SignTool: can't sign XLSM (DOCM)

Question

I have a litte problem with Microsoft SignTool.exe. I have installed Windows 10 SDKs and Office SIPs to support macro enabled documents. Then I followed readme to activate dlls and made all the changes, including:

1. Installed - Microsoft Visual C++ Runtime Libraries
2. Set path to VBE7.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA]
"Vbe71DllPath"="C:\Workspace\Signing\vbe7.dll"

3. Registered MSOSIPX.DLL with REGSVR32
4. I have also created wintrust.dll.ini and added:
   

[1]
DLL=<C:\Workspace\Signing\msosipx.dll>
GUID={6E64D5BD-CEB0-4B66-B4A0-15AC71775C48}
CryptSIPDllCreateIndirectData=_VBASipCreateIndirectData@12
CryptSIPDllGetSignedDataMsg=_VBASipGetSignedDataMsg@20
CryptSIPDllIsMyFileType2=_VBASipIsMyTypeOfFileName@8
CryptSIPDllPutSignedDataMsg=_VBASipPutSignedDataMsg@20
CryptSIPDllRemoveSignedDataMsg=_VBASipRemoveSignedDataMsg@8
CryptSIPDllVerifyIndirectData=_VBASipVerifyIndirectData@8

5. I'm using:

   signtool sign /debug /n "Cert" /fd SHA256 test.xlsm and the following happens:

SignTool Error: This file format cannot be signed because it is not recognized.
SignTool Error: An error occurred while attempting to sign: test.xlsm
Number of files successfully Signed: 0
Number of warnings: 0
Number of errors: 1

---

Little note at the end:

With test.exe it worked just fine.

Answer 1

I understand this has been answered, but adding my input for anyone else coming across this.

I don't think you don't need the angle brackets for the path to the SIP module. As per Wikipedia the syntax is key = value. So I would use:

[1]
DLL=C:\Workspace\Signing\msosipx.dll

Also make sure you are using the 32-bit version of signtool from "C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86". Using the 64-bit version I received the same error as you. But following the examples in the bundled offsign.bat and using the right version made it work.

Answer 2

I have solved the problem by using regsvr32.exe via powershell instead of cmd.

Important note! I'm calling regsvr32.exe on msosipx.dll in my working folder C:\Workspace\Signing.

P.S. I don't really understand why it's working.