How do you verify Signing Certificate of binary in code?

Question

I'm trying to find a way to verify the signing certificate of a binary in code. For example, if you run the command: "codesign -vvvvd /YourApp/Executable" you may receive the output: "Authority: Apple Root CA" etc. I'm looking for a way to do this in code. Any push or nudge in the right direction would be outstanding.

Thanks!

This might be of some help: http://stackoverflow.com/questions/1475182/cocoa-objective-c-shell-command-line-execution — Simon Germain, Jan 03 '13 at 17:57

score 6 · Accepted Answer · answered Jan 03 '13 at 18:36

On the Mac, SecStaticCode and SecCode provide code signing and verification functionality. Specifically, SecCodeCopySelf() and SecCodeCheckValidityWithErrors() would be used to check the code signing of the current application.

Note that an application that has been modified and resigned (with the same certificate or any other) is effectively impossible to detect, since anyone capable of modifying the application and resigning it can stub out or otherwise defeat your verification code. The functions named above are, at best, a keep-honest-people-honest solution.

On iOS, Apple's official position is that you shouldn't attempt to do jailbreak detection or similar, and should trust the OS to get it right. Since you cannot run dynamically loaded code or read the binary data of other applications, it is not very useful to be able to verify code signing on that platform. (Whether or not Apple's official position is useful to you is another discussion entirely.)

score 1 · Answer 2 · answered Jan 03 '13 at 18:36

1

this is possible with an OS X application using Code Signing Services or Ole Begemann's code, but doesn't appear to be possible with iOS.

answered Jan 03 '13 at 18:36

Peter Elliott

3,273
16
30

How do you verify Signing Certificate of binary in code?

2 Answers2