1

I have drivers with security catalog files included (catalogFile=someFile.cat). I would like to check the validity of those drivers using the included security catalog file.

Which tools are included in Windows 7 to check a security catalog file? What is the best practice?

How can i check the integrity of drivers?

Thank for your time.

3

Source: Tools for Signing Drivers

The Microsoft Windows Driver Kit (WDK) includes the following tools that you can use to create a code-signing certificate, to sign the catalog file of a driver package, and to embed a signature in a driver file:

  • CertMgr
  • Inf2Cat
  • MakeCat
  • MakeCert
  • Pvk2Pfx
  • SignTool

SignTool is used to verify that a catalog file is signed by a valid commercial release certificate (see below).

Source: Verifying the Signature of a Catalog File Signed by a Commercial Release Certificate

To verify that a catalog file is signed by a valid commercial release certificate, use the following SignTool command:

SignTool verify /v /pa CatalogFileName.cat

To verify that a file that is listed in a driver package's catalog file is signed by a valid commercial release certificate, use the following SignTool command:

SignTool verify /v /pa /c CatalogFileName.cat DriverFileName

Where:

  • The verify command configures SignTool to verify the signature of the driver package's catalog file CatalogFileName.cat or the driver file DriverFileName.
  • The /v option configures SignTool to print execution and warning messages.
  • The /pa option configures SignTool to verify that the signature of the catalog file or driver file complies with the PnP driver installation requirements.
  • CatalogFileName.cat is the name of the catalog file for a driver package.
  • The /c CatalogFileName.cat option specifies a catalog file that includes an entry for the file DriverFileName.
  • DriverFileName specifies the name of a file that has an entry in the catalog file CatalogFileName.cat.
  • How can I check that WDK is installed? I have only certmgr.msc! – MUY Belgium Sep 17 '14 at 9:18
  • osr.com/blog/2014/05/28/wdk-version-running might give you some ideas – DavidPostill Sep 17 '14 at 9:21
  • I SDK and then the tool was installed in the bin directory in the SDK installation directroy. – MUY Belgium Sep 17 '14 at 13:29
  • As far as I can tell, (and supported by davidegrayson.com/signing), this is necessary but not sufficient for the driver to actually work, and doesn't guarantee that the driver will actually be permitted to load – ikrase Aug 29 '17 at 16:11

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.