have fun with it

Kerlingen · #2 02-28-2018, 20:04

This is a code signing certificate, no kernel mode signing certificate.

Code:

signtool sign /ac thawte.cer /ph /fd SHA256 /v /tr http://sha256timestamp.ws.symantec.com/sha256/timestamp driver.sys
The following certificate was selected:
    Issued to: YD Online Corp.
    Issued by: thawte SHA256 Code Signing CA
    Expires:   Tue May 15 00:59:59 2018
    SHA1 hash: C17761DD3B2FCCB2AF39A7A6D888AE6E646637F1

Cross certificate chain (using machine store):
    Issued to: Microsoft Code Verification Root
    Issued by: Microsoft Code Verification Root
    Expires:   Sat Nov 01 14:54:03 2025
    SHA1 hash: 8FBE4D070EF8AB1BCCAF2A9D5CCAE7282A2C66B3

        Issued to: thawte Primary Root CA
        Issued by: Microsoft Code Verification Root
        Expires:   Mon Feb 22 20:41:57 2021
        SHA1 hash: 5538E9FEC14030B740152349E115A1165D29074A

            Issued to: thawte SHA256 Code Signing CA
            Issued by: thawte Primary Root CA
            Expires:   Sun Dec 10 00:59:59 2023
            SHA1 hash: D00CFDBF46C98A838BC10DC4E097AE0152C461BC

                Issued to: YD Online Corp.
                Issued by: thawte SHA256 Code Signing CA
                Expires:   Tue May 15 00:59:59 2018
                SHA1 hash: C17761DD3B2FCCB2AF39A7A6D888AE6E646637F1

Done Adding Additional Store
Successfully signed: driver.sys

Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0

Normal:

Code:

signtool verify driver.sys
Successfully verified: driver.sys

Authenticode:

Code:

signtool verify /pa driver.sys
Successfully verified: driver.sys

Kernel-mode:

Code:

signtool verify /kp driver.sys
SignTool Error: The signing certificate is not valid for the requested usage.

Test:

Code:

net start driver
System error 577 has occurred.
Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

The Following User Says Thank You to Kerlingen For This Useful Post:
vic4key (03-04-2018)