What is the safest way to verify loaded DLLs have valid certificates?

Question

I have a binary 'api.dll' which uses another binary 'helper.dll'. I want to validate the authenticity of each DLL using digital signatures, but I'm not sure the correct way to go about it. For context, the DLLs are being built using visual studio 2010, and are linked via the dependencies tab. The linkage occurs via a stub helper.lib, so I don't explicitly call LoadLibrary in the api.dll code. Part of the problem with this is I don't know exactly where helper.dll is loaded from. My initial thought is to:

1. Get handle to current process
2. Enum all loaded modules
3. Find the one(s) named 'helper.dll' (if this info is available via the enum modules apis), and validate it's signature using something like this

Is this the best way to go about this?

Second, based on my somewhat hazy understanding of digital signatures/certificates, it seems to me the validation requires a connection to the certificate authority, or the certificate needs to be already listed as trusted on the machine. How is this usually handled when outside connections are either frowned upon or explicitly disallowed? Would it be something that is 'installed' with the application? Or would another less-secure method of validation be required in such cases?

Answer 1

You want to verify signatures before you've loaded the DLLs. Once they are loaded, they have already had time to run arbitrary code in your process (see DllMain), and you've lost.

You might want to delay-load the DLLs. This way, you don't need to manually do LoadLibrary/GetProcAddress for every function, but you still get a chance to run some code before the DLLs are loaded, and bail out if verification fails.

No, WinVerifyTrust doesn't need a live Internet connection. Every Windows machine has a list of trusted root certificates. What verification does is it extracts the signature and the certificates attached to the binary, verifies that the signature is valid (the file contents actually match what was signed), and that the certificates form a valid chain that leads to one of the trusted roots.

Note that WinVerifyTrust doesn't verify that the file is signed by your company - just that it is signed by someone who bought a certificate from one of the known CAs, and has not been tampered with afterwards. If you want to confirm that the file is actually yours, additional steps need to be taken.