Delphi 编写 数字签名验证 并获取签名信息
一个客户想通过编程实现验证程序自身的数字签名来确保程序的完整性,防范病毒感染以及防止一些无聊人士的修改(通过十六进制编辑器替换一些版权、网址、LOGO..); 为此我做了一个数字签名验证的小例子,其中也有获取签名者信息的方法,以满足“自验证”的需求。
示例:
WinAPI:
• 安全编录(CAT)
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
• 验证文件的签名(主API)
WinVerifyTrust
• 获取签名信息
WTHelperProvDataFromStateData
• 获取证书名字信息
CertGetNameString
代码:
{
* by: HouSoft
* site: www.yryz.net
* created: 2012/02/03
}
unit Unit1;
inte易做图ce
uses
Windows, Sysutils, jwaWinCrypt, WinTrustApi;
procedure Test;
implementation
procedure PrintCertChain(pCertChain: PCERT_SIMPLE_CHAIN);
var
I: Integer;
sBuf: string;
begin
// 开启指针运算
{$POINTERMATH ON}
//
// 输出书链元素
for I := pCertChain^.cElement - 1 downto 0 do
begin
SetLength(sBuf, 1024);
SetLength(sBuf,
CertGetNameString(
pCertChain^.rgpElement[I].pCertContext,
CERT_NAME_SIMPLE_DISPLAY_TYPE, // 简单名字
0,
nil,
PChar(sBuf),
Length(sBuf)) - 1);
WriteLn(#9, StringOfChar(' ', 2 * (pCertChain^.cElement - I - 1)), sBuf);
end;
end;
procedure OutSignerInfo(hWVTStateData: THANDLE);
var
provData: PCRYPT_PROVIDER_DATA;
LSysTime: TSystemTime;
begin
// 获取签名信息
// http://msdn.microsoft.com/ZH-CN/library/windows/desktop/aa388429(v=vs.85).aspx
provData := WTHelperProvDataFromStateData(hWVTStateData);
if (provData <> nil) and (provData^.pasSigners <> nil) then
begin
// 采用安全编录(CAT)签名
if provData^.pPDSip^.psSipCATSubjectInfo <> nil then
begin
WriteLn('安全编录: ');
WriteLn(#9, provData^.pPDSip^.psSipCATSubjectInfo^.pwsFileName);
WriteLn('');
end;
/// 注意: provData^.pasSigners 是数组, 但常见的都是一个元素,so...
// 时间戳
if provData^.pasSigners^.pasCounterSigners <> nil then
begin
FileTimeToSystemTime(provData^.pasSigners^.pasCounterSigners^.sftVerifyAsOf, LSysTime);
WriteLn('时间戳: ');
WriteLn(#9, FormatDateTime('yyyy-MM-dd hh:mm:ss', SystemTimeToDateTime(LSysTime)));
WriteLn('');
WriteLn('时间戳证书链: ');
PrintCertChain(provData^.pasSigners^.pasCounterSigners^.pChainContext^.rgpChain[0]);
WriteLn('');
end;
WriteLn('签名者证书链:');
PrintCertChain(provData^.pasSigners^.pChainContext^.rgpChain[0]);
WriteLn('');
end;
end;
function SignVerify(FileName: string): Boolean;
var
aByteHash: array [0 .. 255] of Byte;
iByteCount: Integer;
hCatAdminContext: HCatAdmin;
WTrustData: WINTRUST_DATA;
WTDCatalogInfo: WINTRUST_CATALOG_INFO;
WTDFileInfo: WINTRUST_FILE_INFO;
CatalogInfo: CATALOG_INFO;
hFile: THANDLE;
hCatalogContext: THANDLE;
swFilename: WideString;
swMemberTag: WideString;
ilRet: Longint;
I: Integer;
begin
Result := False;
if not FileExists(FileName) then
Exit;
swFilename := FileName;
ZeroMemory(@CatalogInfo, SizeOf(CatalogInfo));
ZeroMemory(@WTDFileInfo, SizeOf(WTDFileInfo));
ZeroMemory(@WTDCatalogInfo, SizeOf(WTDCatalogInfo));
ZeroMemory(@WTrustData, SizeOf(WTrustData));
hCatalogContext := 0;
hCatAdminContext := 0;
try
// 先查询安全编目
if not CryptCATAdminAcquireContext(@hCatAdminContext,
nil,
0) then
Exit;
hFile := CreateFile(PChar(FileName),
GENERIC_READ,
FILE_SHARE_READ,
nil,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
0);
if hFile = INVALID_HANDLE_VALUE then
Exit;
iByteCount := SizeOf(aByteHash);
// 文件哈希函数计算的
CryptCATAdminCalcHashFromFileHandle(hFile,
@iByteCount,
@aByteHash,
0);
for i := 0 to iByteCount - 1 do
begin
swMemberTag := swMemberTag + IntToHex(aByteHash[i], 2);
end;
CloseHandle(hFile);
// 枚举目录包含一个指定的哈希
hCatalogContext := CryptCATAdminEnumCatalogFromHash(hCatAdminContext,
@aByteHash,
iByteCount,
0,
nil);
// 准备验证参数
// http://msdn.microsoft.com/en-us/library/windows/desktop/aa388205(v=vs.85).aspx
WTrustData.dwUIChoice := WTD_UI_NONE;
WTrustData.fdwRevocationChecks := WTD_REVOKE_NONE;
WTrustData.dwStateAction := WTD_STATEACTION_VERIFY; // 获取信息后需要手动 WTD_STATEACTION_CLOSE
WTrustData.dwProvFlags := WTD_REVOCATION_CHECK_NONE;
if hCatalogContext = 0 then // 未找到包含此文件的安全编目
begin
WTDFileInfo.cbStruct := SizeOf(WTDFileInfo);
WTDFileInfo.pcwszFilePath := PWideChar(swFilename);
WTrustData.cbStruc
补充:软件开发 , Delphi ,