Signing executable files programatically

5 Dec 2006 2:31 PM

Miles

Hi, I am struggling to work out how to digitally sign exe files using .Net
2.0. This must be programmatic, not the manual way and will be built in to
an existing .Net application. I am trying to use
System.Security.Cryptography.Pkcs and was thinking the code below should do
it, but the resulting file can't be run and is a few KB larger than the
original. I created the .pfx file from .spc and .pvk using pvk2pfx.
Can anyone show me the way?
Many thanks, Miles.

Imports System.IO
Imports System.Security.Cryptography.Pkcs

Public Class Form

    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As
System.EventArgs) Handles Button1.Click

        Dim binReader As New BinaryReader(File.Open("c:\files\setup.exe",
FileMode.Open))
        Dim binWriter As New
BinaryWriter(File.Open("c:\files\signed\setup.exe", FileMode.Create))

        Dim bSigned() As Byte
        Dim bUnsigned(binReader.BaseStream.Length) As Byte
        Dim iBytesRead As Integer = binReader.Read(bUnsigned, 0,
bUnsigned.Length - 1)

        Dim cert As New
System.Security.Cryptography.X509Certificates.X509Certificate2("c:\files\mypfxfile.pfx", "mypassword")
        Dim cont As New ContentInfo(bUnsigned)

        Dim signed As New SignedCms(cont)
        Dim signer As New CmsSigner(cert)

        signed.ComputeSignature(signer)
        bSigned = signed.Encode

        binWriter.Write(bSigned)
        binWriter.Close()
        binReader.Close()

    End Sub

End Class

11 Dec 2006 12:48 AM

Alvin Bruney [MVP]

Out of curiosity, why is this a requirement? Best practices dictate that,
prior to signing code, the code should be reviewed since digital signatures
impose an implicit guarantee on the body of code.

--
Regards,
Alvin Bruney
------------------------------------------------------
Shameless author plug
Excel Services for .NET is coming...
OWC Black book on Amazon and
www.lulu.com/owc

Show quote

"Miles" <Mi***@discussions.microsoft.com> wrote in message
news:0DC490B1-8436-4B02-856E-5AB9FBE0C226@microsoft.com...
> Hi, I am struggling to work out how to digitally sign exe files using
> .Net
> 2.0. This must be programmatic, not the manual way and will be built in
> to
> an existing .Net application. I am trying to use
> System.Security.Cryptography.Pkcs and was thinking the code below should
> do
> it, but the resulting file can't be run and is a few KB larger than the
> original. I created the .pfx file from .spc and .pvk using pvk2pfx.
> Can anyone show me the way?
> Many thanks, Miles.
>
> Imports System.IO
> Imports System.Security.Cryptography.Pkcs
>
> Public Class Form
>
>    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As
> System.EventArgs) Handles Button1.Click
>
>        Dim binReader As New BinaryReader(File.Open("c:\files\setup.exe",
> FileMode.Open))
>        Dim binWriter As New
> BinaryWriter(File.Open("c:\files\signed\setup.exe", FileMode.Create))
>
>        Dim bSigned() As Byte
>        Dim bUnsigned(binReader.BaseStream.Length) As Byte
>        Dim iBytesRead As Integer = binReader.Read(bUnsigned, 0,
> bUnsigned.Length - 1)
>
>        Dim cert As New
> System.Security.Cryptography.X509Certificates.X509Certificate2("c:\files\mypfxfile.pfx",
> "mypassword")
>        Dim cont As New ContentInfo(bUnsigned)
>
>        Dim signed As New SignedCms(cont)
>        Dim signer As New CmsSigner(cert)
>
>        signed.ComputeSignature(signer)
>        bSigned = signed.Encode
>
>        binWriter.Write(bSigned)
>        binWriter.Close()
>        binReader.Close()
>
>    End Sub
>
> End Class

11 Dec 2006 12:21 PM

Miles

Hi Alvin,

This would be for internal use only by a small number of trusted
individuals. We want to produce setup.exe files programmatically, that our
staff can download and run which unzips some files onto their PC's. We used
to create and sign the setup.exe's manually (installshield), but the volume
is increasing. It all works fine except for the security warning and we
cannot change the users PC config as they are in different territories.

Thanks,
Miles.

Show quote

"Alvin Bruney [MVP]" wrote:

> Out of curiosity, why is this a requirement? Best practices dictate that,
> prior to signing code, the code should be reviewed since digital signatures
> impose an implicit guarantee on the body of code.
>
> --
> Regards,
> Alvin Bruney
> ------------------------------------------------------
> Shameless author plug
> Excel Services for .NET is coming...
> OWC Black book on Amazon and
> www.lulu.com/owc
>
> "Miles" <Mi***@discussions.microsoft.com> wrote in message
> news:0DC490B1-8436-4B02-856E-5AB9FBE0C226@microsoft.com...
> > Hi, I am struggling to work out how to digitally sign exe files using
> > .Net
> > 2.0. This must be programmatic, not the manual way and will be built in
> > to
> > an existing .Net application. I am trying to use
> > System.Security.Cryptography.Pkcs and was thinking the code below should
> > do
> > it, but the resulting file can't be run and is a few KB larger than the
> > original. I created the .pfx file from .spc and .pvk using pvk2pfx.
> > Can anyone show me the way?
> > Many thanks, Miles.
> >
> > Imports System.IO
> > Imports System.Security.Cryptography.Pkcs
> >
> > Public Class Form
> >
> >    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As
> > System.EventArgs) Handles Button1.Click
> >
> >        Dim binReader As New BinaryReader(File.Open("c:\files\setup.exe",
> > FileMode.Open))
> >        Dim binWriter As New
> > BinaryWriter(File.Open("c:\files\signed\setup.exe", FileMode.Create))
> >
> >        Dim bSigned() As Byte
> >        Dim bUnsigned(binReader.BaseStream.Length) As Byte
> >        Dim iBytesRead As Integer = binReader.Read(bUnsigned, 0,
> > bUnsigned.Length - 1)
> >
> >        Dim cert As New
> > System.Security.Cryptography.X509Certificates.X509Certificate2("c:\files\mypfxfile.pfx",
> > "mypassword")
> >        Dim cont As New ContentInfo(bUnsigned)
> >
> >        Dim signed As New SignedCms(cont)
> >        Dim signer As New CmsSigner(cert)
> >
> >        signed.ComputeSignature(signer)
> >        bSigned = signed.Encode
> >
> >        binWriter.Write(bSigned)
> >        binWriter.Close()
> >        binReader.Close()
> >
> >    End Sub
> >
> > End Class
>
>
>