Validating a Code Signing Certificate on a Windows Application

user_5305770 0
Viewed 1084

I am trying to programmatically validate a code signing certificate as described in this question from 2014. After following the suggestions, I am still not able to find a consistent working solution to determine when my .exe has been tampered with (i.e. the hash no longer matches)

The WinVerifyTrust method from wintrust.dll is the most accurate however I seem to getting a false positive after my executable has been obfuscated/VM'd. In this scenario, I am getting a result of (int)2148204800 even though the .exe is validly signed and un-tampered with. I am also averse to using Windows API calls as I want the code to be as portable as possible.

The other methods such as X509Certificate.CreateFromSignedFile().Verify() and the Powershell method of course do not validate the exe's hash so return true.

Is there any new way that's come about in the last 4 years to validate the hash of the .exe, preferably in pure .NET? I am happy with a solution that simply validates that the hash and not the entire certificate (if that's possible).

.net c#
1 Answers

If you pull from Mono.Security as a Nuget Package they have a nice AuthenticodeDeformatter class that will verify code signing certificates:

var authenticode = new AuthenticodeDeformatter(Filename);
authenticode.IsTrusted(); //Should return False if tampered with.
user_8473830
Related