Windows sysinternals

TABLE 8-1 SigCheck Command-Line Parameters
Chapter 8 Security Utilities 263
Parameter
target
Signature Verification
Description
Specifies the file or directory to process. It can include wildcard characters.
–i Shows the catalog name and image signers.
–r Checks for certificate revocation.
–u Reports unsigned files only, including files that have invalid signatures.
–c Looks for a signature in the specified catalog file.
Which Files to Scan
–e Scans executable files only. (It looks at the file headers, not the extension, to
determine whether a file is an executable.)
–s Recurses subdirectories.
Additional File Information
–a Shows extended version information.
–h Shows file hashes.
–m Shows the manifest.
–n Shows the file version number only.
Output Format
–v CSV output (not compatible with –i or –m).
–q Quiet (suppresses the banner).
The target parameter is the only required one. It can specify a single file, such as explorer.
exe; it can specify multiple files using a wildcard, such as *.dll; or it can specify a folder, using
relative or absolute paths. If you specify a folder, SigCheck scans every file in the folder. The
following command scans every file in the current folder:
sigcheck .
Signature Verification
Without further parameters, SigCheck reports the following for each file scanned:
■ Verified If the file has been signed with a code-signing certificate that derives from a
root certification authority that is trusted on the current computer, and the file has not
been modified since its signing, this field reports Signed. If it has not been signed, this
field reports Unsigned. If it has been signed but there are problems with the signature,
those problems are noted. Problems can include the following: the signing certificate
was outside its validity period at the time of the signing; the root authority is not
trusted (which can happen with a self-signed certificate, for example); the file has been
modified since signing.
www.it-ebooks.info