Code Signing with one click (example 3)

After Windows Vista came out, many software developers started to use code signing certificates to confirm that the software really comes from the publisher and that the original package has not been modified since it was signed.

SignTool.exe is a command-line utility designed to manage digital signatures (sign, verify, etc). Usually, the command line looks like this:

signtool.exe sign /a /t <URL of timestamp server> Sample.exe

This command line is mainly used in post-build scripts. Although it is often required to sign a standalone EXE or DLL without running a complete build script (to make a quick test version, etc). Here is what I use on my development machine:

Add digital signature

This menu item calls Hstart with the following command line:

hstart /NOCONSOLE /WAIT /MSG="Successfully signed and timestamped!"
       /ERRMSG="An error occured while signing (signtool.exe)."
       /TITLE="Digital Signature" ""C:\WSDK\Bin\signtool.exe" sign /a /t
       http://timestamp.comodoca.com/authenticode "Sample.exe""

After SignTool.exe is executed (note the /WAIT switch), a simple message is displayed telling me that everything is OK:

Successfully signed and timestamped!

If something went wrong (f.e. the EXE file is read-only or the timestamp server is not accessible), SignTool.exe returns an error and the following message is displayed:

An error occured while signing (signtool.exe).

To enable this Shell command, create a new .REG file with the following content:

Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\exefile\shell\SIGNTOOL]
@="Add digital signature"
[HKEY_CLASSES_ROOT\exefile\shell\SIGNTOOL\command]
@="\"E:\\BIN\\hstart.exe\" /NOCONSOLE /WAIT /MSG=\"Successfully signed and timestamped!\" /ERRMSG=\"An error occured while signing (signtool.exe).\" /TITLE=\"Digital Signature\" \"\"C:\\WSDK\\Bin\\signtool.exe\" sign /a /t http://timestamp.comodoca.com/authenticode \"%1\"\""

A few notes on the REG file:

  1. The REG files have a special interpretation of backslash characters: you have to use it before double quotes and backslashes if these characters appear in the data value (\\ => \ and \" => ").
  2. Don't forget to replace "E:\BIN\hstart.exe" with your own path.
  3. Create the same Shell command for HKEY_CLASSES_ROOT\dllfile to enable this feature for DLL files too.

The sample REG files are included in the Hstart package (see Examples\SignTool).

Download - hstart.zip (23 KB)


Related Links

Code signing and digital signatures:

Hstart examples:

* All screenshots on this page are made with WinSnap.