Is this also showing, if a authenticode is valid?

NetSPI / PESecurity

PowerShell module to check if a Windows binary (EXE/DLL) has been compiled with ASLR, DEP, SafeSEH, StrongNaming, and Authenticode.

https://blog.netspi.com/verifying-aslr-dep-and-safeseh-with-powershell/

MIT License

621 stars 147 forks source link

Is this also showing, if a authenticode is valid? #7

Open phasetwo opened 8 years ago

phasetwo commented 8 years ago

Hey, first of all thanks for providing this. Can you tell me, if this is also providing information about the validity of a authenticode signing?

Thanks in advance!

egru commented 8 years ago

It should be detecting authenticode.

phasetwo commented 8 years ago

I mean like, is this a guarantee for a valid signing or just, that there is one detected?

egru commented 8 years ago

Oh, I see what you mean. Right now it's just checking if there is a signature. I suppose I could add in some checks to validate that the signature is actually real, trusted, expired, etc..

phasetwo commented 8 years ago

Thanks, that was what I meant, thanks for your quick reply. imho, it would be really useful to have this implemented too