[Q] Self-signed certificate on Android 4.4.4 / Cyanogenmod 11 - Android Q&A, Help & Troubleshooting

Hi,
I'm trying to install a self-signed user certificate on Cyanogenmod 11 with Android 4.4.4. I know that there are some issues with this, but in many reports they say, it is easy to install when i take it directly from the SD card. Unfortunately, it is not working on my device and I'm not sure if my OS or my certificate is the problem.
I have tried several things, from using the PEM format or DER format, and also tried to use a signed certificate from CAcert.org. Btw, concering the root certificates: I was able to install them as user-certificates and they're shown up on the right place. However, I got the annoy security warning, but I can deal with it.
So let's start with the procedure to create my certificate:
1. I installed the root and the class3 certificate vom cacert.org. Everything is nice, the certificates are listed in user certificates.
2. Key generation:
Code:
openssl genrsa -des3 -out server.key 4096
3. CSR creation, using for both, self-signing and cacert signing
Code:
openssl req -new -key server.key -out server.csr
4.a Create self-signed certificate by myself:
Code:
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
4.b Put server.csr on cacert.org, create certificate, save it in "server_cacert.crt"
5. Converting to binary format:
Code:
openssl x509 -in server.crt -outform DER -out server_der.crt
With this, my certificate creation is finished. Now I put all four different versions on the internal storage on my smartphone. I go to the security settings -> "Install from internal storage" -> choosing one of the certificates.
I'm then asked for a name fort the cert, choosing "usage for vpn and apps", and -> "Save". A popup with "Cert ... successfully installed" afterwards.
But: When i have a look a the user certification list, none of the created certificates is working. I only got the cacert root certs installed.
I have no idea what to do now. One solution which was discussed, was to install the certs as system certificate. But for this, I need to root my smartphone and this is one thing I don't want to do.
So, hopefully you can find the fault in my procedure, so I can get it installed without root privileges.
Thank you for your support,
Kind regards,
-Cyanide-

Sorry for pushing this thread... but I really have no idea what to do? I guess, I'm not the first person who tries to install a certificate, so hopefully you can share your experience?
In my opinion, the fault may be in the certificate creation, because I'm able to install the root certificates from cacert.org..
thanks again

I would also like to know

Short update:
It is working now. But I'm not sure, if it's good the way I did it.
I used easy-rsa to create a ca.crt. I was able to import this one to Android, like it was working before with cacert root certificates. On the server side, I use the crt and key also for my DAV server. With this combination, everything is fine, but I'm not sure if this is the right way, how the certificates should be used.

Related

[How-to] Set up EAP-TLS or other advanced Wifi connections on NT (root only!)

Hello all,
I figured this tutorial may come in handy to a few people out there since the documentation for getting this to work is quite atrocious.
What this tutorial is:
A step-by-step walkthrough of setting up wpa_supplicant.conf to access advanced networking protocols that we otherwise don't have access to (note, this will ONLY work with root at the moment).
What this tutorial is not:
A wireless troubleshooting thread for any wireless issues not related to wpa_supplicant, EAP-TLS, EAP-TTLS, etc.
Thanks ahead of time.
NOTE: This tutorial will be giving instructions for a Windows 7 machine, but 90% of the code I provide can easily be copied over to Linux/BSD/OSX, just replace with the Bash equivalents.
To begin, you will need a few things:
--ADB, with working drivers, though you don't NEED root access through it it is nice to have, since it cuts the typing in half, and the setup for that can be found here: [App]: ADB Root Hijack [ADB Runs as Root now]
--openSSL, for converting certificates to the proper formats.
Windows instructions: Requires Cygwin, see this link here. This will install several other useful tools, and you'll love Cygwin if you're a power user
Linux/BSD/OSX instructions: install using your favorite repositories or from binaries (in the case of OSX). For Ubuntu/Debian: sudo apt-get install openssl
--You will need access to the Development menu (use an app or the Any Cut app to make a shortcut), as well as Root Browser lite (or Root Explorer).
--Alot of patience, and a bit of time. This should be straightforward, but don't expect a perfect solution for everyone.
1) The most important step, since this will cause you no end of headaches for possibly an hour or two as you trace it down: Go into the Development menu, UNCHECK USB Debugging and RECHECK it, then UNCHECK Auto Mount. So, even if debugging is checked, uncheck and check it anyway. And make SURE Auto Mount is unchecked, otherwise this will automatically install the "normal" NT drivers and screw up the entire process.
2) Plug in the Nook, and bring up the command line (cmd.exe). Run:
Code:
adb devices
If this returns an alphanumeric string (or anything), your device is in and you're good to go. Otherwise, check the other forum topics for troubleshooting (link to come).
3) To begin, we need to convert our tickets to the correct format. For this we will use OpenSSL. To make this easy, I piled all of my working space into a folder in the root of the C: drive, called "certs". For this example, I will assume that you were given a root certificate named rootCA.crt and a private certificate names [email protected].p12 (because I was, for the eduroam worldwide network).
This example also assumes EAP-TLS authentication. To convert the files:
Code:
openssl x509 -in rootCA.crt -out rootCA.der -outform DER
openssl x509 -in rootCA.der -inform DER -out rootCA.pem -outform PEM
then
openssl pkcs12 -in [email protected] -out cert.pem -clcerts -nokeys
openssl pkcs12 -in [email protected] -out key.pem -nocerts
Note: even if your business/Uni doesn't use a separate hashed key normally (For example, the University of Alaska system), you will need it here. Normally a certificate app handles all of this (on AOSP and custom builds).
4) Thanks to good ol' FSTAB, we will have to remount /system so we can read/write to it:
Code:
adb shell
su
mount -o remount,rw /system /system
5) Now, we have three new files: rootCA.pem, cert.pem and key.pem in the C:\certs folder. We push them to their proper directory on the NT:
Code:
adb push rootCA.pem /system/etc/wifi/
adb push cert.pem /system/etc/wifi/
adb push key.pem /system/etc/wifi/
Note: This is where it gets tricky without root ADB access...the option is to push them to "/media/My Files/My Downloads/" (including quotes) and then use a terminal or root browser to move them to /system/etc/wifi/
6) Next, we get to pull wpa_supplicant finally!
Code:
adb pull /system/etc/wifi/wpa_supplicant.conf .
Note: Make sure to include the . at the end, this means 'copy it to the current directory'
7) Open wpa_supplicant.conf in Wordpad (NOT notepad, wrapping issues), and build a profile based on the examples located here.
Here is an edited version of mine, if you use EAP-TLS this will work for you:
Code:
network={
ssid="YourAPNameHere"
scan_ssid=1
key_mgmt=WPA-EAP
pairwise=CCMP TKIP
group=CCMP TKIP
eap=TLS
identity="[email protected]"
ca_cert="/system/etc/wifi/rootCA.pem"
client_cert="/system/etc/wifi/cert.pem"
private_key="/system/etc/wifi/key.pem"
private_key_passwd="yourPassHere"
priority=20
}
Change ssid, identity, and private_key_passwd to your respective information.
NOTE: priority, near the bottom, determines when it will connect to the network when others are around. Compare it to the values of the priority's set in /data/misc/wifi/wpa_supplicant.conf, the higher the value the higher the priority when they're all within range.
Now save and close the file.
8) Now, we push and reboot:
Code:
adb push wpa_supplicant.conf /system/etc/wifi/
then reboot the nook.
Now, after reboot, it should be good to go!
Notice, one bit of trouble I ran into, if you just get "error" when turning on the wireless after reboot, double-check that your certificates are correct and in the correct places, and wpa_supplicant.conf points at them. If thats fine, try erasing /data/misc/wifi/wpa_supplicant.conf, then reboot, and the list will be rebuilt and your AP will automatically connect.
Please let me know if there are any issues with the instructions, it's 6am and I haven't slept more than 8 hours in the last 3 days troubleshooting this, building kernels and playing Skyrim
reserved for future things
Also of note: I'm working on making this into scripts, don't worry everyone. And, if you bork your wifi, I will have a wireless fix in the works too.
Hi
First of all, thanks for this tutorial
I'm pretty sure this should be very straightforward but not to mess this thing up what do I need to change for a network with the following definitions:
Network SSID: eduroam
Security: 802.1x Enterprise
EAP method: PEAP
Phase 2 authentication: MSCHAPV2
Cheers
LacerdaPT said:
Hi
First of all, thanks for this tutorial
I'm pretty sure this should be very straightforward but not to mess this thing up what do I need to change for a network with the following definitions:
Network SSID: eduroam
Security: 802.1x Enterprise
EAP method: PEAP
Phase 2 authentication: MSCHAPV2
Cheers
Click to expand...
Click to collapse
Hey, it's not a problem at all. Pulled from the source here: NookDevs.com wpa_supplicant.conf I built this skeleton here:
Code:
network={
ssid="eduroam"
scan_ssid=1
key_mgmt=WPA-EAP
pairwise=CCMP TKIP
group=CCMP TKIP
eap=PEAP
identity="[email protected]"
password="YOUR-PASSWORD"
ca_cert="/system/etc/wifi/cacert.pem"
phase1="peapver=0"
phase2="MSCHAPV2" }
As you can see, you'll need to enter your University email in the identity field and your password in the password field, and if you don't have the needed certificates/password/etc you can get that from your local IT office (I would ask to speak with your network technicians though, helpdesk may not have it). Make SURE to read the instructions in that link, the openssl bit is different than the guide above!
Thanks!
On monday I will try that and will report the outcome.
Cheers
Hi.
It worked like a charm! No problem at all.
Thanks!
Cheers
Awesome! Glad to hear it.

[Q] Make a private Caldav server work

Hi, I recently purchased the ZTE Open C and want to synchronize its calendar with my own Caldav server.
Firefox rejects the connection tough, because the server has an invalid (self signed) certificate.
So i tried adding my certificate to firefox.
I found this guide:
http : // wiki . mozfr . org / Adding_CA_to_FirefoxOS
(Sorry for inserted spaces, won't let me post a link in first post.)
However I fail in the very first steps.
Code:
adb shell ls /data/b2g/mozilla/
Returns: /data/b2g/mozilla/: Permission denied
This means I dont have reading rights in this directory.
How do I get those rights, or alternativeley is there a better way to achieve my Caldav-Server goal?
Mathews123 said:
Hi, I recently purchased the ZTE Open C and want to synchronize its calendar with my own Caldav server.
Firefox rejects the connection tough, because the server has an invalid (self signed) certificate.
So i tried adding my certificate to firefox.
I found this guide:
http : // wiki . mozfr . org / Adding_CA_to_FirefoxOS
(Sorry for inserted spaces, won't let me post a link in first post.)
However I fail in the very first steps.
Code:
adb shell ls /data/b2g/mozilla/
Returns: /data/b2g/mozilla/: Permission denied
This means I dont have reading rights in this directory.
How do I get those rights, or alternativeley is there a better way to achieve my Caldav-Server goal?
Click to expand...
Click to collapse
You cannot use that method unless your phone is rooted, BUT...
I had the same problem and solved it a lot easier. Just launch the browser and input your server's URL. Then you will be warned about the not valid cert, add a permanent exception and that's all, now calendars should sync over HTTPS.
BTW this worked for me until FFOS v1.4. Today I updated to FFOS 2.1 and this trick stopped working, so you have been warned.
Thank you for the suggestion.
I am not running v2.0, so I tried it.
I could add the certificate.
However, when trying to connect, I get:
"Unknown Error. Please try again later."
Any way to figure out what's wrong now?
Seems to be a problem with the server I used. (Baikal)
Using a different one (Owncloud - sadly quite a lot bigger), it works with your tip.
So thanks for the help.
to ged rid of the "unknown error" in Caldav (etc.?)
doragasu said:
I had the same problem and solved it a lot easier. Just launch the browser and input your server's URL. Then you will be warned about the not valid cert, add a permanent exception and that's all, now calendars should sync over HTTPS.
Click to expand...
Click to collapse
thank you so much :victory:

Certificate error when trying to establish email account connection

I am trying to connect an email app (AquaMail) on my phone (Sprint Samsung Note 4, stock rooted, Android OS 5.0.1) to my email server (IMAP) using SSL. When I try this, I get the following error message:
Incoming mail server (IMAP): Invalid security (SSL) certificate. java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
The server to which I am trying to connect is my own VPS. I do have a wild card certificate installed on the site and I believe it is installed properly. I say this because of the report I generated on www.ssllabs.com/ssltest:
Certificate: 100%
Protocol Support: 95%
Key Exchange: 90%
Cipher Strength: 90%
Two certification paths are shown: mail.mydomain.com -> StartCom Class 2 Primary Intermediate Server CA -> StartCom Certification Authority (one path shows this with SHA1withRSA and the other shows SHA256withRSA).
Looking at the Handshake Simulation section, it clearly shows that Android 5.0.0 functions properly, but is also shows that Java 7u25 has a 'protocol or cipher suite mismatch'. This same warning shows up for other, deprecated systems and is probably due to my having turned off older, insecure access protocols.
Can anyone suggest how to get this working properly? Yes, I could work around this by a) allowing all certificate or b) not using secure protocols; but neither of these are solutions.
Thank you for your help!

What should I do if the tool package fails to run when I integrate the HUAWEI AppGallery Connect SDK to Eclipse?

Background​I had recently planned on integrating the Crash SDK to my app. However, my app was developed through Eclipse and the integration process was different from that in Android Studio.
By referring to the official materials, I downloaded the tool package and used it to generate an Eclipse project package.
However, when the build.bat file in the aar2eclipse/aar directory was executed according to the procedures in the document, an error was reported in the command line. The error information was as follows:
FAILURE: Build failed with an exception.
* What went wrong:
Task ' assembleRelease ' not found in root project ' aar '.
Problem Reoccurring​1. I first thought that the problem might be caused by my company's intranet. But when I connected to the Internet, the problem remained unsolved.
2. Then I guessed that it might have something to do with the Android development environment.
I borrowed a colleague's PC to execute the build.bat file, and it that did the trick. Therefore, I was able to conclude that the problem was caused by incorrect configurations in the Android development environment. I compared the configurations on the two PCs and found that the environment variables were different. ANDROID_HOME was missing from the environment variables on my PC.
Cause​Huawei's Eclipse tool package is unable to run properly and reports an error without the ANDROID_HOME variable.
Solution: Right-click This PC and choose Properties from the shortcut menu. In the displayed dialog box, click the Advanced System Settings tab and then click Environment Variables. In the System Variables dialog box, create a new ANDROID_HOME parameter.
Set the value to the installation path of the local Android SDK, and the problem will be resolved, as shown below.
Reference:
https://developer.huawei.com/consumer/en/doc/development/AppGallery-connect-Guides/agc-get-started#h2-1587519820720

How To Guide How to Make and Sign a Driver and Certificate: Intro To Encryption

=========================================
HOW TO MAKE AND SIGN, A DRIVER AND CERTIFICATE: INTRO TO ENCRYPTION~!
=========================================​
Today we are going to get our feet a little wet in Cryptography~!
Why would I need this?
For this Use Case, we will be discussing the NVIDIA SHIELD~!
PLEASE NOTE, THE TOPICS BEING DISCUSSED TODAY MAY BE ILLEGAL IN YOUR COUNTRY. PLEASE USE DISCRETION AND KNOW YOUR COUNTRY'S LAWS REGARDING CRYPTOGRAPHY BEFORE GOING FURTHER.... PEACE AND LOVE
Spoiler: OPENSSL WARNING
OPENSSL WARNING:
"Please remember that export/import and/or use of strong cryptography software, providing cryptography hooks,
or even just communicating technical details about cryptography software is illegal in some parts of the world. So
when you import this package to your country, re-distribute it from there or even just email technical suggestions
or even source patches to the authors or other people you are strongly advised to pay close attention to any laws
or regulations which apply to you. The authors of OpenSSL are not liable for any violations you make here. So be
careful, it is your responsibility."
Many Users on Windows 11 are reporting issues with Android Bootloader not installing and giving an Error Code 10.
Spoiler: LIKE THIS
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Error Code 10 is due to Nvidia's driver's digital certificate expiring. Crypto~!
Spoiler: SHOWN HERE
Spoiler: SOFTWARE DEVELOPMENT TOOLS
This is exclusively for beginners~! I don't care about your fancy IDE's Thank You~!
Intro to Cryptography By a Noob
Hello Friends~! I have built information trees, to teach you about these tools. I was originally going to package them all together, but in my efforts of doing so I realize that the process was getting too convoluted, when there is already an...
forum.xda-developers.com
The Bad Drivers From Nvidia:
Gameworks Download Center
Get the latest Gameworks software for your game development work.
developer.nvidia.com
Spoiler: MAKE A CERTIFICATE IN OPENSSL
GENERATING A PRIVATE AND PUBLIC KEY, AND A CSR
openssl genrsa -out shield.key 2048
openssl rsa -in shield.key -pubout -out shield_public.key
openssl req -new -key shield.key -out shield.csr
openssl x509 -in shield.csr -out shield.crt -req -signkey shield.key -days 365
Spoiler: BUILDING THE DRIVER
To be Continued~!
Spoiler: REFS
This article turned me on to the make cert tool
UWP - SignTool Error: No certificates were found that met all the given criteria
I'm getting this error after our company changed its AD domain. UWP app development with VS 2019 and Windows 10 (1903) C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Micr...
stackoverflow.com
MakeCert - Windows drivers
MakeCert (Makecert.exe) is a command-line CryptoAPI tool that creates an X.509 certificate that is signed by a system test root key or by another specified key.
docs.microsoft.com
Cryptographic Keylength Recomendation
Keylength - Cryptographic Key Length Recommendation
Certificate Stores - Windows drivers
Certificate Stores
docs.microsoft.com
System Store Locations - Win32 apps
A system store is a collection that consists of one or more physical sibling stores.
docs.microsoft.com
SignTool.exe (Sign Tool) - .NET Framework
Learn about SignTool.exe, the Sign Tool. This command-line tool digitally signs files, verifies signatures in files, and applies timestamps to files.
docs.microsoft.com
Using SignTool to Sign a File - Win32 apps
Explains how to use SignTool to sign a file.
docs.microsoft.com
COMMANDS FROM WINSDK LEARNED BUT NOT USED
Spoiler: MAKECERT COMMANDS
-sk <keyName> Subject's key container name; To be created if not present
-pe Mark generated private key as exportable
-ss <store> Subject's certificate store name that stores the output
certificate
-sr <location> Subject's certificate store location.
<CurrentUser|LocalMachine>. Default to 'CurrentUser'
-# <number> Serial Number from 1 to 2^31-1. Default to be unique
-$ <authority> The signing authority of the certificate
<individual|commercial>
-n <X509name> Certificate subject X500 name (eg: CN=Fred Dews)
-? Return a list of basic options
-! Return a list of extended options
Extended Options
-tbs <file> Certificate or CRL file to be signed
-sc <file> Subject's certificate file
-sv <pvkFile> Subject's PVK file; To be created if not present
-ic <file> Issuer's certificate file
-ik <keyName> Issuer's key container name
-iv <pvkFile> Issuer's PVK file
-is <store> Issuer's certificate store name.
-ir <location> Issuer's certificate store location
<CurrentUser|LocalMachine>. Default to 'CurrentUser'
-in <name> Issuer's certificate common name.(eg: Fred Dews)
-a <algorithm> The signature's digest algorithm.
<md5|sha1|sha256|sha384|sha512>. Default to 'sha1'
-ip <provider> Issuer's CryptoAPI provider's name
-iy <type> Issuer's CryptoAPI provider's type
-sp <provider> Subject's CryptoAPI provider's name
-sy <type> Subject's CryptoAPI provider's type
-iky <keytype> Issuer key type
<signature|exchange|<integer>>.
-sky <keytype> Subject key type
<signature|exchange|<integer>>.
-l <link> Link to the policy information (such as a URL)
-cy <certType> Certificate types
<end|authority>
-b <mm/dd/yyyy> Start of the validity period; default to now.
-m <number> The number of months for the cert validity period
-e <mm/dd/yyyy> End of validity period; defaults to 2039
-h <number> Max height of the tree below this cert
-len <number> Generated Key Length (Bits)
Default to '2048' for 'RSA' and '512' for 'DSS'
-r Create a self signed certificate
-nscp Include Netscape client auth extension
-crl Generate a CRL instead of a certificate
-eku <oid[<,oid>]> Comma separated enhanced key usage OIDs
-? Return a list of basic options
-! Return a list of extended options
Spoiler: SIGNTOOL COMMANDS
Typing Signtool brings up this
sign -- Sign files using an embedded signature.
timestamp -- Timestamp previously-signed files.
verify -- Verify embedded or catalog signatures.
catdb -- Modify a catalog database.
remove -- Remove embedded signature(s) or reduce the size of an
embedded signed file.
Spoiler: SIGN
Usage: signtool sign [options] <filename(s)>
Use the "sign" command to sign files using embedded signatures. Signing
protects a file from tampering, and allows users to verify the signer (you)
based on a signing certificate. The options below allow you to specify signing
parameters and to select the signing certificate you wish to use.
Certificate selection options:
/a Select the best signing cert automatically. SignTool will find all
valid certs that satisfy all specified conditions and select the
one that is valid for the longest. If this option is not present,
SignTool will expect to find only one valid signing cert.
/ac <file> Add an additional certificate, from <file>, to the signature block.
/c <name> Specify the Certificate Template Name (Microsoft extension) of the
signing cert.
/f <file> Specify the signing cert in a file. If this file is a PFX with
a password, the password may be supplied with the "/p" option.
If the file does not contain private keys, use the "/csp" and "/kc"
options to specify the CSP and container name of the private key.
/i <name> Specify the Issuer of the signing cert, or a substring.
/n <name> Specify the Subject Name of the signing cert, or a substring.
/p <pass.> Specify a password to use when opening the PFX file.
/r <name> Specify the Subject Name of a Root cert that the signing cert must
chain to.
/s <name> Specify the Store to open when searching for the cert. The default
is the "MY" Store.
/sm Open a Machine store instead of a User store.
/sha1 <h> Specify the SHA1 thumbprint of the signing cert.
/fd Specifies the file digest algorithm to use for creating file
signatures. If this parameter is not specified, an error will be
generated.
/u <usage> Specify the Enhanced Key Usage that must be present in the cert.
The parameter may be specified by OID or by string. The default
usage is "Code Signing" (1.3.6.1.5.5.7.3.3).
/uw Specify usage of "Windows System Component Verification"
(1.3.6.1.4.1.311.10.3.6).
/fdchw Generate a warning if the file digest algorithm and the hash algorithm
used in the signing certificate's signature are different.
Private Key selection options:
/csp <name> Specify the CSP containing the Private Key Container.
/kc <name> Specify the Key Container Name of the Private Key.
Signing parameter options:
/as Append this signature. If no primary signature is present, this
signature will be made the primary signature instead.
/d <desc.> Provide a description of the signed content.
/du <URL> Provide a URL with more information about the signed content.
/t <URL> Specify the timestamp server's URL. If this option is not present,
the signed file will not be timestamped. A warning is generated if
timestamping fails.
/tr <URL> Specifies the RFC 3161 timestamp server's URL. If this option
(or /t) is not specified, the signed file will not be timestamped.
A warning is generated if timestamping fails. This switch cannot
be used with the /t switch.
/tseal <URL> Specifies the RFC 3161 timestamp server's URL for timestamping a
sealed file.
/td <alg> Used with the /tr or /tseal switch to request a digest algorithm
used by the RFC 3161 timestamp server. This parameter
is required if the /tr or /tseal is specified.
/sa <OID> <value> Specify an OID and value to be included as an authenticated
attribute in the signature. The value will be encoded as an
ASN1 UTF8 string. This option may be given multiple times.
/seal Add a sealing signature if the file format supports it.
/itos Create a primary signature with the intent-to-seal attribute.
/force Continue to seal or sign in situations where the existing signature
or sealing signature needs to be removed to support sealing.
/nosealwarn Sealing-related warnings do not affect SignTool's return code.
/tdchw Generate a warning if the digest algorithm used by the RFC 3161
timestamp server and the hash algorithm used in the signing certificate's
signature are different.
Digest options:
/dg <path> Generates the to be signed digest and the unsigned PKCS7 files.
The output digest and PKCS7 files will be: <path>\<file>.dig and
<path>\<file>.p7u. To output an additional XML file, see /dxml.
/ds Signs the digest only. The input file should be the digest
generated by the /dg option. The output file will be:
<file>.signed.
/di <path> Creates the signature by ingesting the signed digest to the
unsigned PKCS7 file. The input signed digest and unsigned
PKCS7 files should be: <path>\<file>.dig.signed and
<path>\<file>.p7u.
/dxml When used with the /dg option, produces an XML file. The output
file will be: <path>\<file>.dig.xml.
/dlib <dll> Specifies the DLL implementing the AuthenticodeDigestSign or
AuthenticodeDigestSignEx function to sign the digest with. This
option is equivalent to using SignTool separately with the
/dg, /ds, and /di switches, except this option invokes all three
as one atomic operation.
/dmdf <file> When used with the /dlib option, passes the file's contents to
the AuthenticodeDigestSign or AuthenticodeDigestSignEx function
without modification.
PKCS7 options:
/p7 <path> Specifies that for each specified content file a PKCS7 file is
produced. The PKCS7 file will be named: <path>\<file>.p7
/p7co <OID> Specifies the <OID> that identifies the signed content.
/p7ce <Value> Defined values:
Embedded - Embeds the signed content in the PKCS7.
DetachedSignedData - Produces the signed data part of
a detached PKCS7.
Pkcs7DetachedSignedData - Produces a full detached PKCS7.
The default is 'Embedded'
Other options:
/ph Generate page hashes for executable files if supported.
/nph Suppress page hashes for executable files if supported.
The default is determined by the SIGNTOOL_PAGE_HASHES
environment variable and by the wintrust.dll version.
/rmc Specifies signing a PE file with the relaxed marker check semantic.
The flag is ignored for non-PE files. During verification, certain
authenticated sections of the signature will bypass invalid PE
markers check. This option should only be used after careful
consideration and reviewing the details of MSRC case MS12-024 to
ensure that no vulnerabilities are introduced.
/q No output on success and minimal output on failure. As always,
SignTool returns 0 on success, 1 on failure, and 2 on warning.
/v Print verbose success and status messages. This may also provide
slightly more information on error.
/debug Display additional debug information.
Spoiler: TIMESTAMP
Use the "timestamp" command to add a timestamp to a previously-signed file.
The "/t" option is required.
/q No output on success and minimal output on failure. As always,
SignTool returns 0 on success and 1 on failure.
/t <URL> Specify the timestamp server's URL.
/tr <URL> Specifies the RFC 3161 timestamp server's URL.
/tseal <URL> Specifies the RFC 3161 timestamp server's URL for timestamping a
sealed file. One of /t, /tr or /tseal is required.
/td <alg> Used with the /tr or /tseal switch to request a digest algorithm
used by the RFC 3161 timestamp server. If this parameter is not
specified, a warning will be generated. In future releases,
this parameter will be required if /tr or /tseal is specified
/tp <index> Timestamps the signature at <index>.
/p7 Timestamps PKCS7 files.
/force Remove any sealing signature that is present in order to timestamp.
/nosealwarn Warnings for removing a sealing signature do not affect SignTool's
return code.
/v Print verbose success and status messages. This may also provide
slightly more information on error.
/debug Display additional debug information.
Spoiler: VERIFY
Usage: signtool verify [options] <filename(s)>
Use the "verify" command to verify embedded or catalog signatures.
Verification determines if the signing certificate was issued by a trusted
party, whether that certificate has been revoked, and whether the certificate
is valid under a specific policy. Options allow you to specify requirements
that must be met and to specify how to find the catalog, if appropriate.
Catalogs are used by Microsoft and others to sign many files very efficiently.
Catalog options:
/a Automatically attempt to verify the file using all methods. First
search for a catalog using all catalog databases. If the file is
not signed in any catalog, attempt to verify the embedded
signature. When verifying files that may or may not be signed in a
catalog, such as Windows files and drivers, this option is the
easiest way to ensure that the signature is found.
/ad Find the catalog automatically using the default catalog database.
/as Find the catalog automatically using the system component (driver)
catalog database.
/ag <GUID> Find the catalog automatically in the specified catalog database.
Catalog databases are identified by GUID.
Example GUID: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}
/c <file> Specify the catalog file.
/o <ver> When verifying a file that is in a signed catalog, verify that the
file is valid for the specified platform.
Parameter format is: PlatformID:VerMajor.VerMinor.BuildNumber
/hash <SHA1 | SHA256> Optional hash algorithm to use when searching for
a file in a catalog.
SignTool uses the "Windows Driver" Verification Policy by default. The options
below allow you to use alternate Policies.
Verification Policy options:
/pa Use the "Default Authenticode" Verification Policy.
/pg <GUID> Specify the verification policy by GUID (also called ActionID).
Signature requirement options:
/ca <h> Verify that the file is signed with an intermediate CA cert with
the specified hash. This option may be specified multiple times;
one of the specified hashes must match.
/r <name> Specify the Subject Name of a Root cert that the signing cert must
chain to.
/sha1 <h> Verify that the signer certificate has the specified hash. This
option may be specified multiple times; one of the specified hashes
must match.
/tw Generate a Warning if the signature is not timestamped.
/u <usage> Generate a Warning if the specified Enhanced Key Usage is not
present in the cert. This option may be given multiple times.
Other options:
/all Verify all signatures in a file with multiple signatures.
/ds <index> Verify the signature at <index>.
/ms Use multiple verification semantics. This is the default behavior
of a Win8 WinVerifyTrust call.
/sl Verify sealing signatures for supported file types.
/p7 Verify PKCS7 files. No existing policies are used for p7 validation.
The signature is checked and a chain is built for the signing
certificate.
/bp Perform the verification with the Biometric mode signing policy.
/enclave Perform the verification with the enclave signing policy. This also
prints the Unique ID and Author ID information.
/kp Perform the verification with the kernel-mode driver signing policy.
/q No output on success and minimal output on failure. As always,
SignTool returns 0 on success, 1 on failure, and 2 on warning.
/ph Print and verify page hash values.
/d Print Description and Description URL.
/v Print verbose success and status messages. This may also provide
slightly more information on error. If you want to see information
about the signer, you should use this option.
/debug Display additional debug information.
/p7content <file> Provide p7 content file incase of detached signatures (signed using PKCS7DetachedSignedData).
Spoiler: CATDB
Usage: signtool catdb [options] <filename(s)>
Use the "catdb" command to add or remove catalog files to or from a catalog
database. Catalog databases are used for automatic lookup of catalog files,
and are identified by GUID.
Catalog Database options allow you to select which catalog database to operate
on. If you do not specify a catalog database, SignTool operates on the system
component (driver) database.
Catalog Database options:
/d Operate on the default catalog database instead of the system
component (driver) catalog database.
/g <GUID> Operate on the specified catalog database.
Other options specify what to do with the selected catalog database, and other
behavior. If you do not specify any other options, SignTool will add the
specified catalogs to the catalog database, replacing any existing catalog
which has the same name.
Other options:
/q No output on success and minimal output on failure. As always,
SignTool returns 0 on success and 1 on failure.
/r Remove the specified catalogs from the catalog database.
/u Automatically generate a unique name for the added catalogs. The
catalog files will be renamed if necessary to prevent name
conflicts with existing catalog files.
/v Print verbose success and status messages. This may also provide
slightly more information on error.
/debug Display additional debug information.
Spoiler: REMOVE
Usage: signtool remove [options] <filename(s)>
Use the "remove" command to remove the embedded signature(s) or sections of
the embedded signature on a PE/COFF file.
WARNING: This command will modify the file on the disk. Please create a backup
copy if you want to preserve the original file.
The option "/c" and/or "/u", or "/s" is required.
/c Remove all certificates, except for the signer certificate
from the signature.
/q No output on success and minimal output on failure. As always,
SignTool returns 0 on success and 1 on failure.
/s Remove the signature(s) entirely.
/u Remove the unauthenticated attributes from the signature
e.g. Dual signatures and timestamps.
/v Print verbose success and status messages. This may also provide
slightly more information on error.
This thread may explain why this is happening, AMD CPU and USB 3.0 unsupported on these old dang drivers
Fastboot problem on USB 3.0 ports
Hi guys, today I set up my notebook, to use in the future, MIUI flashing tool (No bootloader unlock in this machine, cause: ryzen CPU). After installing the drivers I restarted in fastboot mode and all ok..recognized device (Android bootloader...
forum.xda-developers.com
This is not complete and the code shown is placeholder. I am getting so deep in note taking I had to put up what I have so I can see it better and clearer~! I'll update when I am done and will post a video walkthrough. For Now... I need Sleep. Bah~! I hate having to sleep all the time.
jenneh said:
This is not complete and the code shown is placeholder. I am getting so deep in note taking I had to put up what I have so I can see it better and clearer~! I'll update when I am done and will post a video walkthrough. For Now... I need Sleep. Bah~! I hate having to sleep all the time.
Click to expand...
Click to collapse
What do you need to know?
persona78 said:
What do you need to know?
Click to expand...
Click to collapse
I'm trying to learn how to take a fresh USB driver ini file and build a cert for it with sha 256 hash just to learn how to run the algorithm while fixing the problem of the original ini file being expired. It's funny to think about some of this software we use, as having "shelf dates" almost. Haha. Like a food product or something organic. Interesting! Crypto~!
jenneh said:
I'm trying to learn how to take a fresh USB driver ini file and build a cert for it with sha 256 hash just to learn how to run the algorithm while fixing the problem of the original ini file being expired. It's funny to think about some of this software we use, as having "shelf dates" almost. Haha. Like a food product or something organic. Interesting! Crypto~!
Click to expand...
Click to collapse
I know how to create a certificate and sign a exe.
This helps?
persona78 said:
I know how to create a certificate and sign a exe.
This helps?
Click to expand...
Click to collapse
Yes!!
Hi!
@jenneh this are the batch tools i create: Tools
1-Extract to Desktop
2-Create your cert.pfx and paste inside Sign_Batch folder
3-paste the app you want in to sign inside Sign_Batch folder to
4-Pick and drop the app over the appsign_soft.bat
5-Right click over app and check Digital signature
6-Select the signature and go to details
7-Check your certificate
8-Install your certificate, like this system will know that is safe
9-Done!
Your app is now signed with your certificate!
Spoiler: Print Screens
persona78 said:
Hi!
@jenneh this are the batch tools i create: Tools
1-Extract to Desktop
2-Create your cert.pfx and paste inside Sign_Batch folder
3-paste the app you want in to sign inside Sign_Batch folder to
4-Pick and drop the app over the appsign_soft.bat
5-Right click over app and check Digital signature
6-Select the signature and go to details
7-Check your certificate
8-Install your certificate, like this system will know that is safe
9-Done!
Your app is now signed with your certificate!
Spoiler: Print Screens
View attachment 5544459
View attachment 5544463
Click to expand...
Click to collapse
You are like An Angel from Binary Heaven. I just Woke Up and was refreshing my memory on this~! I will check out your tools now and update my thread when I fully understand and properly credit you for your hard work. I really thank you So So much :> Your efforts will help Many~!
I only started this train of thought yesterday so bare with me, this is all new to me~!
jenneh said:
You are like An Angel from Binary Heaven. I just Woke Up and was refreshing my memory on this~! I will check out your tools now and update my thread when I fully understand and properly credit you for your hard work. I really thank you So So much :> Your efforts will help Many~!
I only started this train of thought yesterday so bare with me, this is all new to me~!
Click to expand...
Click to collapse
I hope it helps you!
persona78 said:
I hope it helps you!
Click to expand...
Click to collapse
OMG. I'm going through your work now... I got goosebumps. THANK YOU. I just need to get my coffee and some music going and Ima figure out how to explain all this in a video when I chain it together. haha
Oh and I want to tell the other WSA enthusiasts out there~! I see now how to chain this information over to WSA, specifically the MSIX bundle, decompiling it and adding rooted system images. I have seen where others on this forum have done the same thing, or come to the same conclusion but want to be secretive about their methods.
But WHy?~~! Haha~! That Tis Only the Soft Root as I am coining it. Explaining the modding of the msix file in order to gain root will be my next project on windows when this is complete. I would like to think... the stock root... would be a valuable resource that could be reported somewhere... But who knows?~! HMM
The letter of the day today is O, for OPEN SSL
/docs/man3.0/man7/crypto.html
www.openssl.org
Could not repeat the error. Tested using Virtual win11available here. Previous version though.
https://developer.microsoft.com/en-us/windows/downloads/virtual-machines/
Faked my LG to show as Nvidia...
CXZa said:
Could not repeat the error. Tested using Virtual win11available here. Previous version though.
https://developer.microsoft.com/en-us/windows/downloads/virtual-machines/
Faked my LG to show as Nvidia...
View attachment 5544673
Click to expand...
Click to collapse
The purpose of this article is to learn something about this obstacle, since Nvidia has not updated the drivers since 2018.
Which we are learning LOTS.
Not whether or not it is broke for all Users.
It's about engineering a fix for said problem.
Since I cannot easily edit the .inf Due to it's encryption.
jenneh said:
Nvidia Drivers, not an issue with Windows 11.
Click to expand...
Click to collapse
I was interested as it has been said that in future there are
more strick rules for drivers and such.
But this driver is ok. Installed properly and worked ok.
Or maybe the rules have changed in the later win versions.??
Try to restart your device. Maybe both of them...
CXZa said:
I was interested as it has been said that in future there are
more strick rules for drivers and such.
But this driver is ok. Installed properly and worked ok.
Try to restart your device. Maybe both of them...
Click to expand...
Click to collapse
Sorry that came off robotic, I THANK YOU For testing. Out of curiosity are you using amd or intel processor?
jenneh said:
Sorry that came off robotic, I THANK YOU For testing. Out of curiosity are you using amd or intel processor?
Click to expand...
Click to collapse
Intel...
Which win11 version you are using? Maybe the rules have changed like I said in previous post (added it after you quoted)
CXZa said:
Intel...
Which win11 version you are using? Maybe the rules have changed like I said in previous post (added it after you quoted)
Click to expand...
Click to collapse
I am on the latest version. Running AMD. I have uninstalled and reinstalled Many Times. I have used both Microsofts Factory isos, tried every iteration since preview, built my own modded ISOs ETC.
I have case Evidenced This problem for months and many of my viewers Have reported the Same Issue.
So what you are not understanding is, there are some of us who see a problem, regardless of the Root Cause,
We want a fix~! Your solutions have already been tried. So thank you, but this is an article regarding KNOWLEDGE
The shield is only a metaphor~! It is as said in the beginning just the Use Case. For the Lesson. This is a Live lesson.
Thank you.
Okay, have fun...
CXZa said:
Okay, have fun...
Click to expand...
Click to collapse
Oh I Am <3
So an Update~! I had theorized that I could just copy the contents of the .inf file, paste them into a new text document, rename it to android_usb.inf, then paste the rest of nvidia's original dlls etc, but Nope~! Apparently you have to modify the cat files and well every thing~! So another day of research it is!! Here's a nifty signing tool ;-)
ksign (Install) 2016.07.20.20170105
Free GUI and command line tool for software and installer signing
community.chocolatey.org

Categories

Resources