Signature verification

You can find how to call Windows APIs to verify that a program is signed in Microsoft’s public document, Example C Program: Verifying the Signature of a PE File (docs.microsoft.com/en-us/windows/win32/seccrypto/example-c-program--verifying-the-signature-of-a-pe-file). This document provides the complete C/C++ source code, showing how to call the Windows API to verify the validity of a digital signature.

The following example is the winTrust project in the Chapter#9 folder of the GitHub project. In order to save space, this book only extracts the highlighted code; the complete source code should be referred to in the complete project for detailed reading.

Figure 9.2 shows the main entry section. In Figure 9.2, the main entry is quite compact, with a VerifyEmbeddedSignature function that is designed to read in a specified program to verify the validity of the digital signature and prints out the result on the screen:

Figure...