How can I determine if a Windows Driver is Digitally signed

[Rymfax]

Hey all.

I need to determine whether or not a Windows Driver is digitally
signed using a C# application. Can anyone point me in the right
direction for doing this? I know it has something to do with the .cat
file, but I'm not sure exactly what else I need to do.

TIA!

 

[Willy Denoyette [MVP]]

Hey all.

I need to determine whether or not a Windows Driver is digitally
signed using a C# application. Can anyone point me in the right
direction for doing this? I know it has something to do with the .cat
file, but I'm not sure exactly what else I need to do.

TIA!

If the driver file is signed, then it should contain a valid X509
certificate, so one way to check this is by using using the
System.Security.Cryptography.X509Certificates namespace.
Here a small snip to get you started..

using System;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
....

X509Certificate certp =
X509Certificate2.CreateFromSignedFile(@"C:\Windows\System32\drivers\tcpip.sys");
X509Certificate2 x509 = new X509Certificate2(certp.Handle);
// if valid, dump some properties to the console
Console.WriteLine("{0}Subject: {1}{0}",
Environment.NewLine,x509.Subject);
Console.WriteLine("{0}Issuer: {1}{0}", Environment.NewLine,x509.Issuer);
Console.WriteLine("{0}Version: {1}{0}",
Environment.NewLine,x509.Version);
Console.WriteLine("{0}Valid Date: {1}{0}",
Environment.NewLine,x509.NotBefore);
Console.WriteLine("{0}Expiry Date: {1}{0}",
Environment.NewLine,x509.NotAfter);
Console.WriteLine("{0}Thumbprint: {1}{0}",
Environment.NewLine,x509.Thumbprint);
Console.WriteLine("{0}Serial Number: {1}{0}",
Environment.NewLine,x509.SerialNumber);
Console.WriteLine("{0}Friendly Name: {1}{0}",
Environment.NewLine,x509.PublicKey.Oid.FriendlyName);
Console.WriteLine("{0}Public Key Format: {1}{0}",
Environment.NewLine,x509.PublicKey.EncodedKeyValue.Format(true));
Console.WriteLine("{0}Raw Data Length: {1}{0}",
Environment.NewLine,x509.RawData.Length);
Console.WriteLine("{0}Certificate to string: {1}{0}",
Environment.NewLine,x509.ToString(true));

Willy.

 

[Rymfax]

If the driver file is signed, then it should contain a valid X509
certificate, so one way to check this is by using using the
System.Security.Cryptography.X509Certificates namespace.
Here a small snip to get you started..

using System;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
...

   X509Certificate certp =
X509Certificate2.CreateFromSignedFile(@"C:\Windows\System32\drivers\tcpip.s­ys");
   X509Certificate2 x509 = new X509Certificate2(certp.Handle);
   // if valid, dump some properties to the console
   Console.WriteLine("{0}Subject: {1}{0}",
Environment.NewLine,x509.Subject);
   Console.WriteLine("{0}Issuer: {1}{0}", Environment.NewLine,x509.Issuer);
   Console.WriteLine("{0}Version: {1}{0}",
Environment.NewLine,x509.Version);
   Console.WriteLine("{0}Valid Date: {1}{0}",
Environment.NewLine,x509.NotBefore);
   Console.WriteLine("{0}Expiry Date: {1}{0}",
Environment.NewLine,x509.NotAfter);
   Console.WriteLine("{0}Thumbprint: {1}{0}",
Environment.NewLine,x509.Thumbprint);
   Console.WriteLine("{0}Serial Number: {1}{0}",
Environment.NewLine,x509.SerialNumber);
   Console.WriteLine("{0}Friendly Name: {1}{0}",
        Environment.NewLine,x509.PublicKey.Oid.FriendlyName);
   Console.WriteLine("{0}Public Key Format: {1}{0}",
         Environment.NewLine,x509.PublicKey.EncodedKeyValue.Format(true));
   Console.WriteLine("{0}Raw Data Length: {1}{0}",
Environment.NewLine,x509.RawData.Length);
   Console.WriteLine("{0}Certificate to string: {1}{0}",
Environment.NewLine,x509.ToString(true));

Willy.

You Rock Willy! That worked perfectly...THANKS!