WinVerifyTrust校验文件内置签名实例.docx

1、WinVerifyTrust校验文件内置签名实例WinVerifyTrust FunctionThe WinVerifyTrust function performs a trust verification action on a specified object. The function passes the inquiry to a that supports the action identifier, if one exists.For certificate verification, use the and functions.SyntaxLONG WINAPI WinVeri

2、fyTrust( _inHWND hWnd, _inGUID *pgActionID, _inLPVOID pWVTData);ParametershWnd in Optional handle to a caller window. A trust provider can use this value to determine whether it can interact with the user. However, trust providers typically perform verification actions without input from the user.Th

3、is parameter can be one of the following values.ValueMeaningINVALID_HANDLE_VALUE There is no interactive user. The trust provider performs the verification action without the users assistance.Zero The trust provider can use the interactive desktop to display its user interface.A valid window handle

4、A trust provider can treat any value other than INVALID_HANDLE_VALUE or zero as a valid window handle that it can use to interact with the user.pgActionID in A pointer to a GUID structure that identifies an action and the trust provider that supports that action. This value indicates the type of ver

5、ification action to be performed on the structure pointed to by pWinTrustData.The WinTrust service is designed to work with trust providers implemented by third parties. Each trust provider provides its own unique set of action identifiers. For information about the action identifiers supported by a

6、 trust provider, see the documentation for that trust provider.For example, Microsoft provides a Software Publisher Trust Provider that can establish the trustworthiness of software being downloaded from the Internet or some other public network. The Software Publisher Trust Provider supports the fo

7、llowing action identifiers. These constants are defined in .ValueMeaningDRIVER_ACTION_VERIFY Verify the authenticity of a Windows Hardware Quality Labs (WHQL) signed driver. This is an Authenticode add-on policy provider.HTTPSPROV_ACTION Verify an SSL/TLS connection through Internet Explorer.OFFICES

8、IGN_ACTION_VERIFY Verify the authenticity of a structured storage file by using the Microsoft Office Authenticode add-on policy provider.NoteThis Action ID is only supported on Windows Server2003, WindowsXP, and Windows2000.WINTRUST_ACTION_GENERIC_CERT_VERIFY Verify a certificate chain only. This is

9、 only valid when passing in a certificate context in the WinVerifyTrust input structures.NoteWe do not recommend using this function to perform certificate verification. To perform certificate verification, use the and functions.WINTRUST_ACTION_GENERIC_CHAIN_VERIFY Verify certificate chains created

10、from any object type. A callback is provided to implement the final chain policy by using the chain context for each signer and counter signer.WINTRUST_ACTION_GENERIC_VERIFY Verify a certificate chain only.NoteWe do not recommend using this function to perform certificate verification. To perform ce

11、rtificate verification, use the and functions. WINTRUST_ACTION_GENERIC_VERIFY_V2 Verify a file or object using the Authenticode policy provider.WINTRUST_ACTION_TRUSTPROVIDER_TEST Write the structure to a file after calling the Authenticode policy provider.pWVTData in A pointer that, when cast as a s

12、tructure, contains information that the trust provider needs to process the specified action identifier. Typically, the structure includes information that identifies the object that the trust provider must evaluate.The format of the structure depends on the action identifier. For information about

13、the data required for a specific action identifier, see the documentation for the trust provider that supports that action.Return ValueIf the trust provider verifies that the subject is trusted for the specified action, the return value is zero. No other value besides zero should be considered a suc

14、cessful return.If the trust provider does not verify that the subject is trusted for the specified action, the function returns a status code from the trust provider.NoteThe return value is a LONG, not an HRESULT as previously documented. Do not use HRESULT macros such as SUCCEEDED to determine whet

15、her the function succeeded. Instead, check the return value for equality to zero.For example, a trust provider might indicate that the subject is not trusted, or is trusted but with limitations or warnings. The return value can be a trust-provider-specific value described in the documentation for an

16、 individual trust provider, or it can be one of the following error codes.Return codeDescriptionTRUST_E_SUBJECT_NOT_TRUSTED The subject failed the specified verification action. Most trust providers return a more detailed error code that describes the reason for the failure.TRUST_E_PROVIDER_UNKNOWN

17、The trust provider is not recognized on this system.TRUST_E_ACTION_UNKNOWN The trust provider does not support the specified action.TRUST_E_SUBJECT_FORM_UNKNOWN The trust provider does not support the form specified for the subject.RemarksThe WinVerifyTrust function enables applications to invoke a

18、trust provider to verify that a specified object satisfies the criteria of a specified verification operation. The pgActionID parameter identifies the verification operation, and the pWinTrustData parameter identifies the object whose trust is to be verified. A trust provider is a DLL registered wit

19、h WinVerifyTrust. A call to WinVerifyTrust forwards that call to the registered trust provider, if there is one, that supports that specified action identifier.For example, the Software Publisher Trust Provider can verify that an executable image file comes from a trusted software publisher and that

20、 the file has not been modified since it was published. In this case, the pWinTrustData parameter specifies the name of the file and the type of file, such as a Microsoft image file.Each trust provider supports a specific set of actions that it can evaluate. Each action has a GUID that identifies it

21、. A trust provider can support any number of action identifiers, but two trust providers cannot support the same action identifier.For an example that demonstrates how to use this function to verify the signature of a portable executable (PE) file, see .RequirementsMinimum supported clientWindows200

22、0 ProfessionalMinimum supported serverWindows2000 ServerHeader (include LibraryDLLExample C Program: Verifying the Signature of a PE FileThe API can be used to verify the signature of a portable executable file.The following example shows how to use the API to verify the signature of a signed portab

23、le executable file. All rights reserved.#define _UNICODE 1#define UNICODE 1#include #include #include #include #include #include #include #pragma comment (lib, wintrust)BOOL VerifyEmbeddedSignature(LPCWSTR pwszSourceFile) LONG lStatus; DWORD dwLastError; WINTRUST_FILE_INFO FileData; memset(&FileData

24、, 0, sizeof(FileData); = sizeof(WINTRUST_FILE_INFO); = pwszSourceFile; = NULL; = NULL; /* WVTPolicyGUID specifies the policy to apply on the file WINTRUST_ACTION_GENERIC_VERIFY_V2 policy checks: 1) The certificate used to sign the file chains up to a root certificate located in the trusted root cert

25、ificate store. This implies that the identity of the publisher has been verified by a certification authority. 2) In cases where user interface is displayed (which this example does not do), WinVerifyTrust will check for whether the end entity certificate is stored in the trusted publisher store, im

26、plying that the user trusts content from this publisher. 3) The end entity certificate has sufficient permission to sign code, as indicated by the presence of a code signing EKU or no EKU. */ GUID WVTPolicyGUID = WINTRUST_ACTION_GENERIC_VERIFY_V2; WINTRUST_DATA WinTrustData; memset(&WinTrustData, 0,

27、 sizeof(WinTrustData); = sizeof(WinTrustData); = NULL; = NULL; = WTD_UI_NONE; = WTD_REVOKE_NONE; = WTD_CHOICE_FILE; = 0; = NULL; = NULL; = 0; = &FileData; lStatus = WinVerifyTrust( NULL, &WVTPolicyGUID, &WinTrustData); switch (lStatus) case ERROR_SUCCESS: /* Signed file: - Hash that represents the s

28、ubject is trusted. - Trusted publisher without any verification errors. - UI was disabled in dwUIChoice. No publisher or time stamp chain errors. - UI was enabled in dwUIChoice and the user clicked Yes when asked to install and run the signed subject. */ wprintf_s(LThe file %s is signed and the sign

29、ature Lwas verified.n, pwszSourceFile); break; case TRUST_E_NOSIGNATURE: dwLastError = GetLastError(); if (TRUST_E_NOSIGNATURE = dwLastError | TRUST_E_SUBJECT_FORM_UNKNOWN = dwLastError | TRUST_E_PROVIDER_UNKNOWN = dwLastError) wprintf_s(LThe file %s is not signed.n, pwszSourceFile); else wprintf_s(

30、LAn unknown error occurred trying to Lverify the signature of the %s file.n, pwszSourceFile); break; case TRUST_E_EXPLICIT_DISTRUST: wprintf_s(LThe signature is present, but specifically Ldisallowed.n); break; case TRUST_E_SUBJECT_NOT_TRUSTED: wprintf_s(LThe signature is present, but not Ltrusted.n)

31、; break; case CRYPT_E_SECURITY_SETTINGS: /* The hash that represents the subject or the publisher was not explicitly trusted by the admin and the admin policy has disabled user trust. No signature, publisher or time stamp errors. */ wprintf_s(LCRYPT_E_SECURITY_SETTINGS - The hash Lrepresenting the subject or the publisher wasnt Lexplicitly trusted by the admin and admin policy Lhas disabled user trust. No signature, publisher