CodeSigning results in 'Code Integrity completed validating page hashes. Status 0xc0000428.'

1

I have been attemping to code sign a dll using a code signing certiticate I have purchased from Comodo. The intention for the signing is to be verifiable via the kernel signing policy. However, in the the EventLog explaining that there are CodeIntegrity errors relating to per-page image hashes not being able to be found.

Below is a summary I what I am doing, if you could please provide advice on where I have gone wrong, or where to look next that would be greatly appreciated.

I have signed a previously signed dll for the sake of testing using the following commands, the result is the same if I used a newly built dll.

    "C:\WinDDK\7600.16385.1\bin\amd64\SignTool.exe" sign /v /ph /ac "addtrustexternalcaroot_kmod.crt" /f css-certificate.pfx /p <password> /t http://timestamp.verisign.com/scripts/timstamp.dll VBoxVRDP.dll

The output is as follows

    The following certificate was selected:
        Issued to: S4 Technology
        Issued by: COMODO RSA Code Signing CA
        Expires:   Wed Nov 11 15:59:59 2015
        SHA1 hash: 0161DC2D8757B886E626B25B1770C72B789BAF02
    Cross certificate chain (using machine store):
        Issued to: Microsoft Code Verification Root
        Issued by: Microsoft Code Verification Root
        Expires:   Sat Nov 01 05:54:03 2025
        SHA1 hash: 8FBE4D070EF8AB1BCCAF2A9D5CCAE7282A2C66B3
            Issued to: AddTrust External CA Root
            Issued by: Microsoft Code Verification Root
            Expires:   Tue Aug 15 12:36:30 2023
            SHA1 hash: A75AC657AA7A4CDFE5F9DE393E69EFCAB659D250
                Issued to: COMODO RSA Certification Authority
                Issued by: AddTrust External CA Root
                Expires:   Sat May 30 02:48:38 2020
                SHA1 hash: F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0
                    Issued to: COMODO RSA Code Signing CA
                    Issued by: COMODO RSA Certification Authority
                    Expires:   Mon May 08 15:59:59 2028
                    SHA1 hash: B69E752BBE88B4458200A7C0F4F5B3CCE6F35B47
                        Issued to: S4 Technology
                        Issued by: COMODO RSA Code Signing CA
                        Expires:   Wed Nov 11 15:59:59 2015
                        SHA1 hash: 0161DC2D8757B886E626B25B1770C72B789BAF02
    Done Adding Additional Store
    Successfully signed and timestamped: VBoxVRDP.dll
    Number of files successfully Signed: 1
    Number of warnings: 0
    Number of errors: 0

I now validate the signing using the following command

    "C:\WinDDK\7600.16385.1\bin\amd64\SignTool.exe" verify /v /ph /kp VBoxVRDP.dll 

The output is as follows

    Verifying: VBoxVRDP.dll
    Hash of file (sha1): 41909BD87A05CF3E61BBEF7B9DD4C4A8B6E4B2A1
    Signing Certificate Chain:
        Issued to: AddTrust External CA Root
        Issued by: AddTrust External CA Root
        Expires:   Sat May 30 02:48:38 2020
        SHA1 hash: 02FAF3E291435468607857694DF5E45B68851868
            Issued to: COMODO RSA Certification Authority
            Issued by: AddTrust External CA Root
            Expires:   Sat May 30 02:48:38 2020
            SHA1 hash: F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0
                Issued to: COMODO RSA Code Signing CA
                Issued by: COMODO RSA Certification Authority
                Expires:   Mon May 08 15:59:59 2028
                SHA1 hash: B69E752BBE88B4458200A7C0F4F5B3CCE6F35B47
                    Issued to: S4 Technology
                    Issued by: COMODO RSA Code Signing CA
                    Expires:   Wed Nov 11 15:59:59 2015
                    SHA1 hash: 0161DC2D8757B886E626B25B1770C72B789BAF02
    The signature is timestamped: Mon Dec 15 10:05:37 2014
    Timestamp Verified by:
        Issued to: Thawte Timestamping CA
        Issued by: Thawte Timestamping CA
        Expires:   Thu Dec 31 15:59:59 2020
        SHA1 hash: BE36A4562FB2EE05DBB3D32323ADF445084ED656
            Issued to: Symantec Time Stamping Services CA - G2
            Issued by: Thawte Timestamping CA
            Expires:   Wed Dec 30 15:59:59 2020
            SHA1 hash: 6C07453FFDDA08B83707C09B82FB3D15F35336B1
                Issued to: Symantec Time Stamping Services Signer - G4
                Issued by: Symantec Time Stamping Services CA - G2
                Expires:   Tue Dec 29 15:59:59 2020
                SHA1 hash: 65439929B67973EB192D6FF243E6767ADF0834E4
    Cross Certificate Chain:
        Issued to: Microsoft Code Verification Root
        Issued by: Microsoft Code Verification Root
        Expires:   Sat Nov 01 05:54:03 2025
        SHA1 hash: 8FBE4D070EF8AB1BCCAF2A9D5CCAE7282A2C66B3
            Issued to: AddTrust External CA Root
            Issued by: Microsoft Code Verification Root
            Expires:   Tue Aug 15 12:36:30 2023
            SHA1 hash: A75AC657AA7A4CDFE5F9DE393E69EFCAB659D250
                Issued to: COMODO RSA Certification Authority
                Issued by: AddTrust External CA Root
                Expires:   Sat May 30 02:48:38 2020
                SHA1 hash: F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0
                    Issued to: COMODO RSA Code Signing CA
                    Issued by: COMODO RSA Certification Authority
                    Expires:   Mon May 08 15:59:59 2028
                    SHA1 hash: B69E752BBE88B4458200A7C0F4F5B3CCE6F35B47
                        Issued to: S4 Technology
                        Issued by: COMODO RSA Code Signing CA
                        Expires:   Wed Nov 11 15:59:59 2015
                        SHA1 hash: 0161DC2D8757B886E626B25B1770C72B789BAF02
    Embedded page hashes:
    0x00000000 7B54C3ABC3FC7DA85CB40074D653DFB36DF8E0F9
    <...>
    0x00071a00 0000000000000000000000000000000000000000
    Successfully verified: VBoxVRDP.dll
    Number of files successfully Verified: 1
    Number of warnings: 0
    Number of errors: 0

So it all looks good, however, I have noted when looking at the properties of dll via Explorer, but I end up with a CodeIntegrity errors in the EventLog.

    Code Integrity is unable to verify the image integrity of the file <...>\VBoxVRDP.dll because the set of per-page image hashes could not be found on the system.

When I look at the Verbose logs of CodeIntegrity I see the following Verbose events

    Code Integrity started validating page hashes of <...>\VBoxVRDP.dll file.

    Code Integrity completed validating page hashes. Status 0xc0000428.

From what I can tell 0xc0000428 is Windows cannot verify the digital signature of this file, which seems to imply I am missing something somewhere, but I for the life of me cannot figure out exactly what it is I need to do.

dll
code-signing
asked on Stack Overflow Dec 15, 2014 by user3159484 • edited Dec 16, 2014 by user3159484

1 Answer

0

Windows support for SHA2 on Win 7 seems to be problematic at present. https://technet.microsoft.com/en-us/library/security/2949927.aspx There is a fix but note "Revision V2.0 (October 17, 2014): Removed Download Center links for Microsoft security update 2949927. Microsoft recommends that customers experiencing issues uninstall this update. Microsoft is investigating behavior associated with this update, and will update the advisory when more information becomes available."

answered on Stack Overflow Dec 16, 2014 by Terry

User contributions licensed under CC BY-SA 3.0