VBScript + JScript support

[tresf]

Does JSign support VBScript .vbs or JScript .js files?

Reference: https://stackoverflow.com/a/34244366/3196753

Windows will show a warning if a script file is not digitally signed. I assume the technique can be extended to other scriptable languages, such as PowerShell .ps1, etc.

[tresf]

Using the Visual Studio signtool command, I was able to generate the following signatures examples... (click to expand)

JScript

``` // SIG // Begin signature block // SIG // MIIM4AYJKoZIhvcNAQcCoIIM0TCCDM0CAQExCzAJBgUr // SIG // DgMCGgUAMGcGCisGAQQBgjcCAQSgWTBXMDIGCisGAQQB // SIG // gjcCAR4wJAIBAQQQEODJBs441BGiowAQS9NQkAIBAAIB // SIG // AAIBAAIBAAIBADAhMAkGBSsOAwIaBQAEFBTe3LRByBdw // SIG // f/RuE43w7wYm/lkdoIIKLzCCBRIwggP6oAMCAQICAhAA // SIG // MA0GCSqGSIb3DQEBCwUAMIGsMQswCQYDVQQGEwJVUzEL // SIG // MAkGA1UECAwCTlkxEjAQBgNVBAcMCUNhbmFzdG90YTEb // SIG // MBkGA1UECgwSUVogSW5kdXN0cmllcywgTExDMRswGQYD // SIG // VQQLDBJRWiBJbmR1c3RyaWVzLCBMTEMxGTAXBgNVBAMM // SIG // EHF6aW5kdXN0cmllcy5jb20xJzAlBgkqhkiG9w0BCQEW // SIG // GHN1cHBvcnRAcXppbmR1c3RyaWVzLmNvbTAeFw0xNTAz // SIG // MDIwMDUwMThaFw0zNTAzMDIwMDUwMThaMIGYMQswCQYD // SIG // VQQGEwJVUzELMAkGA1UECAwCTlkxGzAZBgNVBAoMElFa // SIG // IEluZHVzdHJpZXMsIExMQzEbMBkGA1UECwwSUVogSW5k // SIG // dXN0cmllcywgTExDMRkwFwYDVQQDDBBxemluZHVzdHJp // SIG // ZXMuY29tMScwJQYJKoZIhvcNAQkBFhhzdXBwb3J0QHF6 // SIG // aW5kdXN0cmllcy5jb20wggIiMA0GCSqGSIb3DQEBAQUA // SIG // A4ICDwAwggIKAoICAQDUw4DS1IqIZf60KGdm0zB1RJNZ // SIG // gNNtC2IYH1oztPhrC5W4OUr1lRVpL+GYH37lUVyx68M9 // SIG // R2KTMqPmYfJLCRfbLCVgsEBjuXIjOnZqK8sgdFWRxmNW // SIG // 5XsHTLsYnlz+yq+lw9xkTBgIRME8Y1MyN5LLkbp1+CHJ // SIG // 0VymJIOaY7OJyxIV7SGVgy4lz1LMlABKtVNanS9QBxLX // SIG // Svy98ywE54TwemYjPh8zRuGgD8p0gN/H6XnmeEdLSDTK // SIG // RU4cDYBlLMWCrD/ZIdIMRpfGBy+mcwuwQvBVyAf9FrXp // SIG // 4NPlywFbaOej8sbewXcbTVblTTV4JAovbTKlV8TpN6CL // SIG // zgw7dFKEFGf7plLqDLji3pGFKWVZOLrQql15QeJlX0uf // SIG // 81gep1cRV/CKNfRTogy08GVbQZs5nopM2+qNUC6fRdkw // SIG // L5X/PgyBgzqNA6T0FLTlMizwoeYQWgxhRGYROeqjwgYk // SIG // CHOE9pJVl//NAuTWZ3f7STcY8lMpO243Q84c09dAhkQL // SIG // KsQJ7I7zA9inDH96FzeDzYMn6W36toqcSdbu++xqW88n // SIG // 9MaCsB/RWIoJqn0R9jdqRHYmGsCq1+qcl8xjOHL0OV9W // SIG // MX9sf/sXUy3VWi52YMK3asBWJg3oxgJXV5WA5d42wR1T // SIG // Nb/rmOSLRk45Pt7y68ZrxsuVxVRvvHxf8WlX6OU1uQID // SIG // AQABo1AwTjAdBgNVHQ4EFgQUkKZQt4TUuepf8gWEE3hF // SIG // 6Kl1VFwwHwYDVR0jBBgwFoAUA0XGTcD6jqkL2oMPQaVt // SIG // EgZDqV4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsF // SIG // AAOCAQEACSDvEoja/Y6S0HlLBVJm7nqMciOS/j+Xlfdn // SIG // HlTidrQJQQNd78xdTVpaUpazJkHFVBPyuA9Nara9JIA7 // SIG // Oi1B749l1y6chKIIrWwYIqZEKcAkyVXwvW1mAcBKLQu2 // SIG // PJlY4xFe7lwE+9Rik8fF5QfZmn/gU2RoMqLpQOaU2Cfv // SIG // u7P8V/YM0lgmvnlxnI4LgbWGF2gI4wKhRkQL7qc9cqw1 // SIG // nAOh/eB3hKySlFwWpEtCZv1d9yQ7lV2PmmfBEItpFfNm // SIG // mWzXV5Zf0eohsNrq+KwxK5x7IqYQYGQe9QuRQ+HHX0jj // SIG // U7GMZj5slG+U/ii1KLsWfQdFodvLnHNS6a2zuwZ41jCC // SIG // BRUwggL9oAMCAQICBDU2NTAwCwYJKoZIhvcNAQEFMIGY // SIG // MQswCQYDVQQGEwJVUzELMAkGA1UECAwCTlkxGzAZBgNV // SIG // BAoMElFaIEluZHVzdHJpZXMsIExMQzEbMBkGA1UECwwS // SIG // UVogSW5kdXN0cmllcywgTExDMRkwFwYDVQQDDBBxemlu // SIG // ZHVzdHJpZXMuY29tMScwJQYJKoZIhvcNAQkBFhhzdXBw // SIG // b3J0QHF6aW5kdXN0cmllcy5jb20wHhcNMTgxMjE5MDUw // SIG // MDAwWhcNMjAxMTA3MDUwMDAwWjCB3jELMAkGA1UEBgwC // SIG // VVMxETAPBgNVBAgMCE5ldyBZb3JrMRIwEAYDVQQHDAlD // SIG // YW5hc3RvdGExGTAXBgNVBAoMEFRyZXMgRmlub2NjaGlh // SIG // cm8xGTAXBgNVBAsMEFRyZXMgRmlub2NjaGlhcm8xGTAX // SIG // BgNVBAMMEFRyZXMgRmlub2NjaGlhcm8xGTAXBgkqhkiG // SIG // 9w0BCQEMCnRyZXNAcXouaW8xPDA6BgNVBA0MM3JlbmV3 // SIG // YWwtb2YtYjc5YzBkYjYxMzc5Y2I0NzlhMTM1NzQxZGFl // SIG // MjllMDQ4MDUyZGY4YjCCASAwCwYJKoZIhvcNAQEBA4IB // SIG // DwAwggEKAoIBAQCouMcBoM0OkA8gyGzLUSAgfrIqdOZV // SIG // a58Auuv3iyy7CKWzq7ITWNpNGMGE3RNCc3tWiAynMqad // SIG // QH8qBi1QP9sX7co94N4LCCUIC5clwZ5wJ6cf4eQlzTCN // SIG // QR+UtjdA78tiuYIQmrbmUzev7hizUIklM0uiDfOaTZNI // SIG // 3noIPDZdDWtmiUGZuxLUTtjjPRDepRURvedKVoDf5259 // SIG // lhvhTNzL8PPPA8xPsMt+n7hELrOyxDWTcymlwnZLI+0/ // SIG // NqbBeXRwLKmDsaweiJCvoNhVT4xxAwPZ0kJaka87Peip // SIG // pPPVHeG7yYIZO7enJFuyQwCawjayOQKqqxd9FyXruTaM // SIG // kY6PAgMBAAGjIzAhMB8GA1UdIwQYMBaAFJCmULeE1Lnq // SIG // X/IFhBN4ReipdVRcMA0GCSqGSIb3DQEBBQUAA4ICAQBH // SIG // i2K28ygz5ONoOEzmr4aY5tff387P3uj+HZGoZOyqg+xB // SIG // sv1BH/ctBsPqoWxxG6/T3GL0ClPF2VmKOYJYf0FGFe/7 // SIG // RHhXtxORyY9B5owTg6o/kBFxyIjpYbQ2n6dzYSbLvkut // SIG // pbMCwqJ6iODH8J3UO8jUuG3OqMezHtvOWZ6SNHC3cGEa // SIG // weffwkCJ1raTS7q7D9K7q1+5XPyCCYOWJCOhBmuKWH8J // SIG // hSKXYi9o8k2K2VcKVgrTziHiVWkbKfB9qvyUeWyWWank // SIG // cajI/ry+q0ej4TjCSI+Vl1MVIgXO5l4oQsJsYSBdZZx8 // SIG // E4QdRQM+7FXIB6XLiL6lj/TbQkQuxsfQUsw8SUkCn+kl // SIG // 1bRyxxEI2H3F6oFhhu0bkQm20T09mwEOyF4M2LfoKxpE // SIG // IgJMMIJ/c04W9uOBkjgIhKEWoSgIzki9OKhjTlkykjii // SIG // KxijXm10DIj/HDROFFvzYpozw/H3Kv70vSjIh6VFjhOZ // SIG // PFU+O9GtAafSdll+owLx1wTskcSK3GfNP8vBKvY08sis // SIG // uEtk56l4YbzC6kWniFNf/Gno1Q4OigPz9+NBtQfiiLOP // SIG // byY8WdFjzyTRVDVAPxfydhYQ8g4zgyVucdof9zTknyUz // SIG // EJvG+UeBVubJqx5yDoU68xKtk/tt1Fju0PQBmu0jtxlo // SIG // WsLx+r6WOJmnlmFrXdKaYjGCAh0wggIZAgEBMIGhMIGY // SIG // MQswCQYDVQQGEwJVUzELMAkGA1UECAwCTlkxGzAZBgNV // SIG // BAoMElFaIEluZHVzdHJpZXMsIExMQzEbMBkGA1UECwwS // SIG // UVogSW5kdXN0cmllcywgTExDMRkwFwYDVQQDDBBxemlu // SIG // ZHVzdHJpZXMuY29tMScwJQYJKoZIhvcNAQkBFhhzdXBw // SIG // b3J0QHF6aW5kdXN0cmllcy5jb20CBDU2NTAwCQYFKw4D // SIG // AhoFAKBSMBAGCisGAQQBgjcCAQwxAjAAMBkGCSqGSIb3 // SIG // DQEJAzEMBgorBgEEAYI3AgEEMCMGCSqGSIb3DQEJBDEW // SIG // BBSLWdFJdp/rHERKQUgewAcAHARUOzANBgkqhkiG9w0B // SIG // AQEFAASCAQBTxY1OetxJmPjMmEsvqPdV5r//S+DTu8zh // SIG // C5RGW0ajmpANapfJAsiSwGYZIbvVONukHhaBJwKRpUeT // SIG // c4b+kNum1KtKxXVBnFkg28sFAJGV/jyE/GcrQGqxvD67 // SIG // sPO9crzuO0VIukSNNreX07nOWSGAaaf5FS+2nR/GeJkm // SIG // VrJIN9KfOalwV/pCd6ge3MqzbWxF/QAxZ1r8JPW8jptW // SIG // 4rItJfDvJIBDbfnKW3+lhZF83Ek+2q85h1XnQHaSP+Eq // SIG // 14+Kd50p59Gj3dkuh7QFuAA0zCjVg9KAAEp/ICBhE5Jd // SIG // 3y4Uxhubdm33ltKgy9otmQg+8IlX3tIuLlzL7me8c0va // SIG // End signature block ```

VBScript

```vbs '' SIG '' Begin signature block '' SIG '' MIIM4AYJKoZIhvcNAQcCoIIM0TCCDM0CAQExCzAJBgUr '' SIG '' DgMCGgUAMGcGCisGAQQBgjcCAQSgWTBXMDIGCisGAQQB '' SIG '' gjcCAR4wJAIBAQQQTvApFpkntU2P5azhDxfrqwIBAAIB '' SIG '' AAIBAAIBAAIBADAhMAkGBSsOAwIaBQAEFM7o7r4hG4YX '' SIG '' P194LadJ+ahScPGEoIIKLzCCBRIwggP6oAMCAQICAhAA '' SIG '' MA0GCSqGSIb3DQEBCwUAMIGsMQswCQYDVQQGEwJVUzEL '' SIG '' MAkGA1UECAwCTlkxEjAQBgNVBAcMCUNhbmFzdG90YTEb '' SIG '' MBkGA1UECgwSUVogSW5kdXN0cmllcywgTExDMRswGQYD '' SIG '' VQQLDBJRWiBJbmR1c3RyaWVzLCBMTEMxGTAXBgNVBAMM '' SIG '' EHF6aW5kdXN0cmllcy5jb20xJzAlBgkqhkiG9w0BCQEW '' SIG '' GHN1cHBvcnRAcXppbmR1c3RyaWVzLmNvbTAeFw0xNTAz '' SIG '' MDIwMDUwMThaFw0zNTAzMDIwMDUwMThaMIGYMQswCQYD '' SIG '' VQQGEwJVUzELMAkGA1UECAwCTlkxGzAZBgNVBAoMElFa '' SIG '' IEluZHVzdHJpZXMsIExMQzEbMBkGA1UECwwSUVogSW5k '' SIG '' dXN0cmllcywgTExDMRkwFwYDVQQDDBBxemluZHVzdHJp '' SIG '' ZXMuY29tMScwJQYJKoZIhvcNAQkBFhhzdXBwb3J0QHF6 '' SIG '' aW5kdXN0cmllcy5jb20wggIiMA0GCSqGSIb3DQEBAQUA '' SIG '' A4ICDwAwggIKAoICAQDUw4DS1IqIZf60KGdm0zB1RJNZ '' SIG '' gNNtC2IYH1oztPhrC5W4OUr1lRVpL+GYH37lUVyx68M9 '' SIG '' R2KTMqPmYfJLCRfbLCVgsEBjuXIjOnZqK8sgdFWRxmNW '' SIG '' 5XsHTLsYnlz+yq+lw9xkTBgIRME8Y1MyN5LLkbp1+CHJ '' SIG '' 0VymJIOaY7OJyxIV7SGVgy4lz1LMlABKtVNanS9QBxLX '' SIG '' Svy98ywE54TwemYjPh8zRuGgD8p0gN/H6XnmeEdLSDTK '' SIG '' RU4cDYBlLMWCrD/ZIdIMRpfGBy+mcwuwQvBVyAf9FrXp '' SIG '' 4NPlywFbaOej8sbewXcbTVblTTV4JAovbTKlV8TpN6CL '' SIG '' zgw7dFKEFGf7plLqDLji3pGFKWVZOLrQql15QeJlX0uf '' SIG '' 81gep1cRV/CKNfRTogy08GVbQZs5nopM2+qNUC6fRdkw '' SIG '' L5X/PgyBgzqNA6T0FLTlMizwoeYQWgxhRGYROeqjwgYk '' SIG '' CHOE9pJVl//NAuTWZ3f7STcY8lMpO243Q84c09dAhkQL '' SIG '' KsQJ7I7zA9inDH96FzeDzYMn6W36toqcSdbu++xqW88n '' SIG '' 9MaCsB/RWIoJqn0R9jdqRHYmGsCq1+qcl8xjOHL0OV9W '' SIG '' MX9sf/sXUy3VWi52YMK3asBWJg3oxgJXV5WA5d42wR1T '' SIG '' Nb/rmOSLRk45Pt7y68ZrxsuVxVRvvHxf8WlX6OU1uQID '' SIG '' AQABo1AwTjAdBgNVHQ4EFgQUkKZQt4TUuepf8gWEE3hF '' SIG '' 6Kl1VFwwHwYDVR0jBBgwFoAUA0XGTcD6jqkL2oMPQaVt '' SIG '' EgZDqV4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsF '' SIG '' AAOCAQEACSDvEoja/Y6S0HlLBVJm7nqMciOS/j+Xlfdn '' SIG '' HlTidrQJQQNd78xdTVpaUpazJkHFVBPyuA9Nara9JIA7 '' SIG '' Oi1B749l1y6chKIIrWwYIqZEKcAkyVXwvW1mAcBKLQu2 '' SIG '' PJlY4xFe7lwE+9Rik8fF5QfZmn/gU2RoMqLpQOaU2Cfv '' SIG '' u7P8V/YM0lgmvnlxnI4LgbWGF2gI4wKhRkQL7qc9cqw1 '' SIG '' nAOh/eB3hKySlFwWpEtCZv1d9yQ7lV2PmmfBEItpFfNm '' SIG '' mWzXV5Zf0eohsNrq+KwxK5x7IqYQYGQe9QuRQ+HHX0jj '' SIG '' U7GMZj5slG+U/ii1KLsWfQdFodvLnHNS6a2zuwZ41jCC '' SIG '' BRUwggL9oAMCAQICBDU2NTAwCwYJKoZIhvcNAQEFMIGY '' SIG '' MQswCQYDVQQGEwJVUzELMAkGA1UECAwCTlkxGzAZBgNV '' SIG '' BAoMElFaIEluZHVzdHJpZXMsIExMQzEbMBkGA1UECwwS '' SIG '' UVogSW5kdXN0cmllcywgTExDMRkwFwYDVQQDDBBxemlu '' SIG '' ZHVzdHJpZXMuY29tMScwJQYJKoZIhvcNAQkBFhhzdXBw '' SIG '' b3J0QHF6aW5kdXN0cmllcy5jb20wHhcNMTgxMjE5MDUw '' SIG '' MDAwWhcNMjAxMTA3MDUwMDAwWjCB3jELMAkGA1UEBgwC '' SIG '' VVMxETAPBgNVBAgMCE5ldyBZb3JrMRIwEAYDVQQHDAlD '' SIG '' YW5hc3RvdGExGTAXBgNVBAoMEFRyZXMgRmlub2NjaGlh '' SIG '' cm8xGTAXBgNVBAsMEFRyZXMgRmlub2NjaGlhcm8xGTAX '' SIG '' BgNVBAMMEFRyZXMgRmlub2NjaGlhcm8xGTAXBgkqhkiG '' SIG '' 9w0BCQEMCnRyZXNAcXouaW8xPDA6BgNVBA0MM3JlbmV3 '' SIG '' YWwtb2YtYjc5YzBkYjYxMzc5Y2I0NzlhMTM1NzQxZGFl '' SIG '' MjllMDQ4MDUyZGY4YjCCASAwCwYJKoZIhvcNAQEBA4IB '' SIG '' DwAwggEKAoIBAQCouMcBoM0OkA8gyGzLUSAgfrIqdOZV '' SIG '' a58Auuv3iyy7CKWzq7ITWNpNGMGE3RNCc3tWiAynMqad '' SIG '' QH8qBi1QP9sX7co94N4LCCUIC5clwZ5wJ6cf4eQlzTCN '' SIG '' QR+UtjdA78tiuYIQmrbmUzev7hizUIklM0uiDfOaTZNI '' SIG '' 3noIPDZdDWtmiUGZuxLUTtjjPRDepRURvedKVoDf5259 '' SIG '' lhvhTNzL8PPPA8xPsMt+n7hELrOyxDWTcymlwnZLI+0/ '' SIG '' NqbBeXRwLKmDsaweiJCvoNhVT4xxAwPZ0kJaka87Peip '' SIG '' pPPVHeG7yYIZO7enJFuyQwCawjayOQKqqxd9FyXruTaM '' SIG '' kY6PAgMBAAGjIzAhMB8GA1UdIwQYMBaAFJCmULeE1Lnq '' SIG '' X/IFhBN4ReipdVRcMA0GCSqGSIb3DQEBBQUAA4ICAQBH '' SIG '' i2K28ygz5ONoOEzmr4aY5tff387P3uj+HZGoZOyqg+xB '' SIG '' sv1BH/ctBsPqoWxxG6/T3GL0ClPF2VmKOYJYf0FGFe/7 '' SIG '' RHhXtxORyY9B5owTg6o/kBFxyIjpYbQ2n6dzYSbLvkut '' SIG '' pbMCwqJ6iODH8J3UO8jUuG3OqMezHtvOWZ6SNHC3cGEa '' SIG '' weffwkCJ1raTS7q7D9K7q1+5XPyCCYOWJCOhBmuKWH8J '' SIG '' hSKXYi9o8k2K2VcKVgrTziHiVWkbKfB9qvyUeWyWWank '' SIG '' cajI/ry+q0ej4TjCSI+Vl1MVIgXO5l4oQsJsYSBdZZx8 '' SIG '' E4QdRQM+7FXIB6XLiL6lj/TbQkQuxsfQUsw8SUkCn+kl '' SIG '' 1bRyxxEI2H3F6oFhhu0bkQm20T09mwEOyF4M2LfoKxpE '' SIG '' IgJMMIJ/c04W9uOBkjgIhKEWoSgIzki9OKhjTlkykjii '' SIG '' KxijXm10DIj/HDROFFvzYpozw/H3Kv70vSjIh6VFjhOZ '' SIG '' PFU+O9GtAafSdll+owLx1wTskcSK3GfNP8vBKvY08sis '' SIG '' uEtk56l4YbzC6kWniFNf/Gno1Q4OigPz9+NBtQfiiLOP '' SIG '' byY8WdFjzyTRVDVAPxfydhYQ8g4zgyVucdof9zTknyUz '' SIG '' EJvG+UeBVubJqx5yDoU68xKtk/tt1Fju0PQBmu0jtxlo '' SIG '' WsLx+r6WOJmnlmFrXdKaYjGCAh0wggIZAgEBMIGhMIGY '' SIG '' MQswCQYDVQQGEwJVUzELMAkGA1UECAwCTlkxGzAZBgNV '' SIG '' BAoMElFaIEluZHVzdHJpZXMsIExMQzEbMBkGA1UECwwS '' SIG '' UVogSW5kdXN0cmllcywgTExDMRkwFwYDVQQDDBBxemlu '' SIG '' ZHVzdHJpZXMuY29tMScwJQYJKoZIhvcNAQkBFhhzdXBw '' SIG '' b3J0QHF6aW5kdXN0cmllcy5jb20CBDU2NTAwCQYFKw4D '' SIG '' AhoFAKBSMBAGCisGAQQBgjcCAQwxAjAAMBkGCSqGSIb3 '' SIG '' DQEJAzEMBgorBgEEAYI3AgEEMCMGCSqGSIb3DQEJBDEW '' SIG '' BBTtcWTnVdRERG37vHiVoZYDggqtpjANBgkqhkiG9w0B '' SIG '' AQEFAASCAQBRUCrjMLSmYGgdkNMdguqDUw3kukiwLkve '' SIG '' HBbopAVik5vGPUCMBYPh2MU7pWmpGuCNXQFgenEPgYap '' SIG '' yZeuA36pYuAror28w+WLmI1ZtO4pmeWRd/nOTxrQCZK4 '' SIG '' lO0xJMkVQGrlXwDsCIXoNb664DmIwU8mvkjI9wt10iNn '' SIG '' F7BQSXSgpWfpaBrkp4kTScF94px7Z/TUq7XkF5bfZBxu '' SIG '' tMcIeg2PzomqlKo4mxk8em3pB2Z3o+ICoTIc1b3fw6T/ '' SIG '' e9GjqTtlOS8vAMQC53gnXumbMARmQxOfopZs/6Hb8Jb/ '' SIG '' zdCvgWiEnisS7NmTzmfBJZP9r9MeF5Rap/gNxHEmhtuJ '' SIG '' End signature block ```

PowerShell

```ps1 # SIG # Begin signature block # MIIM4gYJKoZIhvcNAQcCoIIM0zCCDM8CAQExCzAJBgUrDgMCGgUAMGkGCisGAQQB # gjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR # AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUPqwCC3TdbNNn6hf12Z6rn1Zw # uF6gggovMIIFEjCCA/qgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgawxCzAJBgNV # BAYTAlVTMQswCQYDVQQIDAJOWTESMBAGA1UEBwwJQ2FuYXN0b3RhMRswGQYDVQQK # DBJRWiBJbmR1c3RyaWVzLCBMTEMxGzAZBgNVBAsMElFaIEluZHVzdHJpZXMsIExM # QzEZMBcGA1UEAwwQcXppbmR1c3RyaWVzLmNvbTEnMCUGCSqGSIb3DQEJARYYc3Vw # cG9ydEBxemluZHVzdHJpZXMuY29tMB4XDTE1MDMwMjAwNTAxOFoXDTM1MDMwMjAw # NTAxOFowgZgxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJOWTEbMBkGA1UECgwSUVog # SW5kdXN0cmllcywgTExDMRswGQYDVQQLDBJRWiBJbmR1c3RyaWVzLCBMTEMxGTAX # BgNVBAMMEHF6aW5kdXN0cmllcy5jb20xJzAlBgkqhkiG9w0BCQEWGHN1cHBvcnRA # cXppbmR1c3RyaWVzLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB # ANTDgNLUiohl/rQoZ2bTMHVEk1mA020LYhgfWjO0+GsLlbg5SvWVFWkv4ZgffuVR # XLHrwz1HYpMyo+Zh8ksJF9ssJWCwQGO5ciM6dmoryyB0VZHGY1blewdMuxieXP7K # r6XD3GRMGAhEwTxjUzI3ksuRunX4IcnRXKYkg5pjs4nLEhXtIZWDLiXPUsyUAEq1 # U1qdL1AHEtdK/L3zLATnhPB6ZiM+HzNG4aAPynSA38fpeeZ4R0tINMpFThwNgGUs # xYKsP9kh0gxGl8YHL6ZzC7BC8FXIB/0Wteng0+XLAVto56Pyxt7BdxtNVuVNNXgk # Ci9tMqVXxOk3oIvODDt0UoQUZ/umUuoMuOLekYUpZVk4utCqXXlB4mVfS5/zWB6n # VxFX8Io19FOiDLTwZVtBmzmeikzb6o1QLp9F2TAvlf8+DIGDOo0DpPQUtOUyLPCh # 5hBaDGFEZhE56qPCBiQIc4T2klWX/80C5NZnd/tJNxjyUyk7bjdDzhzT10CGRAsq # xAnsjvMD2KcMf3oXN4PNgyfpbfq2ipxJ1u777Gpbzyf0xoKwH9FYigmqfRH2N2pE # diYawKrX6pyXzGM4cvQ5X1Yxf2x/+xdTLdVaLnZgwrdqwFYmDejGAldXlYDl3jbB # HVM1v+uY5ItGTjk+3vLrxmvGy5XFVG+8fF/xaVfo5TW5AgMBAAGjUDBOMB0GA1Ud # DgQWBBSQplC3hNS56l/yBYQTeEXoqXVUXDAfBgNVHSMEGDAWgBQDRcZNwPqOqQva # gw9BpW0SBkOpXjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAJIO8S # iNr9jpLQeUsFUmbueoxyI5L+P5eV92ceVOJ2tAlBA13vzF1NWlpSlrMmQcVUE/K4 # D01qtr0kgDs6LUHvj2XXLpyEogitbBgipkQpwCTJVfC9bWYBwEotC7Y8mVjjEV7u # XAT71GKTx8XlB9maf+BTZGgyoulA5pTYJ++7s/xX9gzSWCa+eXGcjguBtYYXaAjj # AqFGRAvupz1yrDWcA6H94HeErJKUXBakS0Jm/V33JDuVXY+aZ8EQi2kV82aZbNdX # ll/R6iGw2ur4rDErnHsiphBgZB71C5FD4cdfSONTsYxmPmyUb5T+KLUouxZ9B0Wh # 28ucc1LprbO7BnjWMIIFFTCCAv2gAwIBAgIENTY1MDALBgkqhkiG9w0BAQUwgZgx # CzAJBgNVBAYTAlVTMQswCQYDVQQIDAJOWTEbMBkGA1UECgwSUVogSW5kdXN0cmll # cywgTExDMRswGQYDVQQLDBJRWiBJbmR1c3RyaWVzLCBMTEMxGTAXBgNVBAMMEHF6 # aW5kdXN0cmllcy5jb20xJzAlBgkqhkiG9w0BCQEWGHN1cHBvcnRAcXppbmR1c3Ry # aWVzLmNvbTAeFw0xODEyMTkwNTAwMDBaFw0yMDExMDcwNTAwMDBaMIHeMQswCQYD # VQQGDAJVUzERMA8GA1UECAwITmV3IFlvcmsxEjAQBgNVBAcMCUNhbmFzdG90YTEZ # MBcGA1UECgwQVHJlcyBGaW5vY2NoaWFybzEZMBcGA1UECwwQVHJlcyBGaW5vY2No # aWFybzEZMBcGA1UEAwwQVHJlcyBGaW5vY2NoaWFybzEZMBcGCSqGSIb3DQEJAQwK # dHJlc0Bxei5pbzE8MDoGA1UEDQwzcmVuZXdhbC1vZi1iNzljMGRiNjEzNzljYjQ3 # OWExMzU3NDFkYWUyOWUwNDgwNTJkZjhiMIIBIDALBgkqhkiG9w0BAQEDggEPADCC # AQoCggEBAKi4xwGgzQ6QDyDIbMtRICB+sip05lVrnwC66/eLLLsIpbOrshNY2k0Y # wYTdE0Jze1aIDKcypp1AfyoGLVA/2xftyj3g3gsIJQgLlyXBnnAnpx/h5CXNMI1B # H5S2N0Dvy2K5ghCatuZTN6/uGLNQiSUzS6IN85pNk0jeegg8Nl0Na2aJQZm7EtRO # 2OM9EN6lFRG950pWgN/nbn2WG+FM3Mvw888DzE+wy36fuEQus7LENZNzKaXCdksj # 7T82psF5dHAsqYOxrB6IkK+g2FVPjHEDA9nSQlqRrzs96Kmk89Ud4bvJghk7t6ck # W7JDAJrCNrI5AqqrF30XJeu5NoyRjo8CAwEAAaMjMCEwHwYDVR0jBBgwFoAUkKZQ # t4TUuepf8gWEE3hF6Kl1VFwwDQYJKoZIhvcNAQEFBQADggIBAEeLYrbzKDPk42g4 # TOavhpjm19/fzs/e6P4dkahk7KqD7EGy/UEf9y0Gw+qhbHEbr9PcYvQKU8XZWYo5 # glh/QUYV7/tEeFe3E5HJj0HmjBODqj+QEXHIiOlhtDafp3NhJsu+S62lswLConqI # 4MfwndQ7yNS4bc6ox7Me285ZnpI0cLdwYRrB59/CQInWtpNLursP0rurX7lc/IIJ # g5YkI6EGa4pYfwmFIpdiL2jyTYrZVwpWCtPOIeJVaRsp8H2q/JR5bJZZqeRxqMj+ # vL6rR6PhOMJIj5WXUxUiBc7mXihCwmxhIF1lnHwThB1FAz7sVcgHpcuIvqWP9NtC # RC7Gx9BSzDxJSQKf6SXVtHLHEQjYfcXqgWGG7RuRCbbRPT2bAQ7IXgzYt+grGkQi # Akwwgn9zThb244GSOAiEoRahKAjOSL04qGNOWTKSOKIrGKNebXQMiP8cNE4UW/Ni # mjPD8fcq/vS9KMiHpUWOE5k8VT470a0Bp9J2WX6jAvHXBOyRxIrcZ80/y8Eq9jTy # yKy4S2TnqXhhvMLqRaeIU1/8aejVDg6KA/P340G1B+KIs49vJjxZ0WPPJNFUNUA/ # F/J2FhDyDjODJW5x2h/3NOSfJTMQm8b5R4FW5smrHnIOhTrzEq2T+23UWO7Q9AGa # 7SO3GWhawvH6vpY4maeWYWtd0ppiMYICHTCCAhkCAQEwgaEwgZgxCzAJBgNVBAYT # AlVTMQswCQYDVQQIDAJOWTEbMBkGA1UECgwSUVogSW5kdXN0cmllcywgTExDMRsw # GQYDVQQLDBJRWiBJbmR1c3RyaWVzLCBMTEMxGTAXBgNVBAMMEHF6aW5kdXN0cmll # cy5jb20xJzAlBgkqhkiG9w0BCQEWGHN1cHBvcnRAcXppbmR1c3RyaWVzLmNvbQIE # NTY1MDAJBgUrDgMCGgUAoFIwEAYKKwYBBAGCNwIBDDECMAAwGQYJKoZIhvcNAQkD # MQwGCisGAQQBgjcCAQQwIwYJKoZIhvcNAQkEMRYEFMEwj9IranNmX5Ge9KREkZRC # VHWnMA0GCSqGSIb3DQEBAQUABIIBAEuSG+SQs4wGe9jsbPo8Q+gx9Bu588xGpnpv # kCD1WY+kN/R7H6hRsOtZvEYSDjrfND+ioW8zu/HeFkYvfkVJ2SwDhG2Np5sLvcf0 # nNwvSeLPJnPz9yVRL6YMGH53gyJ527fAY9+MZrhCALIU3ofqXGcjIaNGLFVmO1uw # meW5Y4H7sv5EnXLQYZdJ2KALpMhmhj2yTCezMp8tY3tx1fxDNT4KmqEBdUieHJiN # CoE8TtK00RD7vTiw179k6F6Yjyvbaz3ywE5SR3MDq2GJGIKzqGI3UEyLBbhozBaa # cWWUhW0VhJqc559V/o3bSMI8jx5Ub4Mb1KZaR0Gf5KPh/FRJFCQ= # SIG # End signature block ```

[ebourg]

Thank you for the suggestion Tres, I wasn't aware VBScript and JScript files could also be signed. PowerShell script signing has just been implemented. I guess we could extend it to support the other types of files.

[ebourg]

Just tried signtool on an XML file, it doesn't recognize a mere .xml file, but if the extension is changed to .ps1xml the following block is appended at the end of the file:

<!-- SIG # Begin signature block -->
<!-- MIIEmwYJKoZIhvcNAQcCoIIEjDCCBIgCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQB -->
<!-- gjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR -->
<!-- AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUYglJp0ak80SxvLGkWVSR4bR9 -->
<!-- yQugggLAMIICvDCCAaSgAwIBAgIJAP9OZxamrmcQMA0GCSqGSIb3DQEBCwUAMCAx -->
<!-- HjAcBgNVBAMMFUpzaWduIENvZGUgU2lnbmluZyBDQTAeFw0xNzA2MTUxOTU1NTZa -->
<!-- Fw0zNzA2MTAxOTU1NTZaMC4xLDAqBgNVBAMMI0pzaWduIENvZGUgU2lnbmluZyBU -->
<!-- ZXN0IENlcnRpZmljYXRlMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCaMIoK -->
<!-- K5Hk0xKFpNqJAfPU37WYKLJ1A5G6qHZias6Ub6VYGSbgZ5KLIpq9+/U6hlXjJGEB -->
<!-- rX9Y5aB/vsb3cm/MV9q9G/ilooIFsFs4Jp9EIJEABJHFPRpo1iZ3nfAhPiL1FlDH -->
<!-- phdTkAmwN1CPzl7poyV7qAh3517TNbiRjyMW7QIDAQABo28wbTAJBgNVHRMEAjAA -->
<!-- MAsGA1UdDwQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUKe9f -->
<!-- HJxmCiML1BRgdczt0cV16R0wHwYDVR0jBBgwFoAUFqIGcZGo1ChElx+V5xpfjJu+ -->
<!-- K+AwDQYJKoZIhvcNAQELBQADggEBAIjNRVnxdn8QkUSwFONiIdEW+DvupbciSzMD -->
<!-- bjvVUTeyKV92ibOpBOfqxuBYu2lyk7ZpAEV1aNaZG9C/2GPOHoUyz6JTHm3mZema -->
<!-- WgQ3lYJA5BIDwr5pqyxg82bpHw2FzcqDljWlmkerlj+orOpn7j/rq9wOXWNQbX2a -->
<!-- jqspebyQnYyM/VxFyEdZ4XZswJNSYFTvRSwbxjXrR+icwJCJyBk3g+A+2TXWYIWn -->
<!-- AscXTCvbewplUcL+va34nW3JwMWmdic/fkxTiv1eHleKMBPnUAjuL2U/gePbh6mR -->
<!-- qb1FY7BHwOJDoyuXLXP54J7qHtJu/tfmB+6QzSEThgw7WwozARkxggFFMIIBQQIB -->
<!-- ATAtMCAxHjAcBgNVBAMMFUpzaWduIENvZGUgU2lnbmluZyBDQQIJAP9OZxamrmcQ -->
<!-- MAkGBSsOAwIaBQCgcDAQBgorBgEEAYI3AgEMMQIwADAZBgkqhkiG9w0BCQMxDAYK -->
<!-- KwYBBAGCNwIBBDAcBgorBgEEAYI3AgELMQ4wDAYKKwYBBAGCNwIBFTAjBgkqhkiG -->
<!-- 9w0BCQQxFgQUxUqHLsf6C63ELQCTso2fsCFCLJAwDQYJKoZIhvcNAQEBBQAEgYAc -->
<!-- 5sLhwuhq5hwa0B63iBaU7Tz0VyXQYcRj5477sP4bswP4lAHH3zJvEdHiC1nJr8VE -->
<!-- RC4PzN26jyAiT+e2cqbWzVaQ4rxffM3H5VPdOcrbmExBtAWrr7iQVunUxWHL5VSg -->
<!-- RCPNY5qojWXObSuf4GD7CxwvHBahSbeEgozZXJFqNQ== -->
<!-- SIG # End signature block -->

[ebourg]

I've played a bit with VBScript and JScript files, it looks like the hashing method is different from the PowerShell scripts. For PowerShell the content is converted to UTF-16LE before being hashed. For VB and JS it doesn't work, the hash generated differs from the one computed by signtool. I tried various encodings (UTF-8, UTF-16BE, UTF-32BE/LE, with or without byte order marks) but it still doesn't match.

[ebourg]

I've pushed my work on VB/JS signing to the vbscript-jscript-support branch. If someone figures out how to hash the files I'll merge it for the next release.

[tresf]

An expert on Windows signing is Chilkatsoft, a commercial project that provides modern signing algorithms to languages like Classic ASP (and many others). I've used and recommended chilkat many times, perhaps he has some input on this.

@chilkatsoft, I hope you don't mind me asking, are you aware of how VBScript or JScript files are hashed in order to create the digital signature?

The topic of signing VBScript files is pretty dark on the internet. Lately, I've been using GitHub's search for code that Google doesn't index and I've found quite a bit. I'm struggling to find anything on GitHub for this topic, probably because of the lack of a unique keyword to search for. I'll keep digging.

[tresf]

I've also posted the question to stackoverflow.

[tresf]

@ebourg something very peculiar... if I add newlines to the bottom of the file, it still generates the same signature. If I leave the signature block at the bottom of the file, it's still generating the same signature. Is there a chance that it's doing some form of trimming before signing?

Scratch that... still investigating.

[tresf]

@ebourg why would the signature change each time I use jsign, but remain the same each subsequent call when using signtool.exe? I'm viewing the file with a hex-editor and I don't see any obvious bytes being added.

jsign

java -jar jsign.jar --keystore my-key.p12 --storepass password --alias my-alias my-script.vbs

signtool

signtool.exe sign /f my-key.p12 /p password my-script.vbs

[tresf]

@ebourg why would the signature change each time I use jsign,

Answering my own question.... There seems to be a slight bug when --replace command line option isn't provided, the signature changes each time it's called. Using --replace, the signature value is reproducible... Still investigating...

[tresf]

So it turns out Windows has a pretty decent signature viewer for debugging this... (Properties, Digital Signatures, Details, Advanced)...

Differences:

jsign:

• Defaults to SHA-256
• Defaults to the following ObjectIdentifiers:
  • 1.3.6.1.4.1.311.2.1.12(SPC_SP_OPUS_INFO_OBJID)
  • 1.3.6.1.4.1.311.2.1.11 (SPC_STATEMENT_TYPE_OBJID)
  • 1.2.840.113549.1.9.52 (CMSAlgorithmProtection)

signtool:

• Defaults to SHA-1
• Defaults to the following ObjectIdentifiers:
  • 1.3.6.1.4.1.311.2.1.12(SPC_SP_OPUS_INFO_OBJID)

Interestingly, Windows 10 recognizes the SHA-256 signature just fine. My attempts to mimic the signtool.exe behavior were somewhat successful:

• Cosmetic: Modify signature block wrapping to start += 44 / start + 44
• Signature Calculation: Comment out the addition of SPC_STATEMENT_TYPE_OBJID
• Signature Calculation: Force SHA-1 signatures using --alg SHA-1 command line flag
• Signature Calculation: Remove CMSAlgorithmProtection by removing it explicitly from FilteredAttributeTableGenerator, BouncyCastle seems to add it by default.

What I'm still unable to remove is the CMSAlgorithmProtection property, which I believe will aid in yielding an identical signature value.

Edit: I was able to remove CMSAlgorithmProtection by removing it explicitly from FilteredAttributeTableGenerator:

         for (ASN1ObjectIdentifier identifier : removedAttributes) {
             attributes = attributes.remove(identifier);
         }
+
+        attributes = attributes.remove(CMSAttributes.cmsAlgorithmProtect);

[ebourg]

@tresf thank you for looking into this. The issue is the hash that goes into the SpcIndirectData structure, I have no idea how it is computed. For PowerShell the text in converted to UTF-16 and then hashed with the algorithm selected, but for VB/JS it's a mystery.

I've used and recommended chilkat many times, perhaps he has some input on this.

Did they implement Authenticode for VB/JS?

Cosmetic: Modify signature block wrapping to start += 44 / start + 44 Signature Calculation: Comment out the addition of SPC_STATEMENT_TYPE_OBJID

I don't think this makes a difference.

Signature Calculation: Remove CMSAlgorithmProtection

I'm aware Jsign puts an extra CMSAlgorithmProtection attributes compared to signtool, but it doesn't cause any issue. AFAIK it even strengthens the signature.

[chilkatsoft]

Sorry.. I've been extremely busy today.  I'm curious and will have a look sometime soon.. 

Best Regards, Matt Fausey Chilkat Software, Inc.

On 12/16/2019 5:08 PM, Emmanuel Bourg wrote:

@tresf thank you for looking into this. The issue is the hash that goes into the SpcIndirectData structure, I have no idea how it is computed. For PowerShell the text in converted to UTF-16 and then hashed with the algorithm selected, but for VB/JS it's a mystery.

I've used and recommended chilkat many times, perhaps he has some input on this.

Did they implement Authenticode for VB/JS?

Cosmetic: Modify signature block wrapping to start += 44 / start + 44 Signature Calculation: Comment out the addition of SPC_STATEMENT_TYPE_OBJID

I don't think this makes a difference.

Signature Calculation: Remove CMSAlgorithmProtection

I'm aware Jsign puts an extra CMSAlgorithmProtection attributes compared to signtool, but it doesn't cause any issue. AFAIK it even strengthens the signature.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

[tresf]

@tresf thank you for looking into this. The issue is the hash that goes into the SpcIndirectData structure, I have no idea how it is computed. For PowerShell the text in converted to UTF-16 and then hashed with the algorithm selected, but for VB/JS it's a mystery.

I spent quite a bit of time on this myself. I tried UTF-8, ISO-8859-1, Cp1252 and the encodings methods you've mentioned to no avail.

The only unit test that I have is to try to match the signature exactly, which I was unable to do, is there a better unit test I should be using? I've seen other (unrelated) programs use undocumented or poorly documented obfuscation techniques... it'd be nice if we could crack it.

signtool.exe does have a verify flag that can be used to check for validity of a signature. Did you have any luck?

[tresf]

Did some more digging, I haven't found anything, but I wanted to share my failures, if nothing else.

• I was hoping that Mono's signcode would have .vbs|.js support, but it appears VBScript support in general is largely abandoned by the Mono team.
• Same goes for osslsigncode, I can't find any references to supporting .vbs or .js script files in the source.
• Probably unrelated, but one peculiar item I found digging was a strange string value called <<<Obsolete>>>. This occurs in both Microsot's 2008 Windows Authenticode Portable Executable Signature Format document as well as in Mono's signing class. I don't know if this data goes into the signed hash or if it's part of the content that's not signed, but it stood out to me as peculiar so I wanted to mention it.
• PowerShell's Set-AuthenticodeSignaturehasn't been ported to non-Windows platforms yet.

Edit: More digging... still no answers:

• StackOverflow - How to validate authenticode for Javascript in C#
• StackOverflow - Retrieve information about digital signature of a non-exe file?
• Practical Windows Code and Driver Signing - Code and driver signing for Microsoft Windows 10, 8.1, 8, 7, Vista, and XP PDF mirror
• Closed - Request to Microsoft to open-source signtool
• Wine's open-source port of WinVerifyTrust

[ebourg]

I was hoping that Mono's signcode would have .vbs|.js support, but it appears VBScript

signcode works with PE files only (.exe, .dll)

Same goes for osslsigncode

It supports PE , MSI and CAB files, but not scripts.

Probably unrelated, but one peculiar item I found digging was a strange string value called <<>>

This is mentioned in the Authenticode specification, it doesn't affect the content hash.

PowerShell's Set-AuthenticodeSignature hasn't been ported to non-Windows platforms yet.

Like signtool it delegates the actual work to the registered SIPs anyway, so the code won't help.

The best hope is probably to debug the SIP for VB/JS scripts, but I haven't figured out which dll implements it yet.

[ebourg]

The DLL implementing VB/JS signing is C:\Windows\System32\wshext.dll

[ebourg]

...and more specifically the HashFile method in this DLL.

[ebourg]

Looking at the DLL it appears that Windows Script Files (.wsf) can also be signed. A signed wsf file look like this:

<?xml version="1.0" ?>
<job>
  <script language="VBScript">
    <![CDATA[
    WScript.echo "Hello World!"
    ]]>
  </script>

<signature>
** SIG ** MIIH4AYJKoZIhvcNAQcCoIIH0TCCB80CAQExCzAJBgUr
** SIG ** DgMCGgUAMGcGCisGAQQBgjcCAQSgWTBXMDIGCisGAQQB
[...]
** SIG ** BSdshFkEZt2VUvJbXF+Wd6RSVKGt0Bnv8HXXv1kIh2Vk
** SIG ** VlR6x2X/Huuo9JTfDux8rEfWPQDDxZK575CkhCXYRjtQ
** SIG ** 13lhbkRJsQ==
</signature>
</job>

[ebourg]

I got it, the script is indeed hashed in UTF-16LE, but the size of the unsigned file encoded as a 4 bytes little endian integer is added to the hash.

[ebourg]

@tresf the hash is now implemented on the vbscript-jscript-support branch. Let me know how it works for you.

[tresf]

@ebourg thanks for this, it's greatly appreciated.

So I'm testing ant integration using the DigiCert code signing certificate we have and signtool verify is erroring. This same error occurs for .exes which are distributed on mass, so I assume I'm not using the verify command properly.

I'd like to try to raise the Windows security prompt, but I'm having trouble doing so.

  The signature is timestamped: Tue Dec 17 13:52:28 2019
  Timestamp Verified by:
      Issued to: DigiCert Assured ID Root CA
      Issued by: DigiCert Assured ID Root CA
      Expires:   Sun Nov 09 19:00:00 2031
      SHA1 hash: 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

          Issued to: DigiCert Assured ID CA-1
          Issued by: DigiCert Assured ID Root CA
          Expires:   Tue Nov 09 19:00:00 2021
          SHA1 hash: 19A09B5A36F4DD99727DF783C17A51231A56C117

              Issued to: DigiCert Timestamp Responder
              Issued by: DigiCert Assured ID CA-1
              Expires:   Mon Oct 21 19:00:00 2024
              SHA1 hash: 614D271D9102E30169822487FDE5DE00A352B01D

- SignTool Error: A certificate chain processed, but terminated in a root
-        certificate which is not trusted by the trust provider.

[tresf]

I think it's working. Here's my first unit test:

Unsigned

• Download unsigned JavaScript file: windows-keygen-unsigned.txt
• Renamed file extension to .js
• Double-click, warning says "Unknown Publisher"

Signed

• Download signed JavaScript file: windows-keygen.txt
• Renamed file extension to .js
• Double-click, no warning

[tresf]

Found it per https://stackoverflow.com/q/11230091/3196753:

signtool.exe verify /pa path/to/file.js

Quoting:

The /pa option to tells it to use the Default Authentication Verification Policy instead of the Windows Driver Verification Policy

This produces:

Successfully verified: path/to/file.js

Unit tests for .js pass.

[chilkatsoft]

I finally had a chance to try to get up to speed.

My first big question was: How to compute the hash?   It seems you already found the solution to that -- by converting to UTF16-LE and adding the 4-byte length.. That's probably the most difficult hurdle.  The remaining hurdles are tedious and time-consuming tasks, and I don't think I'd be of much help.

The reason is that my approach would be to use the internal infrastructure within Chilkat to solve each problem.  In other words, the Chilkat proprietary code for PKCS*, ASN.1, etc., whereas your solution would be using the API's provided by Java, BounceyCastle, or something else, and I'm not actually super familiar with those API's.  

Best Regards, Matt Fausey Chilkat Software, Inc.

On 12/17/2019 1:52 PM, Tres Finocchiaro wrote:

Found it per https://stackoverflow.com/q/11230091/3196753:

signtool.exe verify /pa path/to/file.js

Quoting:

The /pa option to tells it to use the Default Authentication Verification Policy instead of the *Windows Driver Verification Policy

This produces:

Successfully verified: path/to/file.js

Unit tests for .js pass.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

[tresf]

It seems you already found the solution to that -- by converting to UTF16-LE and adding the 4-byte length..

Yes, that was the missing puzzle piece.