WinVerifyTrust校验文件内置签名实例.docx

资源描述

WinVerifyTrust校验文件内置签名实例.docx

《WinVerifyTrust校验文件内置签名实例.docx》由会员分享，可在线阅读，更多相关《WinVerifyTrust校验文件内置签名实例.docx（17页珍藏版）》请在冰豆网上搜索。

WinVerifyTrust校验文件内置签名实例.docx

WinVerifyTrust校验文件内置签名实例

WinVerifyTrustFunction

TheWinVerifyTrustfunctionperformsatrustverificationactiononaspecifiedobject.Thefunctionpassestheinquirytoathatsupportstheactionidentifier,ifoneexists.

Forcertificateverification,usetheandfunctions.

Syntax

LONGWINAPIWinVerifyTrust（

__in HWNDhWnd,

__in GUID*pgActionID,

__in LPVOIDpWVTData

）;

Parameters

hWnd[in]

Optionalhandletoacallerwindow.Atrustprovidercanusethisvaluetodeterminewhetheritcaninteractwiththeuser.However,trustproviderstypicallyperformverificationactionswithoutinputfromtheuser.

Thisparametercanbeoneofthefollowingvalues.

Value

Meaning

INVALID_HANDLE_VALUE

Thereisnointeractiveuser.Thetrustproviderperformstheverificationactionwithouttheuser'sassistance.

Zero

Thetrustprovidercanusetheinteractivedesktoptodisplayitsuserinterface.

Avalidwindowhandle

AtrustprovidercantreatanyvalueotherthanINVALID_HANDLE_VALUEorzeroasavalidwindowhandlethatitcanusetointeractwiththeuser.

pgActionID[in]

ApointertoaGUIDstructurethatidentifiesanactionandthetrustproviderthatsupportsthataction.ThisvalueindicatesthetypeofverificationactiontobeperformedonthestructurepointedtobypWinTrustData.

TheWinTrustserviceisdesignedtoworkwithtrustprovidersimplementedbythirdparties.Eachtrustproviderprovidesitsownuniquesetofactionidentifiers.Forinformationabouttheactionidentifierssupportedbyatrustprovider,seethedocumentationforthattrustprovider.

Forexample,MicrosoftprovidesaSoftwarePublisherTrustProviderthatcanestablishthetrustworthinessofsoftwarebeingdownloadedfromtheInternetorsomeotherpublicnetwork.TheSoftwarePublisherTrustProvidersupportsthefollowingactionidentifiers.Theseconstantsaredefinedin.

Value

Meaning

DRIVER_ACTION_VERIFY

VerifytheauthenticityofaWindowsHardwareQualityLabs（WHQL）signeddriver.ThisisanAuthenticodeadd-onpolicyprovider.

HTTPSPROV_ACTION

VerifyanSSL/TLSconnectionthroughInternetExplorer.

OFFICESIGN_ACTION_VERIFY

VerifytheauthenticityofastructuredstoragefilebyusingtheMicrosoftOfficeAuthenticodeadd-onpolicyprovider.

Note ThisActionIDisonlysupportedonWindowsServer 2003,Windows XP,andWindows 2000.

WINTRUST_ACTION_GENERIC_CERT_VERIFY

Verifyacertificatechainonly.ThisisonlyvalidwhenpassinginacertificatecontextintheWinVerifyTrustinputstructures.

Note Wedonotrecommendusingthisfunctiontoperformcertificateverification.Toperformcertificateverification,usetheandfunctions.

WINTRUST_ACTION_GENERIC_CHAIN_VERIFY

Verifycertificatechainscreatedfromanyobjecttype.Acallbackisprovidedtoimplementthefinalchainpolicybyusingthechaincontextforeachsignerandcountersigner.

WINTRUST_ACTION_GENERIC_VERIFY

Verifyacertificatechainonly.

Note Wedonotrecommendusingthisfunctiontoperformcertificateverification.Toperformcertificateverification,usetheandfunctions.

WINTRUST_ACTION_GENERIC_VERIFY_V2

VerifyafileorobjectusingtheAuthenticodepolicyprovider.

WINTRUST_ACTION_TRUSTPROVIDER_TEST

WritethestructuretoafileaftercallingtheAuthenticodepolicyprovider.

pWVTData[in]

Apointerthat,whencastasastructure,containsinformationthatthetrustproviderneedstoprocessthespecifiedactionidentifier.Typically,thestructureincludesinformationthatidentifiestheobjectthatthetrustprovidermustevaluate.

Theformatofthestructuredependsontheactionidentifier.Forinformationaboutthedatarequiredforaspecificactionidentifier,seethedocumentationforthetrustproviderthatsupportsthataction.

ReturnValue

Ifthetrustproviderverifiesthatthesubjectistrustedforthespecifiedaction,thereturnvalueiszero.Noothervaluebesideszeroshouldbeconsideredasuccessfulreturn.

Ifthetrustproviderdoesnotverifythatthesubjectistrustedforthespecifiedaction,thefunctionreturnsastatuscodefromthetrustprovider.

Note ThereturnvalueisaLONG,notanHRESULTaspreviouslydocumented.DonotuseHRESULTmacrossuchasSUCCEEDEDtodeterminewhetherthefunctionsucceeded.Instead,checkthereturnvalueforequalitytozero.

Forexample,atrustprovidermightindicatethatthesubjectisnottrusted,oristrustedbutwithlimitationsorwarnings.Thereturnvaluecanbeatrust-provider-specificvaluedescribedinthedocumentationforanindividualtrustprovider,oritcanbeoneofthefollowingerrorcodes.

Returncode

Description

TRUST_E_SUBJECT_NOT_TRUSTED

Thesubjectfailedthespecifiedverificationaction.Mosttrustprovidersreturnamoredetailederrorcodethatdescribesthereasonforthefailure.

TRUST_E_PROVIDER_UNKNOWN

Thetrustproviderisnotrecognizedonthissystem.

TRUST_E_ACTION_UNKNOWN

Thetrustproviderdoesnotsupportthespecifiedaction.

TRUST_E_SUBJECT_FORM_UNKNOWN

Thetrustproviderdoesnotsupporttheformspecifiedforthesubject.

Remarks

TheWinVerifyTrustfunctionenablesapplicationstoinvokeatrustprovidertoverifythataspecifiedobjectsatisfiesthecriteriaofaspecifiedverificationoperation.ThepgActionIDparameteridentifiestheverificationoperation,andthepWinTrustDataparameteridentifiestheobjectwhosetrustistobeverified.AtrustproviderisaDLLregisteredwithWinVerifyTrust.AcalltoWinVerifyTrustforwardsthatcalltotheregisteredtrustprovider,ifthereisone,thatsupportsthatspecifiedactionidentifier.

Forexample,theSoftwarePublisherTrustProvidercanverifythatanexecutableimagefilecomesfromatrustedsoftwarepublisherandthatthefilehasnotbeenmodifiedsinceitwaspublished.Inthiscase,thepWinTrustDataparameterspecifiesthenameofthefileandthetypeoffile,suchasaMicrosoftimagefile.

Eachtrustprovidersupportsaspecificsetofactionsthatitcanevaluate.EachactionhasaGUIDthatidentifiesit.Atrustprovidercansupportanynumberofactionidentifiers,buttwotrustproviderscannotsupportthesameactionidentifier.

Foranexamplethatdemonstrateshowtousethisfunctiontoverifythesignatureofaportableexecutable（PE）file,see.

Requirements

Minimumsupportedclient

Windows 2000Professional

Minimumsupportedserver

Windows 2000Server

Header

（include

Library

DLL

ExampleCProgram:

VerifyingtheSignatureofaPEFile

TheAPIcanbeusedtoverifythesignatureofaportableexecutablefile.

ThefollowingexampleshowshowtousetheAPItoverifythesignatureofasignedportableexecutablefile.

Allrightsreserved.

#define_UNICODE1

#defineUNICODE1

#include<>

#pragmacomment（lib,"wintrust"）

BOOLVerifyEmbeddedSignature（LPCWSTRpwszSourceFile）

{

LONGlStatus;

DWORDdwLastError;

WINTRUST_FILE_INFOFileData;

memset（&FileData,0,sizeof（FileData））;

=sizeof（WINTRUST_FILE_INFO）;

=pwszSourceFile;

=NULL;

WVTPolicyGUIDspecifiesthepolicytoapplyonthefile

WINTRUST_ACTION_GENERIC_VERIFY_V2policychecks:

1）Thecertificateusedtosignthefilechainsuptoaroot

certificatelocatedinthetrustedrootcertificatestore.This

impliesthattheidentityofthepublisherhasbeenverifiedby

acertificationauthority.

2）Incaseswhereuserinterfaceisdisplayed（whichthisexample

doesnotdo）,WinVerifyTrustwillcheckforwhetherthe

endentitycertificateisstoredinthetrustedpublisherstore,

implyingthattheusertrustscontentfromthispublisher.

3）Theendentitycertificatehassufficientpermissiontosign

code,asindicatedbythepresenceofacodesigningEKUorno

EKU.

GUIDWVTPolicyGUID=WINTRUST_ACTION_GENERIC_VERIFY_V2;

WINTRUST_DATAWinTrustData;

memset（&WinTrustData,0,sizeof（WinTrustData））;

=sizeof（WinTrustData）;

=NULL;

=WTD_UI_NONE;

=WTD_REVOKE_NONE;

=WTD_CHOICE_FILE;

=0;

=NULL;

=0;

=&FileData;

lStatus=WinVerifyTrust（

NULL,

&WVTPolicyGUID,

&WinTrustData）;

switch（lStatus）

{

caseERROR_SUCCESS:

Signedfile:

-Hashthatrepresentsthesubjectistrusted.

-Trustedpublisherwithoutanyverificationerrors.

-UIwasdisabledindwUIChoice.Nopublisheror

timestampchainerrors.

-UIwasenabledindwUIChoiceandtheuserclicked

"Yes"whenaskedtoinstallandrunthesigned

subject.

wprintf_s（L"Thefile\"%s\"issignedandthesignature"

L"wasverified.\n",

pwszSourceFile）;

break;

caseTRUST_E_NOSIGNATURE:

dwLastError=GetLastError（）;

if（TRUST_E_NOSIGNATURE==dwLastError||

TRUST_E_SUBJECT_FORM_UNKNOWN==dwLastError||

TRUST_E_PROVIDER_UNKNOWN==dwLastError）

{

wprintf_s（L"Thefile\"%s\"isnotsigned.\n",

pwszSourceFile）;

}

else

{

wprintf_s（L"Anunknownerroroccurredtryingto"

L"verifythesignatureofthe\"%s\"file.\n",

pwszSourceFile）;

}

break;

caseTRUST_E_EXPLICIT_DISTRUST:

wprintf_s（L"Thesignatureispresent,butspecifically"

L"disallowed.\n"）;

break;

caseTRUST_E_SUBJECT_NOT_TRUSTED:

wprintf_s（L"Thesignatureispresent,butnot"

L"trusted.\n"）;

break;

caseCRYPT_E_SECURITY_SETTINGS:

Thehashthatrepresentsthesubjectorthepublisher

wasnotexplicitlytrustedbytheadminandthe

adminpolicyhasdisabledusertrust.Nosignature,

publisherortimestamperrors.

wprintf_s（L"CRYPT_E_SECURITY_SETTINGS-Thehash"

L"representingthesubjectorthepublisherwasn't"

L"explicitlytrustedbytheadminandadminpolicy"

L"hasdisabledusertrust.Nosignature,publisher"

展开阅读全文