2 ms·
A catalog file (.cat) has a bunch of file hashes (think file identities) in it. Signing that means indirectly signing all of those files. Signature validation
by drewcoo 5y ago
A catalog file (.cat) has a bunch of file hashes (think file identities) in it. Signing that means indirectly signing all of those files.
Signature validation means checking an embedded signature if it exists, then looking for the hash in the installed .cat files and, if found, checking that signature.
Authenticode signatures like this are PKI-based. They can be revoked if determined not to be valid later.
- dogma1138 5y agoI think the issue with the Win10 model is that the signature on any PE files is independent so one can use it for some bypass outside of the process of installing a driver. That said WHQL/WHLK signatures aren’t useful for bypassing things like smartscreen and do require an additional EV code signing cert to identify the publisher for that. Which again at large scale isn’t probably hard to get.