Code signing DLLs

[NewsArchive]

Hi Friedrich,

Happy New Year:)

Not exactly SB related, but I know you have messed with code signing
an awful lot, so I hope you don't mind me picking your brain for a
sec.

In a program I'm developing I will open it up for other developers to
write plugins in DLL form. There may be concern about code signing
the dlls to provide some level of security.

1. Is it customary to code sign dlls in this kind of situation?
Would SB have any problems code signing dlls for example?

2. Is it possible to check the code signing information - or check if
a dll is code signed or not via some apis?

Best regards,

Arnór Baldvinsson
Icetips Creative, Inc.
San Antonio, Texas, USA
www.icetips.com


Subscribe to information from Icetips.com:
http://www.icetips.com/subscribe.php

[NewsArchive]

Hi Arnór,

Happy New Year :)

First of all, SetupBuilder would not have any problems with code-signed
DLLs. If the plug-in DLLs are distributed to others, it's a good idea to
code-sign. Code-signing DLLs gives the recipient of the component the
ability to verify that what they received is what was made and it hasn't
been tampered with.

There is a cool feature in a SetupBuilder installer to check the code-sign
status of a file. See "Get File Information -> Verify Trust"

This function lets you retrieve the code-sign status. The following return
values are defined (a value > 0 means that the file is signed with a valid
certificate):

1 — File is signed. The certificate is valid and not expired.
0 — Fatal VerifyTrust initialization failure.
-2 — VerifyTrust failed: Generic Verify V2 Provider Unknown.
-3 — VerifyTrust failed: Unsigned executable or unsigned application file.
-4 — VerifyTrust failed: Certificate Marked as Untrusted by the user.
-5 — VerifyTrust failed: File is not trusted.
-6 — VerifyTrust failed: Executable has been modified.
-7 — VerifyTrust failed: local security options prevent verification.
-8 — VerifyTrust failed: Certificate expired.

The same functionality is available in the "#get file information..."
compiler directive to handle this at compile time!

What do you think?

Friedrich

--
Friedrich Linder
Lindersoft
www.lindersoft.com
+1.954.252.3910

"point. click. ship" - that's SetupBuilder 6.7
Create Windows Vista ready installations in minutes

-- Official Comodo Code Signing and SSL Certificate Partner

[NewsArchive]

Hi Friedrich,

>There is a cool feature in a SetupBuilder installer to check the code-sign
>status of a file. See "Get File Information -> Verify Trust"

Ok, but this is something I have no control over. I need to be able
to check this in _my_ program, not SB. I.e. my customer installs my
software on his/her computer. He could then purchase a plugin from
another developer or company. I would like to be able to check, in my
software, if the plugin dll is code signed or not. All that I know is
where the DLL is and what it's called and a single exported function
in it.

I was digging through MSDN last night but I could not find anything on
how I can detect if a dll (or exe for that matter) is code signed.

Best regards,

Arnór Baldvinsson
Icetips Creative, Inc.
San Antonio, Texas, USA
www.icetips.com


Subscribe to information from Icetips.com:
http://www.icetips.com/subscribe.php

[NewsArchive]

Hi Arnór,

> Ok, but this is something I have no control over. I need to be able
> to check this in _my_ program, not SB. I.e. my customer installs my
> software on his/her computer. He could then purchase a plugin from
> another developer or company. I would like to be able to check, in my
> software, if the plugin dll is code signed or not. All that I know is
> where the DLL is and what it's called and a single exported function
> in it.
>
> I was digging through MSDN last night but I could not find anything on
> how I can detect if a dll (or exe for that matter) is code signed.

Aha, I understand. What about writing a small command line helper
application with SetupBuilder and call it from your application to check the
code-sign status? Should work fine.

See attached code snipped. What do you think?

Friedrich

[NewsArchive]

BTW, I can upload the script if you are interested. It compiles into a
small 136 KB command line application executable to check the file code-sign
status.

Friedrich

[NewsArchive]

Hi Friedrish,

>BTW, I can upload the script if you are interested. It compiles into a
>small 136 KB command line application executable to check the file code-sign
>status.

Ah, you're sneaky, I like!<g> Hadn't thought of using SB to write
regular programs, but I guess that works just fine<g> I would love to
get my hands on the script:)

Best regards,

Arnór Baldvinsson
Icetips Creative, Inc.
San Antonio, Texas, USA
www.icetips.com


Subscribe to information from Icetips.com:
http://www.icetips.com/subscribe.php

[NewsArchive]

In addition to the options within SB that Friedrich's reply outlines, if
you've downloaded the SDK from MS and have signtool.exe you can use it to
check.

I have two one-line batch files for that purpose, one with and one without
the "verbose" switch:

verbose batch command:
signtool verify /pa /v %1

concise batch command:
signtool verify /pa %1

Jane Fleming

[NewsArchive]

Hi Jane,

>In addition to the options within SB that Friedrich's reply outlines, if
>you've downloaded the SDK from MS and have signtool.exe you can use it to
>check.

I was looking at this package
(http://msdn2.microsoft.com/en-us/library/ms537364(VS.85).aspx)
yesterday but I could not see that these are redistributable same with
the information on Signtool.exe
(http://msdn2.microsoft.com/en-us/library/aa387764.aspx)

Best regards,

Arnór Baldvinsson
Icetips Creative, Inc.
San Antonio, Texas, USA
www.icetips.com


Subscribe to information from Icetips.com:
http://www.icetips.com/subscribe.php

[NewsArchive]

> Ah, you're sneaky, I like!<g> Hadn't thought of using SB to write
> regular programs, but I guess that works just fine<g> I would love to
> get my hands on the script:)

I do that in PageSnip.

My user configuration is a SB app that can be started with different
command line parameters.

It is called one way in the post install and another way from a
ShellExecute option in my Clarion app.

The cool thing about this is that the user experience is the same and I
didn't have to write the code twice to get it done!

Plus the config wizard is only about 170K.

;-)

Charles



--
-------------------------------------------------------------------------------------------------------
Charles Edmonds

www.clarionproseries.com - "Serious imaging tools for Clarion Developers"
www.ezround.com - "Round Corner HTML tables with matching Banners, Buttons
and Forms!"
www.lansrad.com - "Intelligent Solutions for Universal Problems"
www.fotokiss.com - "World's Best Auction Photo Editor"
-------------------------------------------------------------------------------------------------------

[NewsArchive]

Hi Arnór,

>>BTW, I can upload the script if you are interested. It compiles into a
>>small 136 KB command line application executable to check the file
>>code-sign
>>status.
>
> Ah, you're sneaky, I like!<g> Hadn't thought of using SB to write
> regular programs, but I guess that works just fine<g> I would love to
> get my hands on the script:)

<G> :)

The fully featured command line tool (including source code) is available
at:

http://www.setupbuilder.com/projects/checkstatus.zip

The following code can be used from your application:

RUN( 'c:\checkstatus.exe c:\sbuilder.exe' , 1 )
IF RUNCODE() = 1 THEN
MESSAGE( 'File is signed. The certificate is valid and not expired.' )
ELSIF RUNCODE() = 0 THEN
MESSAGE( 'No signature, invalid, or VerifyTrust failed error.' )
ELSE MESSAGE( 'Errorcode: ' & RUNCODE())
END

The SetupScript source code looks like this (see attached screenshot).

Friedrich

--
Friedrich Linder
Lindersoft
www.lindersoft.com
+1.954.252.3910

"point. click. ship" - that's SetupBuilder 6.7
Create Windows Vista ready installations in minutes

-- Official Comodo Code Signing and SSL Certificate Partner

[NewsArchive]

Hi Friedrich,

>The fully featured command line tool (including source code) is available
>at:
>
>http://www.setupbuilder.com/projects/checkstatus.zip

Thank you so much for this:) Now I can add this as an option for my
program to check plugin dlls for code signing, COOL:)

Best regards,

Arnór Baldvinsson
Icetips Creative, Inc.
San Antonio, Texas, USA
www.icetips.com


Subscribe to information from Icetips.com:
http://www.icetips.com/subscribe.php

[NewsArchive]

Hi Arnór,

> Thank you so much for this:) Now I can add this as an option for my
> program to check plugin dlls for code signing, COOL:)

You are very welcome :-)

Friedrich

[NewsArchive]

Hi Friedrich,

>RUN( 'c:\checkstatus.exe c:\sbuilder.exe' , 1 )

Couple of things:

Code like:

F String(2048)
Code
If FileDialog(...)
Run('checkstatus.exe ' & F)
End

will fail unless you use Clip() or ShortPath() or something around the
F (I presume that a " " pair would work also). If you use a CString
there is no problem.

I would get error -2 (file not found) from the script every time until
I realized I was using a string and not a cstring<g>

Works perfectly:)

Best regards,

Arnór Baldvinsson
Icetips Creative, Inc.
San Antonio, Texas, USA
www.icetips.com


Subscribe to information from Icetips.com:
http://www.icetips.com/subscribe.php

[NewsArchive]

Hi Arnór,

>>RUN( 'c:\checkstatus.exe c:\sbuilder.exe' , 1 )
>
> Couple of things:
>
> Code like:
>
> F String(2048)
> Code
> If FileDialog(...)
> Run('checkstatus.exe ' & F)
> End
>
> will fail unless you use Clip() or ShortPath() or something around the
> F (I presume that a " " pair would work also). If you use a CString
> there is no problem.
>
> I would get error -2 (file not found) from the script every time until
> I realized I was using a string and not a cstring<g>

Yes, there is a comment line size limit. The above sends a 2,048 byte
string to the command line.

>
> Works perfectly:)
>

COOL :)

Friedrich

[NewsArchive]

Hi Arnór,

BTW, interesting finding. I’d even go so far to call it a SetupBuilder
limitation. Fixed now!

I have increased the command line limit and the installer does an automatic
command line "trim" now. It works even with your String declaration now.

Thanks again!

Friedrich

[NewsArchive]

Hi Friedrich,

>BTW, interesting finding. I’d even go so far to call it a SetupBuilder
>limitation. Fixed now!
>
>I have increased the command line limit and the installer does an automatic
>command line "trim" now. It works even with your String declaration now.
>
>Thanks again!

Thanks:) Not a big deal for this. I usually use CStrings for things
like this...

Now...<g> Do you know of a way to open the file properties window on
the Digital Signatures tab? I can use the shell to open the
properties window, but it would be cool to be able to pop it up right
on the DS tab for a signed dll. Or, alternatively, open the Digital
Signature Information window some other way. I have posted a question
on the msdn forum about this. Will be interesting to see what comes
back:)

You'll appreciate this: I did a seach on Google for "view code sign
information" (without the quotes). THIS thread showed up as the 4th
link<g> (http://www.lindersoft.com/forums/showthread.php?p=15657)

Best regards,

Arnór Baldvinsson
Icetips Creative, Inc.
San Antonio, Texas, USA
www.icetips.com


Subscribe to information from Icetips.com:
http://www.icetips.com/subscribe.php

[NewsArchive]

Hi Arnór,

> Now...<g> Do you know of a way to open the file properties window on
> the Digital Signatures tab? I can use the shell to open the
> properties window, but it would be cool to be able to pop it up right
> on the DS tab for a signed dll. Or, alternatively, open the Digital
> Signature Information window some other way. I have posted a question
> on the msdn forum about this. Will be interesting to see what comes
> back:)

I know how to handle this. Do you need something to be called from your
Clarion application or from the SetupBuilder script?

>
> You'll appreciate this: I did a seach on Google for "view code sign
> information" (without the quotes). THIS thread showed up as the 4th
> link<g> (http://www.lindersoft.com/forums/showthread.php?p=15657)

COOL ;-)

Friedrich

[NewsArchive]

Hi Friedrich,

>I know how to handle this. Do you need something to be called from your
>Clarion application or from the SetupBuilder script?

Clarion or VC++. If you have some C code or apis to get me started I
would very much appreciate it:)

Best regards,

Arnór Baldvinsson
Icetips Creative, Inc.
San Antonio, Texas, USA
www.icetips.com


Subscribe to information from Icetips.com:
http://www.icetips.com/subscribe.php

[NewsArchive]

Hi Arnór,

> Clarion or VC++. If you have some C code or apis to get me started I
> would very much appreciate it:)

The following VC++ code can do it:

long SB_OpenFileProperties(HWND hwnd, char
*szPathOfFileToLaunchPropertiesOf)
{
SHELLEXECUTEINFO sei;

ZeroMemory(&sei, sizeof(sei));
sei.cbSize = sizeof(sei);
sei.hwnd = hwnd;
sei.lpFile = szPathOfFileToLaunchPropertiesOf;
sei.lpVerb = "properties";
sei.fMask = SEE_MASK_INVOKEIDLIST;
sei.lpParameters = "";
sei.lpDirectory = NULL;
sei.nShow = SW_SHOW;
sei.hInstApp = NULL;

ShellExecuteEx(&sei);

return 0;
}

Friedrich

--
Friedrich Linder
Lindersoft
www.lindersoft.com
+1.954.252.3910

"point. click. ship" - that's SetupBuilder 6.7
Create Windows Vista ready installations in minutes

-- Official Comodo Code Signing and SSL Certificate Partner

[NewsArchive]

Hi Friedrich,

> ZeroMemory(&sei, sizeof(sei));
> sei.cbSize = sizeof(sei);
> sei.hwnd = hwnd;
> sei.lpFile = szPathOfFileToLaunchPropertiesOf;
> sei.lpVerb = "properties";
> sei.fMask = SEE_MASK_INVOKEIDLIST;
> sei.lpParameters = "";
> sei.lpDirectory = NULL;
> sei.nShow = SW_SHOW;
> sei.hInstApp = NULL;
>
> ShellExecuteEx(&sei);

Yes, I have had this in my Utilities for a while:)
(ITShellClass.ShowFilePropertyWindow) What I'm looking for is either
to open the properties on the "Digital Signatures" tab or open the
"Digital Signatures Information" window directly. That way a user
could jump directly to the signer information instead of having to
open the properties for the dll/exe and then select the "Digital
Signatures" and then start drilling down.

Best regards,

Arnór Baldvinsson
Icetips Creative, Inc.
San Antonio, Texas, USA
www.icetips.com


Subscribe to information from Icetips.com:
http://www.icetips.com/subscribe.php

[NewsArchive]

Hi Arnór,

Try to set lpParameters to the title of the tab.

For example:

sei.lpParameters = "Digital Signatures";

This "should" select the Digital Signatures. IMO, it's not possible to
directly open the "Digital Signatures Information" window.

Does this work? I am at home right now and don't have access to VS.

Friedrich

[NewsArchive]

Hi Friedrich,

>Hi Arnór,
>
>Try to set lpParameters to the title of the tab.
>
>For example:
>
>sei.lpParameters = "Digital Signatures";

Thanks, I'll give it a try later today:)

Best regards,

Arnór Baldvinsson
Icetips Creative, Inc.
San Antonio, Texas, USA
www.icetips.com


Subscribe to information from Icetips.com:
http://www.icetips.com/subscribe.php

[NewsArchive]

Hi Friedrich,

>Try to set lpParameters to the title of the tab.
>
>For example:
>
>sei.lpParameters = "Digital Signatures";

Works perfectly:):)

Best regards,

Arnór Baldvinsson
Icetips Creative, Inc.
San Antonio, Texas, USA
www.icetips.com


Subscribe to information from Icetips.com:
http://www.icetips.com/subscribe.php

[NewsArchive]

>>Try to set lpParameters to the title of the tab.
>>
>>For example:
>>
>>sei.lpParameters = "Digital Signatures";
>
> Works perfectly:):)

COOL :)

Friedrich