When I open up my macro-enabled office files (i.e., .docm, .xlsm, .pptm) that contain signed macros as a Zip file, I see the following three files which I assume contain the digital signatures for the macro:
Each file contains binary data, although I can see elements of the signing certificate in human readable format. I tried to parse each file out by treating it as a CMS (or PKCS#7) file but that didn't work. Perhaps it is a CMSSignedData structure but with some additional header and/or footer data that needs to be stripped off?
What I would like to know is how to parse out the raw signature value. If I can get it in a format like CMSSignedData that works too, since I can easily parse the signature from there.