Rule for checking the signature.

An "end-to-end" style check that verifies whether or not Windows ultimately ends up trusting the binary.

Author: vcsjones

AuthenticodeLint/AuthenticodeLint.csproj

@@ -25,6 +25,7 @@
     <WarningLevel>4</WarningLevel>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
     <Prefer32Bit>false</Prefer32Bit>
+    <UseVSHostingProcess>true</UseVSHostingProcess>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
     <PlatformTarget>AnyCPU</PlatformTarget>
@@ -37,6 +38,9 @@
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
+  <PropertyGroup>
+    <ApplicationManifest>app.manifest</ApplicationManifest>
+  </PropertyGroup>
   <ItemGroup>
     <Reference Include="System" />
     <Reference Include="System.Core" />
@@ -56,7 +60,9 @@
     <Compile Include="Interop\Crypt32.cs" />
     <Compile Include="Interop\CryptMsgSafeHandle.cs" />
     <Compile Include="Interop\LocalBufferSafeHandle.cs" />
+    <Compile Include="Interop\Wintrust.cs" />
     <Compile Include="IRuleResultCollector.cs" />
+    <Compile Include="KnownGuids.cs" />
     <Compile Include="KnownOids.cs" />
     <Compile Include="PublisherInformation.cs" />
     <Compile Include="Rfc3161Signature.cs" />
@@ -71,6 +77,7 @@
     <Compile Include="Rules\Sha2SignatureExistsRule.cs" />
     <Compile Include="Rules\SigningCertificateDigestAlgorithmRule.cs" />
     <Compile Include="Rules\TimestampedRule.cs" />
+    <Compile Include="Rules\TrustedSignatureRule.cs" />
     <Compile Include="Signature.cs" />
     <Compile Include="SignatureExtractor.cs" />
     <Compile Include="Graph.cs" />
@@ -79,7 +86,9 @@
     <Compile Include="VerboseSignatureTextWriter.cs" />
     <Compile Include="XmlRuleResultCollector.cs" />
   </ItemGroup>
-  <ItemGroup />
+  <ItemGroup>
+    <None Include="app.manifest" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.

AuthenticodeLint/CheckEngine.cs

@@ -22,20 +22,22 @@ public IReadOnlyList<IAuthenticodeRule> GetRules()
                 new TimestampedRule(),
                 new PublisherInformationPresentRule(),
                 new PublisherInformationUrlHttpsRule(),
-                new SigningCertificateDigestAlgorithmRule()
+                new SigningCertificateDigestAlgorithmRule(),
+                new TrustedSignatureRule()
             };
         }
 
-        public RuleEngineResult RunAllRules(string file, Graph<Signature> signatures, List<IRuleResultCollector> collectors, HashSet<int> suppressedRuleIDs, bool verbose)
+        public RuleEngineResult RunAllRules(string file, Graph<Signature> signatures, List<IRuleResultCollector> collectors, CheckConfiguration configuration)
         {
-
+            var verbose = configuration.Verbose;
+            var suppressedRuleIDs = configuration.SuppressErrorIDs;
             var rules = GetRules();
             var engineResult = RuleEngineResult.AllPass;
             collectors.ForEach(c => c.BeginSet(file));
             foreach(var rule in rules)
             {
                 RuleResult result;
-                var verboseWriter = verbose ? new VerboseSignatureLogger() : SignatureLoggerBase.Null;
+                var verboseWriter = verbose ? new VerboseSignatureLogger() : SignatureLogger.Null;
                 if (signatures.Items.Count == 0)
                 {
                     result = RuleResult.Fail;
@@ -49,7 +51,7 @@ public RuleEngineResult RunAllRules(string file, Graph<Signature> signatures, Li
                     }
                     else
                     {
-                        result = rule.Validate(signatures, verboseWriter);
+                        result = rule.Validate(signatures, verboseWriter, configuration, file);
                     }
                 }
                 if (result != RuleResult.Pass)

AuthenticodeLint/ConfigurationValidator.cs

@@ -10,16 +10,17 @@ public class CheckConfiguration
         public string ReportPath { get; }
         public bool Quiet { get; }
         public HashSet<int> SuppressErrorIDs { get; }
-
         public bool Verbose { get; }
+        public RevocationChecking RevocationMode {get;}
 
-        public CheckConfiguration(IReadOnlyList<string> inputPaths, string reportPath, bool quiet, HashSet<int> suppressErrorIDs, bool verbose)
+        public CheckConfiguration(IReadOnlyList<string> inputPaths, string reportPath, bool quiet, HashSet<int> suppressErrorIDs, bool verbose, RevocationChecking revocationMode)
         {
             InputPaths = inputPaths;
             ReportPath = reportPath;
             Quiet = quiet;
             SuppressErrorIDs = suppressErrorIDs;
             Verbose = verbose;
+            RevocationMode = revocationMode;
         }
     }
 

AuthenticodeLint/Graph.cs

@@ -11,7 +11,7 @@ public Graph(IReadOnlyCollection<GraphItem<T>> items)
             Items = items;
         }
 
-        public static Graph<T> Empty { get; } = new Graph<T>(new List<GraphItem<T>>());
+        public static Graph<T> Empty { get; } = new Graph<T>(System.Array.Empty<GraphItem<T>>());
 
         public IEnumerable<T> VisitAll()
         {

AuthenticodeLint/Interop/Wintrust.cs

@@ -0,0 +1,110 @@
+using System;
+using System.Runtime.InteropServices;
+
+namespace AuthenticodeLint.Interop
+{
+    internal static class Wintrust
+    {
+        [method: DllImport("wintrust.dll", EntryPoint = "WinVerifyTrustEx", CallingConvention = CallingConvention.Winapi, SetLastError = false)]
+        [return: MarshalAs(UnmanagedType.I4)]
+        public static extern unsafe int WinVerifyTrustEx
+            (
+                [param: In, MarshalAs(UnmanagedType.SysInt)] IntPtr hwnd,
+                [param: In, MarshalAs(UnmanagedType.LPStruct)] Guid pgActionID,
+                [param: In] WINTRUST_DATA* pWVTData
+            );
+    }
+
+    [type: StructLayout(LayoutKind.Sequential)]
+    internal struct WINTRUST_DATA
+    {
+        public uint cbStruct;
+        public IntPtr pPolicyCallbackData;
+        public IntPtr pSIPClientData;
+        public WinTrustDataUIChoice dwUIChoice;
+        public WinTrustRevocationChecks fdwRevocationChecks;
+        public WinTrustUnionChoice dwUnionChoice;
+        public WINTRUST_DATA_UNION trustUnion;
+        public WinTrustStateAction dwStateAction;
+        public IntPtr hWVTStateData;
+        public IntPtr pwszURLReference;
+        public WinTrustProviderFlags dwProvFlags;
+        public WinTrustUIContext dwUIContext;
+        public IntPtr pSignatureSettings;
+    }
+
+    [type: StructLayout(LayoutKind.Explicit)]
+    internal unsafe struct WINTRUST_DATA_UNION
+    {
+        [field: FieldOffset(0)]
+        public WINTRUST_FILE_INFO* pFile;
+    }
+
+    [type: StructLayout(LayoutKind.Sequential)]
+    internal struct WINTRUST_FILE_INFO
+    {
+        public uint cbStruct;
+        public IntPtr pcwszFilePath;
+        public IntPtr hFile;
+        public IntPtr pgKnownSubject;
+    }
+
+
+    internal enum WinTrustDataUIChoice : uint
+    {
+        WTD_UI_ALL = 1,
+        WTD_UI_NONE = 2,
+        WTD_UI_NOBAD = 3,
+        WTD_UI_NOGOOD = 4,
+    }
+
+    internal enum WinTrustRevocationChecks : uint
+    {
+        WTD_REVOKE_NONE = 0,
+        WTD_REVOKE_WHOLECHAIN = 1
+    }
+
+    internal enum WinTrustUnionChoice : uint
+    {
+        WTD_CHOICE_FILE = 1,
+        WTD_CHOICE_CATALOG = 2,
+        WTD_CHOICE_BLOB = 3,
+        WTD_CHOICE_SIGNER = 4,
+        WTD_CHOICE_CERT = 5
+    }
+
+    internal enum WinTrustStateAction : uint
+    {
+        WTD_STATEACTION_IGNORE = 0x00000000,
+        WTD_STATEACTION_VERIFY = 0x00000001,
+        WTD_STATEACTION_CLOSE = 0x00000002,
+        WTD_STATEACTION_AUTO_CACHE = 0x00000003,
+        WTD_STATEACTION_AUTO_CACHE_FLUSH = 0x00000004,
+    }
+
+    [type: Flags]
+    internal enum WinTrustProviderFlags : uint
+    {
+        NONE = 0,
+        WTD_USE_IE4_TRUST_FLAG = 0x00000001,
+        WTD_NO_IE4_CHAIN_FLAG = 0x00000002,
+        WTD_NO_POLICY_USAGE_FLAG = 0x00000004,
+        WTD_REVOCATION_CHECK_NONE = 0x00000010,
+        WTD_REVOCATION_CHECK_END_CERT = 0x00000020,
+        WTD_REVOCATION_CHECK_CHAIN = 0x00000040,
+        WTD_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT = 0x00000080,
+        WTD_SAFER_FLAG = 0x00000100,
+        WTD_HASH_ONLY_FLAG = 0x00000200,
+        WTD_USE_DEFAULT_OSVER_CHECK = 0x00000400,
+        WTD_LIFETIME_SIGNING_FLAG = 0x00000800,
+        WTD_CACHE_ONLY_URL_RETRIEVAL = 0x00001000,
+        WTD_DISABLE_MD2_MD4 = 0x00002000,
+        WTD_MOTW = 0x00004000,
+    }
+
+    internal enum WinTrustUIContext : uint
+    {
+        WTD_UICONTEXT_EXECUTE = 0,
+        WTD_UICONTEXT_INSTALL = 1,
+    }
+}

AuthenticodeLint/KnownGuids.cs

@@ -0,0 +1,9 @@
+using System;
+
+namespace AuthenticodeLint
+{
+    internal static class KnownGuids
+    {
+        public static Guid WINTRUST_ACTION_GENERIC_VERIFY_V2 { get; } = new Guid(0xaac56b, unchecked((short)0xcd44), 0x11d0, new byte[] { 0x8c, 0xc2, 0x0, 0xc0, 0x4f, 0xc2, 0x95, 0xee });
+    }
+}

AuthenticodeLint/Program.cs

@@ -24,6 +24,7 @@ static int Main(string[] args)
             bool quiet = false;
             bool verbose = false;
             string report = null;
+            var revocation = RevocationChecking.None;
             foreach(var parameter in parsedCommandLine)
             {
                 if (parameter.Name == "in")
@@ -74,7 +75,7 @@ static int Main(string[] args)
                 {
                     if (!string.IsNullOrWhiteSpace(parameter.Value))
                     {
-                        Console.Error.WriteLine($"-{parameter.Value} does not expect a value.");
+                        Console.Error.WriteLine($"-{parameter.Name} does not expect a value.");
                         return ExitCodes.InvalidInputOrConfig;
                     }
                     quiet = true;
@@ -83,7 +84,7 @@ static int Main(string[] args)
                 {
                     if (!string.IsNullOrWhiteSpace(parameter.Value))
                     {
-                        Console.Error.WriteLine($"-{parameter.Value} does not expect a value.");
+                        Console.Error.WriteLine($"-{parameter.Name} does not expect a value.");
                         return ExitCodes.InvalidInputOrConfig;
                     }
                     verbose = true;
@@ -92,6 +93,19 @@ static int Main(string[] args)
                 {
                     report = parameter.Value;
                 }
+                else if (parameter.Name == "revocation")
+                {
+                    if (string.IsNullOrWhiteSpace(parameter.Value))
+                    {
+                        Console.Error.WriteLine($"-{parameter.Name} requires a value if specified.");
+                        return ExitCodes.InvalidInputOrConfig;
+                    }
+                    if (!Enum.TryParse(parameter.Value, true, out revocation))
+                    {
+                        Console.Error.WriteLine($"-{parameter.Value} is an unrecognized revocation mode.");
+                        return ExitCodes.InvalidInputOrConfig;
+                    }
+                }
                 else
                 {
                     Console.Error.WriteLine($"-{parameter.Name} is an unknown parameter.");
@@ -103,7 +117,7 @@ static int Main(string[] args)
                 Console.Error.WriteLine("Input is expected. See -help for usage.");
                 return ExitCodes.InvalidInputOrConfig;
             }
-            var configuration = new CheckConfiguration(inputs, report, quiet, suppress, verbose);
+            var configuration = new CheckConfiguration(inputs, report, quiet, suppress, verbose, revocation);
 
             if (!ConfigurationValidator.ValidateAndPrint(configuration, Console.Error))
             {
@@ -123,7 +137,7 @@ static int Main(string[] args)
             foreach (var file in inputs)
             {
                 var signatures = extractor.Extract(file);
-                if (CheckEngine.Instance.RunAllRules(file, signatures, collectors, suppress, verbose) != RuleEngineResult.AllPass)
+                if (CheckEngine.Instance.RunAllRules(file, signatures, collectors, configuration) != RuleEngineResult.AllPass)
                 {
                     result = ExitCodes.ChecksFailed;
                 }
@@ -138,21 +152,22 @@ static void ShowHelp()
         {
             Console.Out.WriteLine(@"Authenticode Linter
 
-Checks the authenticode signature of your binaries.
+Checks the Authenticode signature of your binaries.
 
 Usage: authlint.exe -in ""C:\path to an\executable.exe""
 
-    -in:        A path to an executable, DLL, or MSI to lint. Can be specified multiple times. Supports wildcards. Required.
-    -suppress:  A comma separated list of error IDs to ignore. All checks are run if omitted. Optional.
-    -q|quiet:   Run quietly and do not print anything to the output. Optional.
-    -report:    A path to produce an XML file as a report. Optional.
-    -verbose:   Show verbose output.
+    -in:            A path to an executable, DLL, or MSI to lint. Can be specified multiple times. Supports wildcards. Required.
+    -suppress:      A comma separated list of error IDs to ignore. All checks are run if omitted. Optional.
+    -q|quiet:       Run quietly and do not print anything to the output. Optional.
+    -report:        A path to produce an XML file as a report. Optional.
+    -verbose:       Show verbose output. Cannot be combined with -quiet.
+    -revocation:    Specify how revocation checking is done. Valid values are none, offline, online. None is the default.
 
 Exit codes:
 
     0:      All checks passed for all inputs, excluding any that were suppressed.
     1:      Invalid input or configuration was specified.
-    2:      One or more checks failed, or the file is not authenticode signed.
+    2:      One or more checks failed, or the file is not Authenticode signed.
 ");
         }
     }
@@ -164,4 +179,11 @@ internal static class ExitCodes
         public static int ChecksFailed { get; } = 2;
         public static int UnknownResults { get; } = 0xFF;
     }
+
+    public enum RevocationChecking
+    {
+        None,
+        Offline,
+        Online
+    }
 }

AuthenticodeLint/PublisherInformation.cs

@@ -35,14 +35,14 @@ public PublisherInformation(AsnEncodedData data)
                     Description = info.pwszProgramName;
                     if (info.pMoreInfo != null)
                     {
-                        var moreInfo = *info.pMoreInfo;
-                        switch(moreInfo.dwLinkChoice)
+                        var moreInfo = info.pMoreInfo;
+                        switch(moreInfo->dwLinkChoice)
                         {
                             case SpcLinkChoice.SPC_URL_LINK_CHOICE:
-                                UrlLink = Marshal.PtrToStringUni(moreInfo.linkUnion.pwszUrl);
+                                UrlLink = Marshal.PtrToStringUni(moreInfo->linkUnion.pwszUrl);
                                 break;
                             case SpcLinkChoice.SPC_FILE_LINK_CHOICE:
-                                FileLink = Marshal.PtrToStringUni(moreInfo.linkUnion.pwszFile);
+                                FileLink = Marshal.PtrToStringUni(moreInfo->linkUnion.pwszFile);
                                 break;
                         }
                     }

AuthenticodeLint/Rfc3161Signature.cs

@@ -10,6 +10,7 @@ public abstract class SignatureBase : IDisposable
     {
         internal CMSG_SIGNER_INFO _signerInfo;
 
+
         protected SignatureBase(AsnEncodedData data)
         {
 
@@ -61,7 +62,7 @@ public unsafe AuthenticodeSignature(AsnEncodedData data) : base(data)
                 }
                 else
                 {
-                    throw new InvalidOperationException("Failed to read authenticode signature");
+                    throw new InvalidOperationException("Failed to read Authenticode signature");
                 }
             }
         }

AuthenticodeLint/Rules/IAuthenticodeRule.cs

@@ -5,6 +5,6 @@ public interface IAuthenticodeRule
         int RuleId { get; }
         string ShortDescription { get; }
         string RuleName { get; }
-        RuleResult Validate(Graph<Signature> graph, SignatureLoggerBase verboseWriter);
+        RuleResult Validate(Graph<Signature> graph, SignatureLogger verboseWriter, CheckConfiguration configuration, string file);
     }
 }