1

Is there anywhere I can download a list of checksums for microsoft-published OS executable files, preferably grouped by release name?

I could do the same by decompressing files on a windows setup CD, and checksumming them, and then doing the same thing to all installed updates via WSUS and some scripting, but this seems like a lot of work. There must be an easier way!

Do Microsoft release such a list?

As an additional, related, question - why do MS sign so few of their executables? Obviously the PE loader only verifies signatures when things are loaded in to kernel mode, but is there any reason why MS don't simply sign all executables? It'd sure make verification a lot easier.

7
  • What evidence do you have that they don't sign executables?
    – Steve
    May 22, 2014 at 16:24
  • Checksums would become stale once they were patched. Different patch levels would result in different checksums.
    – schroeder
    May 22, 2014 at 22:48
  • @Steve - I mean the windows PE signatures that the kernel uses to load modules. I know they aren't present in that format because I can't verify them.
    – randomdude
    May 23, 2014 at 4:06
  • @schroeder - Yes, checksums would need to be supplied for updates also.
    – randomdude
    May 23, 2014 at 4:36
  • You don't understand. Updates don't always simply replace the original files. Sometimes they modify them. You can't predict what the checksums would look like with different patch levels. That's why 'running checksums' isn't used. There can be no such stable list of checksums.
    – schroeder
    May 23, 2014 at 17:44

3 Answers 3

3

The US National Software Reference Library (NSRL) keeps a list of checksums for valid OS files, including all known patched variants:

https://www.nist.gov/itl/ssd/software-quality-group/national-software-reference-library-nsrl

And this site purports to be a lookup for it (but I'm not sure how accurate or current it is):

http://nsrl.hashsets.com/national_software_reference_library1_search.php

CIRCL also has a lookup API:

https://hashlookup.circl.lu/

2

I'm not sure if this exactly solves your problem, but it sounds like you're looking for .CAT ("Security Catalog") files? .CAT files are a binary format roughly analogous to an X.509 certificate, except instead of a "subject" they have a list of hash digests. Those digests are the cryptographic "thumbprints" of files, which thus do not need to directly bear a signature (and often can't, because they're a file format that doesn't have a location for one). The other parts of the catalog are very similar to those of a cert: there's metadata about the catalog (including a validity date and some identifying info), and there's an issuer signature (signed by a Microsoft signing key, in this case).

You can think of security catalogs as a self-verifying collection of detached signatures, except of course there's no need to actually sign every file (just hash it) because you can't modify the contents of the catalog without invalidating its own signature. Windows has tools to work with security catalogs, including a built-in viewer program and a tool to create them that is distributed with the Windows SDK. The components of Windows that implement signature validation (even if they don't necessarily enforce it) can use a security catalog in lieu of an attached signature.

Somewhat inconveniently, I don't know of either a way to tell, from a given file, where its associated security catalog might be (other than "try the same folder, or any subfolder called "catalogs", or lacking that any .CAT file in the same branch of the folder hierarchy"). Nor do I know of tools to parse security catalogs directly, though I wouldn't be at all surprised if they're ASN.1 encoded as CER or DER, just like most certificate files. There is at least some support for security catalogs in PowerShell, which implies you might be able to script the operation "[obtain] a list of checksums of Microsoft-published OS files" without needing third-party tools. Note that you'll possibly need to check a lot of them - there are over 6000 .CAT files under my \Windows directory alone - though I think a lot of those are for updates, legacy versions of various libraries, and in-box drivers that I have perhaps never used.


Incidentally, the existence of security catalogs probably addresses your surprise at so many Windows files being (seemingly) unsigned. Rather than having attached signatures - which are possible for PE-format binaries but not always ideal, and not possible for many other file formats - a single signed file stores the hashes for a large list of files (of arbitrary format), effectively signing every one. It's just not obvious that this is done, or where to find that file.

1

Some software on MSDN has hashes published but I can't find a way to get a decent list.

They don't appear to publish hashes in the download centre either.

As I understood it though, any software issued through Windows Update should be signed and certainly all 64bit Windows software should be signed.

Can't really think of a reason they don't sign everything other than the overheads of maintaining signing keys for such a large set of software. You certainly would have expected their build process to automatically sign any release software.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .