WinVerifyTrust校验文件内置签名实例.docx
- 文档编号:5861484
- 上传时间:2023-01-01
- 格式:DOCX
- 页数:17
- 大小:23.61KB
WinVerifyTrust校验文件内置签名实例.docx
《WinVerifyTrust校验文件内置签名实例.docx》由会员分享,可在线阅读,更多相关《WinVerifyTrust校验文件内置签名实例.docx(17页珍藏版)》请在冰豆网上搜索。
WinVerifyTrust校验文件内置签名实例
WinVerifyTrustFunction
TheWinVerifyTrustfunctionperformsatrustverificationactiononaspecifiedobject.Thefunctionpassestheinquirytoathatsupportstheactionidentifier,ifoneexists.
Forcertificateverification,usetheandfunctions.
Syntax
LONGWINAPIWinVerifyTrust(
__in HWNDhWnd,
__in GUID*pgActionID,
__in LPVOIDpWVTData
);
Parameters
hWnd[in]
Optionalhandletoacallerwindow.Atrustprovidercanusethisvaluetodeterminewhetheritcaninteractwiththeuser.However,trustproviderstypicallyperformverificationactionswithoutinputfromtheuser.
Thisparametercanbeoneofthefollowingvalues.
Value
Meaning
INVALID_HANDLE_VALUE
Thereisnointeractiveuser.Thetrustproviderperformstheverificationactionwithouttheuser'sassistance.
Zero
Thetrustprovidercanusetheinteractivedesktoptodisplayitsuserinterface.
Avalidwindowhandle
AtrustprovidercantreatanyvalueotherthanINVALID_HANDLE_VALUEorzeroasavalidwindowhandlethatitcanusetointeractwiththeuser.
pgActionID[in]
ApointertoaGUIDstructurethatidentifiesanactionandthetrustproviderthatsupportsthataction.ThisvalueindicatesthetypeofverificationactiontobeperformedonthestructurepointedtobypWinTrustData.
TheWinTrustserviceisdesignedtoworkwithtrustprovidersimplementedbythirdparties.Eachtrustproviderprovidesitsownuniquesetofactionidentifiers.Forinformationabouttheactionidentifierssupportedbyatrustprovider,seethedocumentationforthattrustprovider.
Forexample,MicrosoftprovidesaSoftwarePublisherTrustProviderthatcanestablishthetrustworthinessofsoftwarebeingdownloadedfromtheInternetorsomeotherpublicnetwork.TheSoftwarePublisherTrustProvidersupportsthefollowingactionidentifiers.Theseconstantsaredefinedin.
Value
Meaning
DRIVER_ACTION_VERIFY
VerifytheauthenticityofaWindowsHardwareQualityLabs(WHQL)signeddriver.ThisisanAuthenticodeadd-onpolicyprovider.
HTTPSPROV_ACTION
VerifyanSSL/TLSconnectionthroughInternetExplorer.
OFFICESIGN_ACTION_VERIFY
VerifytheauthenticityofastructuredstoragefilebyusingtheMicrosoftOfficeAuthenticodeadd-onpolicyprovider.
Note ThisActionIDisonlysupportedonWindowsServer 2003,Windows XP,andWindows 2000.
WINTRUST_ACTION_GENERIC_CERT_VERIFY
Verifyacertificatechainonly.ThisisonlyvalidwhenpassinginacertificatecontextintheWinVerifyTrustinputstructures.
Note Wedonotrecommendusingthisfunctiontoperformcertificateverification.Toperformcertificateverification,usetheandfunctions.
WINTRUST_ACTION_GENERIC_CHAIN_VERIFY
Verifycertificatechainscreatedfromanyobjecttype.Acallbackisprovidedtoimplementthefinalchainpolicybyusingthechaincontextforeachsignerandcountersigner.
WINTRUST_ACTION_GENERIC_VERIFY
Verifyacertificatechainonly.
Note Wedonotrecommendusingthisfunctiontoperformcertificateverification.Toperformcertificateverification,usetheandfunctions.
WINTRUST_ACTION_GENERIC_VERIFY_V2
VerifyafileorobjectusingtheAuthenticodepolicyprovider.
WINTRUST_ACTION_TRUSTPROVIDER_TEST
WritethestructuretoafileaftercallingtheAuthenticodepolicyprovider.
pWVTData[in]
Apointerthat,whencastasastructure,containsinformationthatthetrustproviderneedstoprocessthespecifiedactionidentifier.Typically,thestructureincludesinformationthatidentifiestheobjectthatthetrustprovidermustevaluate.
Theformatofthestructuredependsontheactionidentifier.Forinformationaboutthedatarequiredforaspecificactionidentifier,seethedocumentationforthetrustproviderthatsupportsthataction.
ReturnValue
Ifthetrustproviderverifiesthatthesubjectistrustedforthespecifiedaction,thereturnvalueiszero.Noothervaluebesideszeroshouldbeconsideredasuccessfulreturn.
Ifthetrustproviderdoesnotverifythatthesubjectistrustedforthespecifiedaction,thefunctionreturnsastatuscodefromthetrustprovider.
Note ThereturnvalueisaLONG,notanHRESULTaspreviouslydocumented.DonotuseHRESULTmacrossuchasSUCCEEDEDtodeterminewhetherthefunctionsucceeded.Instead,checkthereturnvalueforequalitytozero.
Forexample,atrustprovidermightindicatethatthesubjectisnottrusted,oristrustedbutwithlimitationsorwarnings.Thereturnvaluecanbeatrust-provider-specificvaluedescribedinthedocumentationforanindividualtrustprovider,oritcanbeoneofthefollowingerrorcodes.
Returncode
Description
TRUST_E_SUBJECT_NOT_TRUSTED
Thesubjectfailedthespecifiedverificationaction.Mosttrustprovidersreturnamoredetailederrorcodethatdescribesthereasonforthefailure.
TRUST_E_PROVIDER_UNKNOWN
Thetrustproviderisnotrecognizedonthissystem.
TRUST_E_ACTION_UNKNOWN
Thetrustproviderdoesnotsupportthespecifiedaction.
TRUST_E_SUBJECT_FORM_UNKNOWN
Thetrustproviderdoesnotsupporttheformspecifiedforthesubject.
Remarks
TheWinVerifyTrustfunctionenablesapplicationstoinvokeatrustprovidertoverifythataspecifiedobjectsatisfiesthecriteriaofaspecifiedverificationoperation.ThepgActionIDparameteridentifiestheverificationoperation,andthepWinTrustDataparameteridentifiestheobjectwhosetrustistobeverified.AtrustproviderisaDLLregisteredwithWinVerifyTrust.AcalltoWinVerifyTrustforwardsthatcalltotheregisteredtrustprovider,ifthereisone,thatsupportsthatspecifiedactionidentifier.
Forexample,theSoftwarePublisherTrustProvidercanverifythatanexecutableimagefilecomesfromatrustedsoftwarepublisherandthatthefilehasnotbeenmodifiedsinceitwaspublished.Inthiscase,thepWinTrustDataparameterspecifiesthenameofthefileandthetypeoffile,suchasaMicrosoftimagefile.
Eachtrustprovidersupportsaspecificsetofactionsthatitcanevaluate.EachactionhasaGUIDthatidentifiesit.Atrustprovidercansupportanynumberofactionidentifiers,buttwotrustproviderscannotsupportthesameactionidentifier.
Foranexamplethatdemonstrateshowtousethisfunctiontoverifythesignatureofaportableexecutable(PE)file,see.
Requirements
Minimumsupportedclient
Windows 2000Professional
Minimumsupportedserver
Windows 2000Server
Header
(include
Library
DLL
ExampleCProgram:
VerifyingtheSignatureofaPEFile
TheAPIcanbeusedtoverifythesignatureofaportableexecutablefile.
ThefollowingexampleshowshowtousetheAPItoverifythesignatureofasignedportableexecutablefile.
Allrightsreserved.
#define_UNICODE1
#defineUNICODE1
#include<>
#include<>
#include<>
#include<>
#include<>
#include<>
#include<>
#pragmacomment(lib,"wintrust")
BOOLVerifyEmbeddedSignature(LPCWSTRpwszSourceFile)
{
LONGlStatus;
DWORDdwLastError;
WINTRUST_FILE_INFOFileData;
memset(&FileData,0,sizeof(FileData));
=sizeof(WINTRUST_FILE_INFO);
=pwszSourceFile;
=NULL;
=NULL;
/*
WVTPolicyGUIDspecifiesthepolicytoapplyonthefile
WINTRUST_ACTION_GENERIC_VERIFY_V2policychecks:
1)Thecertificateusedtosignthefilechainsuptoaroot
certificatelocatedinthetrustedrootcertificatestore.This
impliesthattheidentityofthepublisherhasbeenverifiedby
acertificationauthority.
2)Incaseswhereuserinterfaceisdisplayed(whichthisexample
doesnotdo),WinVerifyTrustwillcheckforwhetherthe
endentitycertificateisstoredinthetrustedpublisherstore,
implyingthattheusertrustscontentfromthispublisher.
3)Theendentitycertificatehassufficientpermissiontosign
code,asindicatedbythepresenceofacodesigningEKUorno
EKU.
*/
GUIDWVTPolicyGUID=WINTRUST_ACTION_GENERIC_VERIFY_V2;
WINTRUST_DATAWinTrustData;
memset(&WinTrustData,0,sizeof(WinTrustData));
=sizeof(WinTrustData);
=NULL;
=NULL;
=WTD_UI_NONE;
=WTD_REVOKE_NONE;
=WTD_CHOICE_FILE;
=0;
=NULL;
=NULL;
=0;
=&FileData;
lStatus=WinVerifyTrust(
NULL,
&WVTPolicyGUID,
&WinTrustData);
switch(lStatus)
{
caseERROR_SUCCESS:
/*
Signedfile:
-Hashthatrepresentsthesubjectistrusted.
-Trustedpublisherwithoutanyverificationerrors.
-UIwasdisabledindwUIChoice.Nopublisheror
timestampchainerrors.
-UIwasenabledindwUIChoiceandtheuserclicked
"Yes"whenaskedtoinstallandrunthesigned
subject.
*/
wprintf_s(L"Thefile\"%s\"issignedandthesignature"
L"wasverified.\n",
pwszSourceFile);
break;
caseTRUST_E_NOSIGNATURE:
dwLastError=GetLastError();
if(TRUST_E_NOSIGNATURE==dwLastError||
TRUST_E_SUBJECT_FORM_UNKNOWN==dwLastError||
TRUST_E_PROVIDER_UNKNOWN==dwLastError)
{
wprintf_s(L"Thefile\"%s\"isnotsigned.\n",
pwszSourceFile);
}
else
{
wprintf_s(L"Anunknownerroroccurredtryingto"
L"verifythesignatureofthe\"%s\"file.\n",
pwszSourceFile);
}
break;
caseTRUST_E_EXPLICIT_DISTRUST:
wprintf_s(L"Thesignatureispresent,butspecifically"
L"disallowed.\n");
break;
caseTRUST_E_SUBJECT_NOT_TRUSTED:
wprintf_s(L"Thesignatureispresent,butnot"
L"trusted.\n");
break;
caseCRYPT_E_SECURITY_SETTINGS:
/*
Thehashthatrepresentsthesubjectorthepublisher
wasnotexplicitlytrustedbytheadminandthe
adminpolicyhasdisabledusertrust.Nosignature,
publisherortimestamperrors.
*/
wprintf_s(L"CRYPT_E_SECURITY_SETTINGS-Thehash"
L"representingthesubjectorthepublisherwasn't"
L"explicitlytrustedbytheadminandadminpolicy"
L"hasdisabledusertrust.Nosignature,publisher"
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- WinVerifyTrust 校验 文件 内置 签名 实例