Cyber Risks · Trail of Bits Blog

Verifying Windows binaries, without Windows

Summary: Trail of Bits has open-sourced μthenticode, a cross-platform C++ library for verifying Authenticode signatures on Windows PE binaries without a Windows machine, and integrated it into recent builds of Winchecksec. The library replaces the CryptoAPI interfaces WinVerifyTrust and CertVerifyCertificateChainPolicy, and currently supports signature verification and the main Authenticode hash, with page hash parsing and timestamp countersignature validation still to come.

What you should know: Authenticode verification has until now depended on Windows-only APIs, so teams analyzing or validating Windows executables on Linux or macOS had no native path to check a signer's identity and file integrity. The library is a work in progress: page hashes and timestamp countersignatures are not yet supported, which leaves parts of the Authenticode format unverified in its current release.

Read the original at Trail of Bits Blog ↗