파일시스템-장치드라이버 디지털서명 검사

장치드라이버 디지털서명 검사

 

sigverif

결과

서명안된 파일들의 hash값을 구하거나 파일명으로 VirusTotal등에서 악성코드 여부를 조회

 

driverquery

/si : Displays digital signature information for both signed and unsigned device drivers.
F:\temp>driverquery.exe /SI

powershell

F:\temp>powershell
PS F:\temp> Get-WmiObject -class win32_systemdriver | select InstallDate, pathname,  DisplayName

PS F:\temp> Get-WmiObject -class win32_systemdriver |  foreach-object { get-authenticodesignature $_.pathname }

WMI win32_systemdriver
F:\temp>wmic path win32_systemdriver get caption, pathname, installdate /format:table

signtool

SignTool is a command-line CryptoAPI tool that digitally-signs files, verifies signatures in files, and time stamps files.

F:\temp>F:\tool\OS\SignTool\signtool64.exe verify /pa C:\Windows\SysWOW64\vulkaninfo.exe
File: C:\Windows\SysWOW64\vulkaninfo.exe
Index  Algorithm  Timestamp
========================================
0      sha256     RFC3161
Successfully verified: C:\Windows\SysWOW64\vulkaninfo.exe

 

driversignature.bat

@echo off
if Exist driverquery_list.txt del driverquery_list.txt
wmic path win32_systemdriver get pathname > driverquery_list.txt
for /f "tokens=*" %%a in ('type driverquery_list.txt') do (
rem echo %%a
F:\tool\OS\SignTool\signtool64.exe verify /pa %%a
)
if Exist driverquery_list.txt del driverquery_list.txt

 

F:\temp>driversignature.bat

Successfully verified: C:\WINDOWS\system32\drivers\3ware.sys
File: C:\WINDOWS\system32\drivers\acpi.sys
Index  Algorithm  Timestamp
========================================
0      sha256     RFC3161

Successfully verified: C:\WINDOWS\system32\drivers\acpi.sys
File: C:\WINDOWS\system32\drivers\AcpiDev.sys
Index  Algorithm  Timestamp
========================================
SignTool Error: No signature found.

......

 

sigcheck

특정파일에 코드사인이 되어있는지 유무 판별을 해주는 유틸

F:\temp>F:\tool\OS\Sigcheck\sigcheck64.exe -i C:\Windows\SysWOW64\vulkaninfo.exe
c:\windows\syswow64\vulkaninfo.exe:
        Verified:       Signed
......

(이하 디지털서명 상세 정보 확인)

 

<참고>

sigcheck, signtool 등 MicroSoft Sysinternal 에 포함된 tool은 상업적 목적이나 용도로 사용되어서는 안된다.