4

For example, PEauth.sys on Windows 7 and 8.1.

Windows Explorer file property dialog does not show Digital Signature tab for this file, but Sysinternal sigcheck.exe says it is digitally signed.

Can some one tell me why this happens?

enter image description here

  • 5
  • This is not a Question and Answer forum, What has your research effort shown using Google? Questions on SU are expected to show some research effort on your part and should be included in your question. – Moab Apr 25 '16 at 22:47
4

As this article (linked by JosefZ) says, the Digital Signatures tab only appears if the signature is in the file itself. It's also possible for the signature to be stored in a catalog file, which can be found in \Windows\System32\catroot.

The Sysinternals sigcheck tool can tell you whether a certain file has an embedded signature. If you give it the -i option before the filename, the output will include a Catalog line, plus lots more certificate information. Files signed in a catalog will have a .cat file named on that line, and files with an embedded signature will have their own filename there. For example, this is the first part of the (very long) output of sigcheck -i \windows\regedit.exe:

C:\Windows\regedit.exe:
    Verified:   Signed
    Link date:  9:12 PM 10/28/2014
    Signing date:   2:59 AM 11/7/2014
    Catalog:    C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_868_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.cat

Therefore, regedit.exe has a valid signature stored in that catalog.

| improve this answer | |
  • Thank you, but your statements are not very accurate. Using sigcheck v2.01, -i option always show Catalog line, except that for non-catelog-ed files(e.g. C:\Program Files (x86)\HTML Help Workshop\hhc.exe), the Catalog line shows the exe file itself. – Jimm Chen Apr 27 '16 at 7:06
  • @JimmChen Ah, I'm using v2.20; you might want to download the latest version of the suite. – Ben N Apr 27 '16 at 12:53
  • I just download the latest v2.51 (but MS download page stupidly name it v2.5), and confirmed that it always display the Catalog line. You can try it yourself. – Jimm Chen Apr 28 '16 at 2:18
  • @JimmChen You're right - they updated it again, wow. I've adjusted my answer to use the newest version. – Ben N Apr 28 '16 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.