how to check a signed cab file ?

fifty2 · 03-19-2009, 10:28 AM

I need to be able to check the digital signature of a .cab file signed using signtool.
My technique is to open the file using CryptQueryObject and use the various crypto apis to fish out the file hash from the SPC_INDIRECT_DATA structure. so far so good, but when I try and compute the hash of the .cab file in order to compare the 2 hashes to determine if the file has been tampered with, the 2 hashes don't agree. I must say I have not tampered with the file. My question is which fields of the .cab file do I need to include in the hash, or can someone point me to a place where I can find that information. I already have a document from msdn about authenticode signing of p.e. files.

~~matthewforu~~ · 03-20-2009, 03:59 AM

I think its a clear case of virus attack on your computer , which causing such hasles , on your computer .
if you already have any antivirus on your installed on your compute , try to scan your computer after upgrading it ,
If you don't have any antivirus i would suggest you to download and install antivirus software on your computer .

03-19-2009, 10:28 AM	#1 (permalink)
fifty2 Registered User Join Date: Mar 2009 Posts: 1 OS: xp	how to check a signed cab file ? I need to be able to check the digital signature of a .cab file signed using signtool. My technique is to open the file using CryptQueryObject and use the various crypto apis to fish out the file hash from the SPC_INDIRECT_DATA structure. so far so good, but when I try and compute the hash of the .cab file in order to compare the 2 hashes to determine if the file has been tampered with, the 2 hashes don't agree. I must say I have not tampered with the file. My question is which fields of the .cab file do I need to include in the hash, or can someone point me to a place where I can find that information. I already have a document from msdn about authenticode signing of p.e. files.

03-20-2009, 03:59 AM	#2 (permalink)
~~matthewforu~~ Troubled Join Date: Jul 2008 Posts: 174 OS: Windows Xp	Re: how to check a signed cab file ? I think its a clear case of virus attack on your computer , which causing such hasles , on your computer . if you already have any antivirus on your installed on your compute , try to scan your computer after upgrading it , If you don't have any antivirus i would suggest you to download and install antivirus software on your computer .