![如何使用 cli 从 Linux 下的 Windows“exe”文件中提取签名数据](https://linux22.com/image/85561/%E5%A6%82%E4%BD%95%E4%BD%BF%E7%94%A8%20cli%20%E4%BB%8E%20Linux%20%E4%B8%8B%E7%9A%84%20Windows%E2%80%9Cexe%E2%80%9D%E6%96%87%E4%BB%B6%E4%B8%AD%E6%8F%90%E5%8F%96%E7%AD%BE%E5%90%8D%E6%95%B0%E6%8D%AE.png)
如果你去VirusTotal 链接,有一个名为文件信息的选项卡(我想;我的是荷兰语)。你会看到一个名为
"Authenticode signature block and FileVersionInfo properties"
我想使用Linux cli提取标题下的数据。例子:
Signature verification Signed file, verified signature Signing date 7:43 AM 11/4/2014 Signers [+] Microsoft Windows [+] Microsoft Windows Production PCA 2011 [+] Microsoft Root Certificate Authority 2010 Counter signers [+] Microsoft Time-Stamp Service [+] Microsoft Time-Stamp PCA 2010 [+] Microsoft Root Certificate Authority 2010
我Camera.exe
在 Windows 10 中使用了 来以某种方式提取数据。
我解压了该.exe
文件,发现CERTIFICATE
里面有一个文件,里面有很多不可读的数据,但也有一些文本,我可以阅读,那就是 - 大致 - 与上面的输出相同。
.exe
如何使用 cli 从 Linux 下的Windows 文件中提取签名
答案1
Linux 上有一个工具叫osslsigncode
它可以处理 Windows Authenticode 签名。验证二进制文件的签名会产生与示例中显示的类似的输出;在vcredist_x86.exe
我必须手上我得到:
$ osslsigncode verify vcredist_x86.exe
Current PE checksum : 004136A1
Calculated PE checksum: 004136A1
Message digest algorithm : SHA1
Current message digest : 0A9F10FB285BA0064B5537023F8BC9E06E173801
Calculated message digest : 0A9F10FB285BA0064B5537023F8BC9E06E173801
Signature verification: ok
Number of signers: 1
Signer #0:
Subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation
Issuer : /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Signing PCA
Number of certificates: 7
Cert #0:
Subject: /OU=Copyright (c) 1997 Microsoft Corp./OU=Microsoft Corporation/CN=Microsoft Root Authority
Issuer : /OU=Copyright (c) 1997 Microsoft Corp./OU=Microsoft Corporation/CN=Microsoft Root Authority
Cert #1:
Subject: /OU=Copyright (c) 1997 Microsoft Corp./OU=Microsoft Corporation/CN=Microsoft Root Authority
Issuer : /OU=Copyright (c) 1997 Microsoft Corp./OU=Microsoft Corporation/CN=Microsoft Root Authority
Cert #2:
Subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Signing PCA
Issuer : /OU=Copyright (c) 1997 Microsoft Corp./OU=Microsoft Corporation/CN=Microsoft Root Authority
Cert #3:
Subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation
Issuer : /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Signing PCA
Cert #4:
Subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=nCipher DSE ESN:D8A9-CFCC-579C/CN=Microsoft Timestamping Service
Issuer : /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Timestamping PCA
Cert #5:
Subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=nCipher DSE ESN:10D8-5847-CBF8/CN=Microsoft Timestamping Service
Issuer : /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Timestamping PCA
Cert #6:
Subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Timestamping PCA
Issuer : /OU=Copyright (c) 1997 Microsoft Corp./OU=Microsoft Corporation/CN=Microsoft Root Authority
Succeeded
您还可以提取签名:
osslsigncode extract-signature vcredist_x86.exe vcredist_x86.sig
答案2
您还可以查看https://github.com/msdhedhi/VerifyWinFileDigitalSignature
这是我不久前编写的java代码,它提取并验证Windows PE文件的数字签名(32位和64位)