Search code examples
comdigital-signaturewinverifytrust

How to securely load COM components

I want to verify COM DLLS for digital signature before loading, have the below questions

  1. I need to locate the components on disk and then verify the signature. So how to locate them on disk?

  2. Is there any Microsoft API exists which can automatically do this for me?

Thanks in advance.

Searched on web for APIS. I know how to verify the signature for normal DLLs. But for COM I am not sure how to do it.

Solution

  • See the COM registration documentation (https://learn.microsoft.com/en-us/windows/win32/com/inprocserver32) but essentially get the CLSID and lookup the InprocServer32 key in the registry to get the path to the registered DLL. If it doesn't have one then it might be an exe server (LocalServer32) and so on. If what you have is a ProgId, use that to lookup the CLSID but all the registration information is in the registry as documented.