(dll.StrBuff + dll.Crypt32Dll, DLL_CRYPT32, (ULONG)strlen(DLL_CRYPT32) + 1);
  229.     dll.WinVerifyTrust = dll.Crypt32Dll + (ULONG)strlen(DLL_CRYPT32) + 1;
  230.     memcpy(dll.StrBuff + dll.WinVerifyTrust, C_WinVerifyTrust, (ULONG)strlen(C_WinVerifyTrust) + 1);
  232.     dll.WTHelperProvDataFromStateData = dll.WinVerifyTrust + (ULONG)strlen(C_WinVerifyTrust) + 1;
  233.     memcpy(dll.StrBuff + dll.WTHelperProvDataFromStateData, C_WTHelperProvDataFromStateData, (ULONG)strlen(C_WTHelperProvDataFromStateData) + 1);
  235.     dll.WTHelperGetProvSignerFromChain = dll.WTHelperProvDataFromStateData + (ULONG)strlen(C_WTHelperProvDataFromStateData) + 1;
  236.     memcpy(dll.StrBuff + dll.WTHelperGetProvSignerFromChain, C_WTHelperGetProvSignerFromChain, (ULONG)strlen(C_WTHelperGetProvSignerFromChain) + 1);
  238.     dll.WTHelperGetProvCertFromChain = dll.WTHelperGetProvSignerFromChain + (ULONG)strlen(C_WTHelperGetProvSignerFromChain) + 1;
  239.     memcpy(dll.StrBuff + dll.WTHelperGetProvCertFromChain, C_WTHelperGetProvCertFromChain, (ULONG)strlen(C_WTHelperGetProvCertFromChain) + 1);
  241.     dll.CertGetNameStringA = dll.WTHelperGetProvCertFromChain + (ULONG)strlen(C_WTHelperGetProvCertFromChain) + 1;
  242.     memcpy(dll.StrBuff + dll.CertGetNameStringA, C_CertGetNameStringA, (ULONG)strlen(C_CertGetNameStringA) + 1);
  244.     CheckProcessValid(pProcessName, &dll);
  246.     return 0;
  247. }

运行结果：

  1. Signature Date = 13/08/2020 at 22:15:50
  2. C=CN, S=Guangdong, L=Guangzhou, O="Guangzhou KuGou Computer Technology Co., Ltd.", OU=IT, CN="Guangzhou KuGou Computer Technology Co., Ltd."

运行结果

Windows下隐藏盘符
使用临界区封装的自解锁CAutoLock

0 篇笔记 写笔记

获取应用程序数字签名
一般的应用程序在正式发布前都会进行数字签名。如我们经常听歌的酷狗音乐，其通过查看文件属性，可以看到数字签名如下：那么怎么通过编程来获取数字签名的内容？数字签名的获取一般是需要动态载入以下DLL:Wintrust.dllCrypt32.dll相关的函数#define C_WinVerify......
win10企业版64位如何永久禁用驱动数字签名
在win10下用一个命令就可以禁用驱动程序强制签名禁止强制签名，以管理员的身份运行cmd 执行以下命令bcdedit.exe /set nointegritychecks on恢复默认验证，执行如下命令即可：bcdedit.exe /set nointegritychecks off......
win10，Win11如何关闭数字签名认证
数字签名认证可以让系统不加载未经过WHQL或者EV授权的的驱动程序的加载。但是我们在实际使用过程中，经常要调试，所以关闭数字签名证书就很有必要。win10，Win11如何关闭数字签名认证1、在桌面开始菜单中击右键，在弹出的菜单中选择“以管理员身份运行命令行窗口”页面。2、在打开的命令窗口页面中输入......
Win11怎么禁用驱动程序强制签名? 关闭Win11驱动强制签名的技巧
什么是驱动程序签名驱动程序签名又叫做驱动程序的数字签名，它是由微软的Windows硬件设备质量实验室完成的。硬件开发商将自己的硬件设备和相应的驱动程序交给该实验室，由实验室对其进行测试，测试合格后实验室将在其驱动程序中添加数字签名。由于数字签名是由微软完成的。Win11设备只有安装了驱动才能正常使......
作者信息
我爱内核
Windows驱动开发，网站开发
好好学习，天天向上。
  • ARP
  • ASIO
  • 文件系统
  • Win32应用层
  • Windows基础
  • WIKI
    • 取消
    感谢您的支持，我会继续努力的!
    扫码支持
    扫码打赏，你说多少就多少

    打开支付宝扫一扫，即可进行扫码打赏哦

    您的支持，是我们前进的动力！