Digital Code Signing Your Script

[ptrex]

@Automania

No idea what is going wrong ?

@IchBistTod

In the first post there is a procedure / link on how to produce your own certificate,

without paying money $$$.

You cannot change an existing certificate !

Rgds

ptrex

[Automania]

Sorry, I should have given you the error message. Unfortunately, the COM error is in German but freely translated it would look like this:

windescription: no provider was set for the memory or the object.

err.number is: 80020009

By the way, is it correct that the following (first) line is equal to "" ?

$oSigner = ""

; Use a valid certificat

Edited March 31, 2010 by Automania

[ptrex]

@Automania

Propably you are missing the scritp object on your machine by the looks of it.

ObjCreate("Scripting.Signer")

rgds,

ptrex

[Automania]

Thanks for the reply. I have now fixed the issue.

For some reason, the line to create the certificate from posting #8 created a file which I couldn't sign with although I installed it (the error mentioned above).

So instead I tried the line from the website you linked in posting #9:

makecert -r -pe -n "CN=Your Name" -b 01/01/2000 -e 01/01/2099 -eku 1.3.6.1.5.5.7.3.3 -ss My

and this works perfectly. Great script! Thanks a lot!

[Nicozanf]

@Ptrex

Hi, the code on the first post has some garbage at the end Could you fix it?

Thanks,

Nico

[ptrex]

@Nicozanf

I am not able to remove it myself for whatever reason ?!

Maybe some site admin can do this.

rgds

ptrex

[Fantastic]

Auto sign your script after compiling.

Add this line AutoIt3Wrapper_GUI directive with first parameter your compiled script name and second parameter your certificate name.

#AutoIt3Wrapper_Run_After=SignMe.exe /"Your compiled script name here" /"Your certificate name here"

Save this as SignMe.au3 and compile it.

It must be at same dir as the compiled exe to be signed.

expandcollapse popup

If $cmdline[0] = 2 Then
    For $i = 1 To $cmdline[0]
        Switch $cmdline[$i]
            Case $cmdline[1]
                $ScripName = StringTrimLeft($cmdline[1], 1)
;~              MsgBox(0, '', $ScripName)
                ConsoleWrite($ScripName & @CRLF)
                If StringRight($ScripName, 4) <> '.exe' Then $ScripName = $ScripName & '.exe'

;~              If FileExists($ScripName) Then
;~                  MsgBox(0, '', $ScripName)
;~                  ConsoleWrite($ScripName & @CRLF)
;~              Else
                If Not FileExists($ScripName) Then
                    MsgBox(0, '', $ScripName & ' does not exist.')
                    Exit 2
                EndIf
            Case $cmdline[2]
                $CertName = StringTrimLeft($cmdline[2], 1)
;~              MsgBox(0, '', $CertName)
                ConsoleWrite($CertName & @CRLF)
        EndSwitch
    Next
Else
    MsgBox(0, '', '2 Params are needed')
    Exit 1
EndIf

; Initialize error handler
$oMyError = ObjEvent("AutoIt.Error", "MyErrFunc")
$Script = @ScriptDir & "\" & $ScripName

; --------------------------------- Sign it ----------------------------------
$oSigner = ObjCreate("Scripting.Signer")
$oSigner.SignFile($Script, $CertName)

$oSigner = ""
; Use a valid certificat
; you can do this by going to a server that has a certificate service running.
; And than export a certificate that is OK for Signing Code.
; Then import this on the client.
;This is custom error handler

Func MyErrFunc()
    $HexNumber = Hex($oMyError.number, 8)
    MsgBox(0, "AutoItCOM Test", "We intercepted a COM Error !" & @CRLF & @CRLF & _
            "err.description is: " & @TAB & $oMyError.description & @CRLF & _
            "err.windescription:" & @TAB & $oMyError.windescription & @CRLF & _
            "err.number is: " & @TAB & $HexNumber & @CRLF & _
            "err.lastdllerror is: " & @TAB & $oMyError.lastdllerror & @CRLF & _
            "err.scriptline is: " & @TAB & $oMyError.scriptline & @CRLF & _
            "err.source is: " & @TAB & $oMyError.source & @CRLF & _
            "err.helpfile is: " & @TAB & $oMyError.helpfile & @CRLF & _
            "err.helpcontext is: " & @TAB & $oMyError.helpcontext _
            )
    SetError(1)
EndFunc   ;==>MyErrFunc

[SL1CeR]

I spent many hours following the instructions in this post to make a certficate, sign my .au3 scripts (via conversion to .exe) and having my computer trusting my newly signed programs.

I noticed that no one here was willing to post all of the nessecary programs. Only 4 of the five programs were posted. We were missing signtool.exe. No one wants to download the microsoft SDK just for signtool.exe. The internet itself doesn't seem to contain signtool.exe, atleast not microsoft's (the one we need) so I have decided to make a KIT which includes all of the files in POST 9 and signtool.exe and it's needed capicom.dll file.

If we follow the instructions in post 9, and we download signGUI and we download signtool.exe and all the programs needed to make a certificate, all we must do is install the PVK and the certifcate after we create it, and sign our .exe

1. DOWNLOAD SIGNGUI

2. DOWNLOAD ALL NECESSARY FILES

3. FOLLOW THESE INSTRUCTIONS to make ur certificate

4. install the .pvk file and the .cer file

5. load signgui and sign your .exe's!

Woot hope this consoldation helps. I ripped signtool.exe from the SDK!

[ACalcutt]

@SL1CeR

Thanks for putting all the files and information in one place...I finally got this to work :-)

[usabrad86]

My code signing script

[Rich78]

I know this post is old but wanted to give back in case someone like me Googles for this type of solution in the future.

The scripting guys did a great piece of signing scripts.  I originally just did it for a powershell script I was working on but after trying to sign my AutoIT script I tried running it against my compiled .exe and it worked flawlessly.  It is very easy to do assuming you have PKI setup in your environment.

http://blogs.technet.com/b/heyscriptingguy/archive/2010/06/17/hey-scripting-guy-how-can-i-sign-windows-powershell-scripts-with-an-enterprise-windows-pki-part-1-of-2.aspx

http://blogs.technet.com/b/heyscriptingguy/archive/2010/06/17/hey-scripting-guy-how-can-i-sign-windows-powershell-scripts-with-an-enterprise-windows-pki-part-2-of-2.aspx

After you have requested the certificate as documented, you simply need to run 2 powershell commands to sign your code.

$cert=(dir cert:currentuser\my\ -CodeSigningCert)
Set-AuthenticodeSignature c:\temp\myfile.exe $cert -TimeStampServer http://timestamp.comodoca.com/authenticode

 

[argumentum]

maybe what you are looking for is at "Sign your exe with a Digital Signature / Signtool.exe"

[mLipok]

I re-write an example which is located here: