blocks|key|3247119|text|因为我看到你无论如何都没有得到回复，让我提供一个。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3247120|如果您不介意使用第三方组件，请查看我们SecureBlackbox产品的TElAuthenticodeVerifier组件。使用此组件，您可以验证签名并检查时间戳。|offset|length|3247121|entityMap|0|LINK|mutability|MUTABLE|url|https://www.eldos.com/documentation/sbb/documentation/ref_cl_authenticodeverifier.html^0|0|10|N|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

As I see that you've got no replies anyway, let me offer one. 

If you don't mind using third-party components, take a look at <a href="https://www.eldos.com/documentation/sbb/documentation/ref_cl_authenticodeverifier.html" rel="nofollow noreferrer">TElAuthenticodeVerifier</a> component of our SecureBlackbox product. With this component you can verify the signature and check the timestamps.

blocks|key|3033125|text|回到最初的问题，我找不到托管方式，所以最终使用了pInvoke，如下所示：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3033126|public+static+bool+IsTimestamped(string+filename)
{
++++try
++++{
++++++++int+encodingType;
++++++++int+contentType;
++++++++int+formatType;
++++++++IntPtr+certStore+=+IntPtr.Zero;
++++++++IntPtr+cryptMsg+=+IntPtr.Zero;
++++++++IntPtr+context+=+IntPtr.Zero;

++++++++if+(!WinCrypt.CryptQueryObject(
++++++++++++WinCrypt.CERT_QUERY_OBJECT_FILE,
++++++++++++Marshal.StringToHGlobalUni(filename),
++++++++++++WinCrypt.CERT_QUERY_CONTENT_FLAG_ALL,
++++++++++++WinCrypt.CERT_QUERY_FORMAT_FLAG_ALL,
++++++++++++0,
++++++++++++out+encodingType,
++++++++++++out+contentType,
++++++++++++out+formatType,
++++++++++++ref+certStore,
++++++++++++ref+cryptMsg,
++++++++++++ref+context))
++++++++{
++++++++++++throw+new+Win32Exception(Marshal.GetLastWin32Error());
++++++++}

++++++++//expecting+contentType=10;+CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED+
++++++++//Logger.LogInfo(string.Format("Querying+file+'{0}':",+filename));
++++++++//Logger.LogInfo(string.Format("++Encoding+Type:+{0}",+encodingType));
++++++++//Logger.LogInfo(string.Format("++Content+Type:+{0}",+contentType));
++++++++//Logger.LogInfo(string.Format("++Format+Type:+{0}",+formatType));
++++++++//Logger.LogInfo(string.Format("++Cert+Store:+{0}",+certStore.ToInt32()));
++++++++//Logger.LogInfo(string.Format("++Crypt+Msg:+{0}",+cryptMsg.ToInt32()));
++++++++//Logger.LogInfo(string.Format("++Context:+{0}",+context.ToInt32()));


++++++++//+Get+size+of+the+encoded+message.
++++++++int+cbData+=+0;
++++++++if+(!WinCrypt.CryptMsgGetParam(
++++++++++++cryptMsg,
++++++++++++WinCrypt.CMSG_ENCODED_MESSAGE,//Crypt32.CMSG_SIGNER_INFO_PARAM,
++++++++++++0,
++++++++++++IntPtr.Zero,
++++++++++++ref+cbData))
++++++++{
++++++++++++throw+new+Win32Exception(Marshal.GetLastWin32Error());
++++++++}

++++++++var+vData+=+new+byte[cbData];

++++++++//+Get+the+encoded+message.
++++++++if+(!WinCrypt.CryptMsgGetParam(
++++++++++++cryptMsg,
++++++++++++WinCrypt.CMSG_ENCODED_MESSAGE,//Crypt32.CMSG_SIGNER_INFO_PARAM,
++++++++++++0,
++++++++++++vData,
++++++++++++ref+cbData))
++++++++{
++++++++++++throw+new+Win32Exception(Marshal.GetLastWin32Error());
++++++++}

++++++++var+signedCms+=+new+SignedCms();
++++++++signedCms.Decode(vData);

++++++++foreach+(var+signerInfo+in+signedCms.SignerInfos)
++++++++{
++++++++++++foreach+(var+unsignedAttribute+in+signerInfo.UnsignedAttributes)
++++++++++++{
++++++++++++++++if+(unsignedAttribute.Oid.Value+==+WinCrypt.szOID_RSA_counterSign)
++++++++++++++++{
++++++++++++++++++++//Note+at+this+point+we+assume+this+counter+signature+is+the+timestamp
++++++++++++++++++++//refer+to+http://support.microsoft.com/kb/323809+for+the+origins

++++++++++++++++++++//TODO:+extract+timestamp+value,+if+required
++++++++++++++++++++return+true;
++++++++++++++++}

++++++++++++}
++++++++}
++++}
++++catch+(Exception)
++++{
++++++++//+no+logging
++++}

++++return+false;
}|code-block|syntax|javascript|3033127|WinCrypt.cs包含以下内容：|3033128|using+System;
using+System.Collections.Generic;
using+System.Linq;
using+System.Text;
using+System.Runtime.InteropServices;

namespace+MyNamespace.Win32
{
++++static+class+WinCrypt
++++{
++++++++[StructLayout(LayoutKind.Sequential)]
++++++++public+struct+BLOB
++++++++{
++++++++++++public+int+cbData;
++++++++++++public+IntPtr+pbData;
++++++++}

++++++++[StructLayout(LayoutKind.Sequential)]
++++++++public+struct+CRYPT_ALGORITHM_IDENTIFIER
++++++++{
++++++++++++public+String+pszObjId;
++++++++++++BLOB+Parameters;
++++++++}

++++++++[StructLayout(LayoutKind.Sequential)]
++++++++public+struct+CERT_ID
++++++++{
++++++++++++public+int+dwIdChoice;
++++++++++++public+BLOB+IssuerSerialNumberOrKeyIdOrHashId;
++++++++}

++++++++[StructLayoutAttribute(LayoutKind.Sequential)]
++++++++public+struct+SIGNER_SUBJECT_INFO
++++++++{
++++++++++++///+DWORD->unsigned+int
++++++++++++public+uint+cbSize;

++++++++++++///+DWORD*
++++++++++++public+System.IntPtr+pdwIndex;

++++++++++++///+DWORD->unsigned+int
++++++++++++public+uint+dwSubjectChoice;

++++++++++++///+SubjectChoiceUnion
++++++++++++public+SubjectChoiceUnion+Union1;
++++++++}

++++++++[StructLayoutAttribute(LayoutKind.Explicit)]
++++++++public+struct+SubjectChoiceUnion
++++++++{

++++++++++++///+SIGNER_FILE_INFO*
++++++++++++[FieldOffsetAttribute(0)]
++++++++++++public+System.IntPtr+pSignerFileInfo;

++++++++++++///+SIGNER_BLOB_INFO*
++++++++++++[FieldOffsetAttribute(0)]
++++++++++++public+System.IntPtr+pSignerBlobInfo;
++++++++}

++++++++[StructLayout(LayoutKind.Sequential)]
++++++++public+struct+CERT_NAME_BLOB
++++++++{
++++++++++++public+uint+cbData;
++++++++++++[MarshalAs(UnmanagedType.LPArray,+SizeParamIndex+=+0)]
++++++++++++public+byte[]+pbData;
++++++++}

++++++++[StructLayout(LayoutKind.Sequential)]
++++++++public+struct+CRYPT_INTEGER_BLOB
++++++++{
++++++++++++public+UInt32+cbData;
++++++++++++public+IntPtr+pbData;
++++++++}

++++++++[StructLayout(LayoutKind.Sequential)]
++++++++public+struct+CRYPT_ATTR_BLOB
++++++++{
++++++++++++public+uint+cbData;
++++++++++++[MarshalAs(UnmanagedType.LPArray,+SizeParamIndex+=+0)]
++++++++++++public+byte[]+pbData;
++++++++}

++++++++[StructLayout(LayoutKind.Sequential)]
++++++++public+struct+CRYPT_ATTRIBUTE
++++++++{
++++++++++++[MarshalAs(UnmanagedType.LPStr)]
++++++++++++public+string+pszObjId;
++++++++++++public+uint+cValue;
++++++++++++[MarshalAs(UnmanagedType.LPStruct)]
++++++++++++public+CRYPT_ATTR_BLOB+rgValue;
++++++++}

++++++++[StructLayout(LayoutKind.Sequential)]
++++++++public+struct+CMSG_SIGNER_INFO
++++++++{
++++++++++++public+int+dwVersion;
++++++++++++private+CERT_NAME_BLOB+Issuer;
++++++++++++CRYPT_INTEGER_BLOB+SerialNumber;
++++++++++++CRYPT_ALGORITHM_IDENTIFIER+HashAlgorithm;
++++++++++++CRYPT_ALGORITHM_IDENTIFIER+HashEncryptionAlgorithm;
++++++++++++BLOB+EncryptedHash;
++++++++++++CRYPT_ATTRIBUTE[]+AuthAttrs;
++++++++++++CRYPT_ATTRIBUTE[]+UnauthAttrs;
++++++++}

++++++++[DllImport("crypt32.dll",+CharSet+=+CharSet.Auto,+SetLastError+=+true)]
++++++++public+static+extern+Boolean+CryptQueryObject(
++++++++++++int+dwObjectType,
++++++++++++IntPtr+pvObject,
++++++++++++int+dwExpectedContentTypeFlags,
++++++++++++int+dwExpectedFormatTypeFlags,
++++++++++++int+dwFlags,
++++++++++++out+int+pdwMsgAndCertEncodingType,
++++++++++++out+int+pdwContentType,
++++++++++++out+int+pdwFormatType,
++++++++++++ref+IntPtr+phCertStore,
++++++++++++ref+IntPtr+phMsg,
++++++++++++ref+IntPtr+ppvContext);


++++++++[DllImport("crypt32.dll",+CharSet+=+CharSet.Auto,+SetLastError+=+true)]
++++++++public+static+extern+Boolean+CryptMsgGetParam(
++++++++++++IntPtr+hCryptMsg,
++++++++++++int+dwParamType,
++++++++++++int+dwIndex,
++++++++++++IntPtr+pvData,
++++++++++++ref+int+pcbData
++++++++);

++++++++[DllImport("crypt32.dll",+CharSet+=+CharSet.Auto,+SetLastError+=+true)]
++++++++public+static+extern+Boolean+CryptMsgGetParam(
++++++++++++IntPtr+hCryptMsg,
++++++++++++int+dwParamType,
++++++++++++int+dwIndex,
++++++++++++[In,+Out]+byte[]+vData,
++++++++++++ref+int+pcbData
++++++++);

++++++++[DllImport("crypt32.dll",+CharSet+=+CharSet.Auto,+SetLastError+=+true)]
++++++++[return:+MarshalAs(UnmanagedType.Bool)]
++++++++public+static+extern+bool+CryptDecodeObject(
++++++++++uint+CertEncodingType,
++++++++++UIntPtr+lpszStructType,
++++++++++byte[]+pbEncoded,
++++++++++uint+cbEncoded,
++++++++++uint+flags,
++++++++++[In,+Out]+byte[]+pvStructInfo,
++++++++++ref+uint+cbStructInfo);


++++++++public+const+int+CRYPT_ASN_ENCODING+=+0x00000001;
++++++++public+const+int+CRYPT_NDR_ENCODING+=+0x00000002;
++++++++public+const+int+X509_ASN_ENCODING+=+0x00000001;
++++++++public+const+int+X509_NDR_ENCODING+=+0x00000002;
++++++++public+const+int+PKCS_7_ASN_ENCODING+=+0x00010000;
++++++++public+const+int+PKCS_7_NDR_ENCODING+=+0x00020000;

++++++++public+static+UIntPtr+PKCS7_SIGNER_INFO+=+new+UIntPtr(500);
++++++++public+static+UIntPtr+CMS_SIGNER_INFO+=+new+UIntPtr(501);

++++++++public+static+string+szOID_RSA_signingTime+=+"1.2.840.113549.1.9.5";
++++++++public+static+string+szOID_RSA_counterSign+=+"1.2.840.113549.1.9.6";

++++++++//%2B-------------------------------------------------------------------------
++++++++//++Get+parameter+types+and+their+corresponding+data+structure+definitions.
++++++++//--------------------------------------------------------------------------
++++++++public+const+int+CMSG_TYPE_PARAM+=+1;
++++++++public+const+int+CMSG_CONTENT_PARAM+=+2;
++++++++public+const+int+CMSG_BARE_CONTENT_PARAM+=+3;
++++++++public+const+int+CMSG_INNER_CONTENT_TYPE_PARAM+=+4;
++++++++public+const+int+CMSG_SIGNER_COUNT_PARAM+=+5;
++++++++public+const+int+CMSG_SIGNER_INFO_PARAM+=+6;
++++++++public+const+int+CMSG_SIGNER_CERT_INFO_PARAM+=+7;
++++++++public+const+int+CMSG_SIGNER_HASH_ALGORITHM_PARAM+=+8;
++++++++public+const+int+CMSG_SIGNER_AUTH_ATTR_PARAM+=+9;
++++++++public+const+int+CMSG_SIGNER_UNAUTH_ATTR_PARAM+=+10;
++++++++public+const+int+CMSG_CERT_COUNT_PARAM+=+11;
++++++++public+const+int+CMSG_CERT_PARAM+=+12;
++++++++public+const+int+CMSG_CRL_COUNT_PARAM+=+13;
++++++++public+const+int+CMSG_CRL_PARAM+=+14;
++++++++public+const+int+CMSG_ENVELOPE_ALGORITHM_PARAM+=+15;
++++++++public+const+int+CMSG_RECIPIENT_COUNT_PARAM+=+17;
++++++++public+const+int+CMSG_RECIPIENT_INDEX_PARAM+=+18;
++++++++public+const+int+CMSG_RECIPIENT_INFO_PARAM+=+19;
++++++++public+const+int+CMSG_HASH_ALGORITHM_PARAM+=+20;
++++++++public+const+int+CMSG_HASH_DATA_PARAM+=+21;
++++++++public+const+int+CMSG_COMPUTED_HASH_PARAM+=+22;
++++++++public+const+int+CMSG_ENCRYPT_PARAM+=+26;
++++++++public+const+int+CMSG_ENCRYPTED_DIGEST+=+27;
++++++++public+const+int+CMSG_ENCODED_SIGNER+=+28;
++++++++public+const+int+CMSG_ENCODED_MESSAGE+=+29;
++++++++public+const+int+CMSG_VERSION_PARAM+=+30;
++++++++public+const+int+CMSG_ATTR_CERT_COUNT_PARAM+=+31;
++++++++public+const+int+CMSG_ATTR_CERT_PARAM+=+32;
++++++++public+const+int+CMSG_CMS_RECIPIENT_COUNT_PARAM+=+33;
++++++++public+const+int+CMSG_CMS_RECIPIENT_INDEX_PARAM+=+34;
++++++++public+const+int+CMSG_CMS_RECIPIENT_ENCRYPTED_KEY_INDEX_PARAM+=+35;
++++++++public+const+int+CMSG_CMS_RECIPIENT_INFO_PARAM+=+36;
++++++++public+const+int+CMSG_UNPROTECTED_ATTR_PARAM+=+37;
++++++++public+const+int+CMSG_SIGNER_CERT_ID_PARAM+=+38;
++++++++public+const+int+CMSG_CMS_SIGNER_INFO_PARAM+=+39;


++++++++//-------------------------------------------------------------------------
++++++++//dwObjectType+for+CryptQueryObject
++++++++//-------------------------------------------------------------------------
++++++++public+const+int+CERT_QUERY_OBJECT_FILE+=+0x00000001;
++++++++public+const+int+CERT_QUERY_OBJECT_BLOB+=+0x00000002;

++++++++//-------------------------------------------------------------------------
++++++++//dwContentType+for+CryptQueryObject
++++++++//-------------------------------------------------------------------------
++++++++//encoded+single+certificate
++++++++public+const+int+CERT_QUERY_CONTENT_CERT+=+1;
++++++++//encoded+single+CTL
++++++++public+const+int+CERT_QUERY_CONTENT_CTL+=+2;
++++++++//encoded+single+CRL
++++++++public+const+int+CERT_QUERY_CONTENT_CRL+=+3;
++++++++//serialized+store
++++++++public+const+int+CERT_QUERY_CONTENT_SERIALIZED_STORE+=+4;
++++++++//serialized+single+certificate
++++++++public+const+int+CERT_QUERY_CONTENT_SERIALIZED_CERT+=+5;
++++++++//serialized+single+CTL
++++++++public+const+int+CERT_QUERY_CONTENT_SERIALIZED_CTL+=+6;
++++++++//serialized+single+CRL
++++++++public+const+int+CERT_QUERY_CONTENT_SERIALIZED_CRL+=+7;
++++++++//a+PKCS#7+signed+message
++++++++public+const+int+CERT_QUERY_CONTENT_PKCS7_SIGNED+=+8;
++++++++//a+PKCS#7+message,+such+as+enveloped+message.++But+it+is+not+a+signed+message,
++++++++public+const+int+CERT_QUERY_CONTENT_PKCS7_UNSIGNED+=+9;
++++++++//a+PKCS7+signed+message+embedded+in+a+file
++++++++public+const+int+CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED+=+10;
++++++++//an+encoded+PKCS#10
++++++++public+const+int+CERT_QUERY_CONTENT_PKCS10+=+11;
++++++++//an+encoded+PKX+BLOB
++++++++public+const+int+CERT_QUERY_CONTENT_PFX+=+12;
++++++++//an+encoded+CertificatePair+(contains+forward+and/or+reverse+cross+certs)
++++++++public+const+int+CERT_QUERY_CONTENT_CERT_PAIR+=+13;

++++++++//-------------------------------------------------------------------------
++++++++//dwExpectedConentTypeFlags+for+CryptQueryObject
++++++++//-------------------------------------------------------------------------
++++++++//encoded+single+certificate
++++++++public+const+int+CERT_QUERY_CONTENT_FLAG_CERT+=+(1+<<+CERT_QUERY_CONTENT_CERT);

++++++++//encoded+single+CTL
++++++++public+const+int+CERT_QUERY_CONTENT_FLAG_CTL+=+(1+<<+CERT_QUERY_CONTENT_CTL);

++++++++//encoded+single+CRL
++++++++public+const+int+CERT_QUERY_CONTENT_FLAG_CRL+=+(1+<<+CERT_QUERY_CONTENT_CRL);

++++++++//serialized+store
++++++++public+const+int+CERT_QUERY_CONTENT_FLAG_SERIALIZED_STORE+=+(1+<<+CERT_QUERY_CONTENT_SERIALIZED_STORE);

++++++++//serialized+single+certificate
++++++++public+const+int+CERT_QUERY_CONTENT_FLAG_SERIALIZED_CERT+=+(1+<<+CERT_QUERY_CONTENT_SERIALIZED_CERT);

++++++++//serialized+single+CTL
++++++++public+const+int+CERT_QUERY_CONTENT_FLAG_SERIALIZED_CTL+=+(1+<<+CERT_QUERY_CONTENT_SERIALIZED_CTL);

++++++++//serialized+single+CRL
++++++++public+const+int+CERT_QUERY_CONTENT_FLAG_SERIALIZED_CRL+=+(1+<<+CERT_QUERY_CONTENT_SERIALIZED_CRL);

++++++++//an+encoded+PKCS#7+signed+message
++++++++public+const+int+CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED+=+(1+<<+CERT_QUERY_CONTENT_PKCS7_SIGNED);

++++++++//an+encoded+PKCS#7+message.++But+it+is+not+a+signed+message
++++++++public+const+int+CERT_QUERY_CONTENT_FLAG_PKCS7_UNSIGNED+=+(1+<<+CERT_QUERY_CONTENT_PKCS7_UNSIGNED);

++++++++//the+content+includes+an+embedded+PKCS7+signed+message
++++++++public+const+int+CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED+=+(1+<<+CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED);

++++++++//an+encoded+PKCS#10
++++++++public+const+int+CERT_QUERY_CONTENT_FLAG_PKCS10+=+(1+<<+CERT_QUERY_CONTENT_PKCS10);

++++++++//an+encoded+PFX+BLOB
++++++++public+const+int+CERT_QUERY_CONTENT_FLAG_PFX+=+(1+<<+CERT_QUERY_CONTENT_PFX);

++++++++//an+encoded+CertificatePair+(contains+forward+and/or+reverse+cross+certs)
++++++++public+const+int+CERT_QUERY_CONTENT_FLAG_CERT_PAIR+=+(1+<<+CERT_QUERY_CONTENT_CERT_PAIR);

++++++++//content+can+be+any+type
++++++++public+const+int+CERT_QUERY_CONTENT_FLAG_ALL+=
++++++++++++CERT_QUERY_CONTENT_FLAG_CERT+%7C
++++++++++++CERT_QUERY_CONTENT_FLAG_CTL+%7C
++++++++++++CERT_QUERY_CONTENT_FLAG_CRL+%7C
++++++++++++CERT_QUERY_CONTENT_FLAG_SERIALIZED_STORE+%7C
++++++++++++CERT_QUERY_CONTENT_FLAG_SERIALIZED_CERT+%7C
++++++++++++CERT_QUERY_CONTENT_FLAG_SERIALIZED_CTL+%7C
++++++++++++CERT_QUERY_CONTENT_FLAG_SERIALIZED_CRL+%7C
++++++++++++CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED+%7C
++++++++++++CERT_QUERY_CONTENT_FLAG_PKCS7_UNSIGNED+%7C
++++++++++++CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED+%7C
++++++++++++CERT_QUERY_CONTENT_FLAG_PKCS10+%7C
++++++++++++CERT_QUERY_CONTENT_FLAG_PFX+%7C
++++++++++++CERT_QUERY_CONTENT_FLAG_CERT_PAIR;

++++++++//-------------------------------------------------------------------------
++++++++//dwFormatType+for+CryptQueryObject
++++++++//-------------------------------------------------------------------------
++++++++//the+content+is+in+binary+format
++++++++public+const+int+CERT_QUERY_FORMAT_BINARY+=+1;

++++++++//the+content+is+base64+encoded
++++++++public+const+int+CERT_QUERY_FORMAT_BASE64_ENCODED+=+2;

++++++++//the+content+is+ascii+hex+encoded+with+"{ASN}"+prefix
++++++++public+const+int+CERT_QUERY_FORMAT_ASN_ASCII_HEX_ENCODED+=+3;

++++++++//-------------------------------------------------------------------------
++++++++//dwExpectedFormatTypeFlags+for+CryptQueryObject
++++++++//-------------------------------------------------------------------------
++++++++//the+content+is+in+binary+format
++++++++public+const+int+CERT_QUERY_FORMAT_FLAG_BINARY+=+(1+<<+CERT_QUERY_FORMAT_BINARY);

++++++++//the+content+is+base64+encoded
++++++++public+const+int+CERT_QUERY_FORMAT_FLAG_BASE64_ENCODED+=+(1+<<+CERT_QUERY_FORMAT_BASE64_ENCODED);

++++++++//the+content+is+ascii+hex+encoded+with+"{ASN}"+prefix
++++++++public+const+int+CERT_QUERY_FORMAT_FLAG_ASN_ASCII_HEX_ENCODED+=+(1+<<+CERT_QUERY_FORMAT_ASN_ASCII_HEX_ENCODED);

++++++++//the+content+can+be+of+any+format
++++++++public+const+int+CERT_QUERY_FORMAT_FLAG_ALL+=
++++++++++++CERT_QUERY_FORMAT_FLAG_BINARY+%7C
++++++++++++CERT_QUERY_FORMAT_FLAG_BASE64_ENCODED+%7C
++++++++++++CERT_QUERY_FORMAT_FLAG_ASN_ASCII_HEX_ENCODED;

++++}
}|3033129|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

Back to the original question, I could not find managed way so ended up using pInvoke as follows:

<pre><code>public static bool IsTimestamped(string filename)
{
 try
 {
 int encodingType;
 int contentType;
 int formatType;
 IntPtr certStore = IntPtr.Zero;
 IntPtr cryptMsg = IntPtr.Zero;
 IntPtr context = IntPtr.Zero;

 if (!WinCrypt.CryptQueryObject(
 WinCrypt.CERT_QUERY_OBJECT_FILE,
 Marshal.StringToHGlobalUni(filename),
 WinCrypt.CERT_QUERY_CONTENT_FLAG_ALL,
 WinCrypt.CERT_QUERY_FORMAT_FLAG_ALL,
 0,
 out encodingType,
 out contentType,
 out formatType,
 ref certStore,
 ref cryptMsg,
 ref context))
 {
 throw new Win32Exception(Marshal.GetLastWin32Error());
 }

 //expecting contentType=10; CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED 
 //Logger.LogInfo(string.Format("Querying file '{0}':", filename));
 //Logger.LogInfo(string.Format(" Encoding Type: {0}", encodingType));
 //Logger.LogInfo(string.Format(" Content Type: {0}", contentType));
 //Logger.LogInfo(string.Format(" Format Type: {0}", formatType));
 //Logger.LogInfo(string.Format(" Cert Store: {0}", certStore.ToInt32()));
 //Logger.LogInfo(string.Format(" Crypt Msg: {0}", cryptMsg.ToInt32()));
 //Logger.LogInfo(string.Format(" Context: {0}", context.ToInt32()));


 // Get size of the encoded message.
 int cbData = 0;
 if (!WinCrypt.CryptMsgGetParam(
 cryptMsg,
 WinCrypt.CMSG_ENCODED_MESSAGE,//Crypt32.CMSG_SIGNER_INFO_PARAM,
 0,
 IntPtr.Zero,
 ref cbData))
 {
 throw new Win32Exception(Marshal.GetLastWin32Error());
 }

 var vData = new byte[cbData];

 // Get the encoded message.
 if (!WinCrypt.CryptMsgGetParam(
 cryptMsg,
 WinCrypt.CMSG_ENCODED_MESSAGE,//Crypt32.CMSG_SIGNER_INFO_PARAM,
 0,
 vData,
 ref cbData))
 {
 throw new Win32Exception(Marshal.GetLastWin32Error());
 }

 var signedCms = new SignedCms();
 signedCms.Decode(vData);

 foreach (var signerInfo in signedCms.SignerInfos)
 {
 foreach (var unsignedAttribute in signerInfo.UnsignedAttributes)
 {
 if (unsignedAttribute.Oid.Value == WinCrypt.szOID_RSA_counterSign)
 {
 //Note at this point we assume this counter signature is the timestamp
 //refer to http://support.microsoft.com/kb/323809 for the origins

 //TODO: extract timestamp value, if required
 return true;
 }

 }
 }
 }
 catch (Exception)
 {
 // no logging
 }

 return false;
}
</code></pre>

and the WinCrypt.cs contains the following:

<pre><code>using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;

namespace MyNamespace.Win32
{
 static class WinCrypt
 {
 [StructLayout(LayoutKind.Sequential)]
 public struct BLOB
 {
 public int cbData;
 public IntPtr pbData;
 }

 [StructLayout(LayoutKind.Sequential)]
 public struct CRYPT_ALGORITHM_IDENTIFIER
 {
 public String pszObjId;
 BLOB Parameters;
 }

 [StructLayout(LayoutKind.Sequential)]
 public struct CERT_ID
 {
 public int dwIdChoice;
 public BLOB IssuerSerialNumberOrKeyIdOrHashId;
 }

 [StructLayoutAttribute(LayoutKind.Sequential)]
 public struct SIGNER_SUBJECT_INFO
 {
 /// DWORD-&gt;unsigned int
 public uint cbSize;

 /// DWORD*
 public System.IntPtr pdwIndex;

 /// DWORD-&gt;unsigned int
 public uint dwSubjectChoice;

 /// SubjectChoiceUnion
 public SubjectChoiceUnion Union1;
 }

 [StructLayoutAttribute(LayoutKind.Explicit)]
 public struct SubjectChoiceUnion
 {

 /// SIGNER_FILE_INFO*
 [FieldOffsetAttribute(0)]
 public System.IntPtr pSignerFileInfo;

 /// SIGNER_BLOB_INFO*
 [FieldOffsetAttribute(0)]
 public System.IntPtr pSignerBlobInfo;
 }

 [StructLayout(LayoutKind.Sequential)]
 public struct CERT_NAME_BLOB
 {
 public uint cbData;
 [MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 0)]
 public byte[] pbData;
 }

 [StructLayout(LayoutKind.Sequential)]
 public struct CRYPT_INTEGER_BLOB
 {
 public UInt32 cbData;
 public IntPtr pbData;
 }

 [StructLayout(LayoutKind.Sequential)]
 public struct CRYPT_ATTR_BLOB
 {
 public uint cbData;
 [MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 0)]
 public byte[] pbData;
 }

 [StructLayout(LayoutKind.Sequential)]
 public struct CRYPT_ATTRIBUTE
 {
 [MarshalAs(UnmanagedType.LPStr)]
 public string pszObjId;
 public uint cValue;
 [MarshalAs(UnmanagedType.LPStruct)]
 public CRYPT_ATTR_BLOB rgValue;
 }

 [StructLayout(LayoutKind.Sequential)]
 public struct CMSG_SIGNER_INFO
 {
 public int dwVersion;
 private CERT_NAME_BLOB Issuer;
 CRYPT_INTEGER_BLOB SerialNumber;
 CRYPT_ALGORITHM_IDENTIFIER HashAlgorithm;
 CRYPT_ALGORITHM_IDENTIFIER HashEncryptionAlgorithm;
 BLOB EncryptedHash;
 CRYPT_ATTRIBUTE[] AuthAttrs;
 CRYPT_ATTRIBUTE[] UnauthAttrs;
 }

 [DllImport("crypt32.dll", CharSet = CharSet.Auto, SetLastError = true)]
 public static extern Boolean CryptQueryObject(
 int dwObjectType,
 IntPtr pvObject,
 int dwExpectedContentTypeFlags,
 int dwExpectedFormatTypeFlags,
 int dwFlags,
 out int pdwMsgAndCertEncodingType,
 out int pdwContentType,
 out int pdwFormatType,
 ref IntPtr phCertStore,
 ref IntPtr phMsg,
 ref IntPtr ppvContext);


 [DllImport("crypt32.dll", CharSet = CharSet.Auto, SetLastError = true)]
 public static extern Boolean CryptMsgGetParam(
 IntPtr hCryptMsg,
 int dwParamType,
 int dwIndex,
 IntPtr pvData,
 ref int pcbData
 );

 [DllImport("crypt32.dll", CharSet = CharSet.Auto, SetLastError = true)]
 public static extern Boolean CryptMsgGetParam(
 IntPtr hCryptMsg,
 int dwParamType,
 int dwIndex,
 [In, Out] byte[] vData,
 ref int pcbData
 );

 [DllImport("crypt32.dll", CharSet = CharSet.Auto, SetLastError = true)]
 [return: MarshalAs(UnmanagedType.Bool)]
 public static extern bool CryptDecodeObject(
 uint CertEncodingType,
 UIntPtr lpszStructType,
 byte[] pbEncoded,
 uint cbEncoded,
 uint flags,
 [In, Out] byte[] pvStructInfo,
 ref uint cbStructInfo);


 public const int CRYPT_ASN_ENCODING = 0x00000001;
 public const int CRYPT_NDR_ENCODING = 0x00000002;
 public const int X509_ASN_ENCODING = 0x00000001;
 public const int X509_NDR_ENCODING = 0x00000002;
 public const int PKCS_7_ASN_ENCODING = 0x00010000;
 public const int PKCS_7_NDR_ENCODING = 0x00020000;

 public static UIntPtr PKCS7_SIGNER_INFO = new UIntPtr(500);
 public static UIntPtr CMS_SIGNER_INFO = new UIntPtr(501);

 public static string szOID_RSA_signingTime = "1.2.840.113549.1.9.5";
 public static string szOID_RSA_counterSign = "1.2.840.113549.1.9.6";

 //+-------------------------------------------------------------------------
 // Get parameter types and their corresponding data structure definitions.
 //--------------------------------------------------------------------------
 public const int CMSG_TYPE_PARAM = 1;
 public const int CMSG_CONTENT_PARAM = 2;
 public const int CMSG_BARE_CONTENT_PARAM = 3;
 public const int CMSG_INNER_CONTENT_TYPE_PARAM = 4;
 public const int CMSG_SIGNER_COUNT_PARAM = 5;
 public const int CMSG_SIGNER_INFO_PARAM = 6;
 public const int CMSG_SIGNER_CERT_INFO_PARAM = 7;
 public const int CMSG_SIGNER_HASH_ALGORITHM_PARAM = 8;
 public const int CMSG_SIGNER_AUTH_ATTR_PARAM = 9;
 public const int CMSG_SIGNER_UNAUTH_ATTR_PARAM = 10;
 public const int CMSG_CERT_COUNT_PARAM = 11;
 public const int CMSG_CERT_PARAM = 12;
 public const int CMSG_CRL_COUNT_PARAM = 13;
 public const int CMSG_CRL_PARAM = 14;
 public const int CMSG_ENVELOPE_ALGORITHM_PARAM = 15;
 public const int CMSG_RECIPIENT_COUNT_PARAM = 17;
 public const int CMSG_RECIPIENT_INDEX_PARAM = 18;
 public const int CMSG_RECIPIENT_INFO_PARAM = 19;
 public const int CMSG_HASH_ALGORITHM_PARAM = 20;
 public const int CMSG_HASH_DATA_PARAM = 21;
 public const int CMSG_COMPUTED_HASH_PARAM = 22;
 public const int CMSG_ENCRYPT_PARAM = 26;
 public const int CMSG_ENCRYPTED_DIGEST = 27;
 public const int CMSG_ENCODED_SIGNER = 28;
 public const int CMSG_ENCODED_MESSAGE = 29;
 public const int CMSG_VERSION_PARAM = 30;
 public const int CMSG_ATTR_CERT_COUNT_PARAM = 31;
 public const int CMSG_ATTR_CERT_PARAM = 32;
 public const int CMSG_CMS_RECIPIENT_COUNT_PARAM = 33;
 public const int CMSG_CMS_RECIPIENT_INDEX_PARAM = 34;
 public const int CMSG_CMS_RECIPIENT_ENCRYPTED_KEY_INDEX_PARAM = 35;
 public const int CMSG_CMS_RECIPIENT_INFO_PARAM = 36;
 public const int CMSG_UNPROTECTED_ATTR_PARAM = 37;
 public const int CMSG_SIGNER_CERT_ID_PARAM = 38;
 public const int CMSG_CMS_SIGNER_INFO_PARAM = 39;


 //-------------------------------------------------------------------------
 //dwObjectType for CryptQueryObject
 //-------------------------------------------------------------------------
 public const int CERT_QUERY_OBJECT_FILE = 0x00000001;
 public const int CERT_QUERY_OBJECT_BLOB = 0x00000002;

 //-------------------------------------------------------------------------
 //dwContentType for CryptQueryObject
 //-------------------------------------------------------------------------
 //encoded single certificate
 public const int CERT_QUERY_CONTENT_CERT = 1;
 //encoded single CTL
 public const int CERT_QUERY_CONTENT_CTL = 2;
 //encoded single CRL
 public const int CERT_QUERY_CONTENT_CRL = 3;
 //serialized store
 public const int CERT_QUERY_CONTENT_SERIALIZED_STORE = 4;
 //serialized single certificate
 public const int CERT_QUERY_CONTENT_SERIALIZED_CERT = 5;
 //serialized single CTL
 public const int CERT_QUERY_CONTENT_SERIALIZED_CTL = 6;
 //serialized single CRL
 public const int CERT_QUERY_CONTENT_SERIALIZED_CRL = 7;
 //a PKCS#7 signed message
 public const int CERT_QUERY_CONTENT_PKCS7_SIGNED = 8;
 //a PKCS#7 message, such as enveloped message. But it is not a signed message,
 public const int CERT_QUERY_CONTENT_PKCS7_UNSIGNED = 9;
 //a PKCS7 signed message embedded in a file
 public const int CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED = 10;
 //an encoded PKCS#10
 public const int CERT_QUERY_CONTENT_PKCS10 = 11;
 //an encoded PKX BLOB
 public const int CERT_QUERY_CONTENT_PFX = 12;
 //an encoded CertificatePair (contains forward and/or reverse cross certs)
 public const int CERT_QUERY_CONTENT_CERT_PAIR = 13;

 //-------------------------------------------------------------------------
 //dwExpectedConentTypeFlags for CryptQueryObject
 //-------------------------------------------------------------------------
 //encoded single certificate
 public const int CERT_QUERY_CONTENT_FLAG_CERT = (1 &lt;&lt; CERT_QUERY_CONTENT_CERT);

 //encoded single CTL
 public const int CERT_QUERY_CONTENT_FLAG_CTL = (1 &lt;&lt; CERT_QUERY_CONTENT_CTL);

 //encoded single CRL
 public const int CERT_QUERY_CONTENT_FLAG_CRL = (1 &lt;&lt; CERT_QUERY_CONTENT_CRL);

 //serialized store
 public const int CERT_QUERY_CONTENT_FLAG_SERIALIZED_STORE = (1 &lt;&lt; CERT_QUERY_CONTENT_SERIALIZED_STORE);

 //serialized single certificate
 public const int CERT_QUERY_CONTENT_FLAG_SERIALIZED_CERT = (1 &lt;&lt; CERT_QUERY_CONTENT_SERIALIZED_CERT);

 //serialized single CTL
 public const int CERT_QUERY_CONTENT_FLAG_SERIALIZED_CTL = (1 &lt;&lt; CERT_QUERY_CONTENT_SERIALIZED_CTL);

 //serialized single CRL
 public const int CERT_QUERY_CONTENT_FLAG_SERIALIZED_CRL = (1 &lt;&lt; CERT_QUERY_CONTENT_SERIALIZED_CRL);

 //an encoded PKCS#7 signed message
 public const int CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED = (1 &lt;&lt; CERT_QUERY_CONTENT_PKCS7_SIGNED);

 //an encoded PKCS#7 message. But it is not a signed message
 public const int CERT_QUERY_CONTENT_FLAG_PKCS7_UNSIGNED = (1 &lt;&lt; CERT_QUERY_CONTENT_PKCS7_UNSIGNED);

 //the content includes an embedded PKCS7 signed message
 public const int CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED = (1 &lt;&lt; CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED);

 //an encoded PKCS#10
 public const int CERT_QUERY_CONTENT_FLAG_PKCS10 = (1 &lt;&lt; CERT_QUERY_CONTENT_PKCS10);

 //an encoded PFX BLOB
 public const int CERT_QUERY_CONTENT_FLAG_PFX = (1 &lt;&lt; CERT_QUERY_CONTENT_PFX);

 //an encoded CertificatePair (contains forward and/or reverse cross certs)
 public const int CERT_QUERY_CONTENT_FLAG_CERT_PAIR = (1 &lt;&lt; CERT_QUERY_CONTENT_CERT_PAIR);

 //content can be any type
 public const int CERT_QUERY_CONTENT_FLAG_ALL =
 CERT_QUERY_CONTENT_FLAG_CERT |
 CERT_QUERY_CONTENT_FLAG_CTL |
 CERT_QUERY_CONTENT_FLAG_CRL |
 CERT_QUERY_CONTENT_FLAG_SERIALIZED_STORE |
 CERT_QUERY_CONTENT_FLAG_SERIALIZED_CERT |
 CERT_QUERY_CONTENT_FLAG_SERIALIZED_CTL |
 CERT_QUERY_CONTENT_FLAG_SERIALIZED_CRL |
 CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED |
 CERT_QUERY_CONTENT_FLAG_PKCS7_UNSIGNED |
 CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED |
 CERT_QUERY_CONTENT_FLAG_PKCS10 |
 CERT_QUERY_CONTENT_FLAG_PFX |
 CERT_QUERY_CONTENT_FLAG_CERT_PAIR;

 //-------------------------------------------------------------------------
 //dwFormatType for CryptQueryObject
 //-------------------------------------------------------------------------
 //the content is in binary format
 public const int CERT_QUERY_FORMAT_BINARY = 1;

 //the content is base64 encoded
 public const int CERT_QUERY_FORMAT_BASE64_ENCODED = 2;

 //the content is ascii hex encoded with "{ASN}" prefix
 public const int CERT_QUERY_FORMAT_ASN_ASCII_HEX_ENCODED = 3;

 //-------------------------------------------------------------------------
 //dwExpectedFormatTypeFlags for CryptQueryObject
 //-------------------------------------------------------------------------
 //the content is in binary format
 public const int CERT_QUERY_FORMAT_FLAG_BINARY = (1 &lt;&lt; CERT_QUERY_FORMAT_BINARY);

 //the content is base64 encoded
 public const int CERT_QUERY_FORMAT_FLAG_BASE64_ENCODED = (1 &lt;&lt; CERT_QUERY_FORMAT_BASE64_ENCODED);

 //the content is ascii hex encoded with "{ASN}" prefix
 public const int CERT_QUERY_FORMAT_FLAG_ASN_ASCII_HEX_ENCODED = (1 &lt;&lt; CERT_QUERY_FORMAT_ASN_ASCII_HEX_ENCODED);

 //the content can be of any format
 public const int CERT_QUERY_FORMAT_FLAG_ALL =
 CERT_QUERY_FORMAT_FLAG_BINARY |
 CERT_QUERY_FORMAT_FLAG_BASE64_ENCODED |
 CERT_QUERY_FORMAT_FLAG_ASN_ASCII_HEX_ENCODED;

 }
}
</code></pre>

blocks|key|3247180|text|感谢行动组所做的工作。我添加了实现来获取证书的实际TimeStamp。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3247181|foreach+(var+signerInfo+in+signedCms.SignerInfos)
++++++++++++{
++++++++++++++++foreach+(var+unsignedAttribute+in+signerInfo.UnsignedAttributes)
++++++++++++++++{
++++++++++++++++++++if+(unsignedAttribute.Oid.Value+==+WinCrypt.szOID_RSA_counterSign)
++++++++++++++++++++{
++++++++++++++++++++++++foreach+(var+counterSignInfo+in+signerInfo.CounterSignerInfos)
++++++++++++++++++++++++{
++++++++++++++++++++++++++++foreach+(var+signedAttribute+in+counterSignInfo.SignedAttributes)
++++++++++++++++++++++++++++{
++++++++++++++++++++++++++++++++if+(signedAttribute.Oid.Value+==+WinCrypt.szOID_RSA_signingTime)
++++++++++++++++++++++++++++++++{++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++System.Runtime.InteropServices.ComTypes.FILETIME+fileTime+=+new+System.Runtime.InteropServices.ComTypes.FILETIME();
++++++++++++++++++++++++++++++++++++int+fileTimeSize+=+Marshal.SizeOf(fileTime);
++++++++++++++++++++++++++++++++++++IntPtr+fileTimePtr+=+Marshal.AllocCoTaskMem(fileTimeSize);
++++++++++++++++++++++++++++++++++++Marshal.StructureToPtr(fileTime,+fileTimePtr,+true);

++++++++++++++++++++++++++++++++++++byte[]+buffdata+=+new+byte[fileTimeSize];
++++++++++++++++++++++++++++++++++++Marshal.Copy(fileTimePtr,+buffdata,+0,+fileTimeSize);

++++++++++++++++++++++++++++++++++++uint+buffSize+=+(uint)buffdata.Length;

++++++++++++++++++++++++++++++++++++uint+encoding+=+WinCrypt.X509_ASN_ENCODING+%7C+WinCrypt.PKCS_7_ASN_ENCODING;

++++++++++++++++++++++++++++++++++++UIntPtr+rsaSigningTime+=+(UIntPtr)(uint)Marshal.StringToHGlobalAnsi(WinCrypt.szOID_RSA_signingTime);

++++++++++++++++++++++++++++++++++++byte[]+pbData+=+signedAttribute.Values[0].RawData;+++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++uint+ucbData+=+(uint)pbData.Length;

++++++++++++++++++++++++++++++++++++bool+workie+=+WinCrypt.CryptDecodeObject(encoding,+rsaSigningTime.ToUInt32(),+pbData,+ucbData,+0,+buffdata,+ref+buffSize);

++++++++++++++++++++++++++++++++++++if+(workie)
++++++++++++++++++++++++++++++++++++{
++++++++++++++++++++++++++++++++++++++++IntPtr+fileTimePtr2+=+Marshal.AllocCoTaskMem(buffdata.Length);
++++++++++++++++++++++++++++++++++++++++Marshal.Copy(buffdata,+0,+fileTimePtr2,+buffdata.Length);
++++++++++++++++++++++++++++++++++++++++System.Runtime.InteropServices.ComTypes.FILETIME+fileTime2+=+(System.Runtime.InteropServices.ComTypes.FILETIME)Marshal.PtrToStructure(fileTimePtr2,+typeof(System.Runtime.InteropServices.ComTypes.FILETIME));

++++++++++++++++++++++++++++++++++++++++long+hFT2+=+(((long)fileTime2.dwHighDateTime)+<<+32)+%2B+((uint)fileTime2.dwLowDateTime);

++++++++++++++++++++++++++++++++++++++++DateTime+dte+=+DateTime.FromFileTime(hFT2);
++++++++++++++++++++++++++++++++++++++++Console.WriteLine(dte.ToString());
++++++++++++++++++++++++++++++++++++}
++++++++++++++++++++++++++++++++++++else
++++++++++++++++++++++++++++++++++++{
++++++++++++++++++++++++++++++++++++++++throw+new+Win32Exception(Marshal.GetLastWin32Error());++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++}

++++++++++++++++++++++++++++++++}++++
++++++++++++++++++++++++++++}

++++++++++++++++++++++++}++++++++++++++++++++++++++++

++++++++++++++++++++++++return+true;
++++++++++++++++++++}

++++++++++++++++}
++++++++++++}|code-block|syntax|javascript|3247182|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Thanks to the OP for your work. I added the implementation to get the actual TimeStamp of the cert.

<pre><code>foreach (var signerInfo in signedCms.SignerInfos)
 {
 foreach (var unsignedAttribute in signerInfo.UnsignedAttributes)
 {
 if (unsignedAttribute.Oid.Value == WinCrypt.szOID_RSA_counterSign)
 {
 foreach (var counterSignInfo in signerInfo.CounterSignerInfos)
 {
 foreach (var signedAttribute in counterSignInfo.SignedAttributes)
 {
 if (signedAttribute.Oid.Value == WinCrypt.szOID_RSA_signingTime)
 { 
 System.Runtime.InteropServices.ComTypes.FILETIME fileTime = new System.Runtime.InteropServices.ComTypes.FILETIME();
 int fileTimeSize = Marshal.SizeOf(fileTime);
 IntPtr fileTimePtr = Marshal.AllocCoTaskMem(fileTimeSize);
 Marshal.StructureToPtr(fileTime, fileTimePtr, true);

 byte[] buffdata = new byte[fileTimeSize];
 Marshal.Copy(fileTimePtr, buffdata, 0, fileTimeSize);

 uint buffSize = (uint)buffdata.Length;

 uint encoding = WinCrypt.X509_ASN_ENCODING | WinCrypt.PKCS_7_ASN_ENCODING;

 UIntPtr rsaSigningTime = (UIntPtr)(uint)Marshal.StringToHGlobalAnsi(WinCrypt.szOID_RSA_signingTime);

 byte[] pbData = signedAttribute.Values[0].RawData; 
 uint ucbData = (uint)pbData.Length;

 bool workie = WinCrypt.CryptDecodeObject(encoding, rsaSigningTime.ToUInt32(), pbData, ucbData, 0, buffdata, ref buffSize);

 if (workie)
 {
 IntPtr fileTimePtr2 = Marshal.AllocCoTaskMem(buffdata.Length);
 Marshal.Copy(buffdata, 0, fileTimePtr2, buffdata.Length);
 System.Runtime.InteropServices.ComTypes.FILETIME fileTime2 = (System.Runtime.InteropServices.ComTypes.FILETIME)Marshal.PtrToStructure(fileTimePtr2, typeof(System.Runtime.InteropServices.ComTypes.FILETIME));

 long hFT2 = (((long)fileTime2.dwHighDateTime) &lt;&lt; 32) + ((uint)fileTime2.dwLowDateTime);

 DateTime dte = DateTime.FromFileTime(hFT2);
 Console.WriteLine(dte.ToString());
 }
 else
 {
 throw new Win32Exception(Marshal.GetLastWin32Error()); 
 }

 } 
 }

 } 

 return true;
 }

 }
 }
</code></pre>

blocks|key|303088|text|谢谢你们|type|unstyled|depth|inlineStyleRanges|entityRanges|data|303089|您帮了我很多:)|303090|顺便说一下:我找到了获取时间戳的更简单的方法。|303091|这就是它：|303092|foreach+(var+signerInfo+in+signedCms.SignerInfos)
{
++foreach+(var+unsignedAttribute+in+signerInfo.UnsignedAttributes)
++{
++++if+(unsignedAttribute.Oid.Value+==+WinCrypt.szOID_RSA_counterSign)
++++{
++++++foreach+(var+counterSignInfo+in+signerInfo.CounterSignerInfos)
++++++{
++++++++foreach+(var+signedAttribute+in+counterSignInfo.SignedAttributes)
++++++++{
++++++++++if+(signedAttribute.Oid.Value+==+WinCrypt.szOID_RSA_signingTime)
++++++++++{
++++++++++++Pkcs9SigningTime+signingTime+=+(Pkcs9SigningTime)signedAttribute.Values[0];
++++++++++++Console.Out.WriteLine("Signing+Time+UTC:+"+%2B+signingTime.SigningTime);
++++++++++}
++++++++}
++++++}
++++++return+true;
++++}
++}
}|code-block|syntax|javascript|303093|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|Q|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|R|8|@]|9|@]|A|$]]|$1|H|3|I|5|J|7|S|8|@]|9|@]|A|$K|L]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

Thank you guys,

You help me a lot :)

BTW: I found simpler way how to obtain the time stamp.

here it is:

<pre><code>foreach (var signerInfo in signedCms.SignerInfos)
{
 foreach (var unsignedAttribute in signerInfo.UnsignedAttributes)
 {
 if (unsignedAttribute.Oid.Value == WinCrypt.szOID_RSA_counterSign)
 {
 foreach (var counterSignInfo in signerInfo.CounterSignerInfos)
 {
 foreach (var signedAttribute in counterSignInfo.SignedAttributes)
 {
 if (signedAttribute.Oid.Value == WinCrypt.szOID_RSA_signingTime)
 {
 Pkcs9SigningTime signingTime = (Pkcs9SigningTime)signedAttribute.Values[0];
 Console.Out.WriteLine("Signing Time UTC: " + signingTime.SigningTime);
 }
 }
 }
 return true;
 }
 }
}
</code></pre>

blocks|key|300075|text|我喜欢通过使用SignedCms类来避免一些讨厌的p/invoke代码的想法，但请注意，在某些网络环境下，SignedCms构造函数可能会阻塞很长时间-我看到我当前正在运行的一个测试大约有15秒。Alejandro+Campos+Magencio在他的MSDN博客上有一个标题为Big+delay+while+calling+EnvelopedCms+constructor的帖子中有一些关于这方面的信息。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|300076|entityMap|0|LINK|mutability|MUTABLE|url|http://blogs.msdn.com/b/alejacma/archive/2010/12/20/big-delay-while-calling-envelopedcms-constructor.aspx^0|3V|1C|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

I like the idea of avoiding some nasty p/invoke code by using the SignedCms class, but be aware that under some network circumstances the SignedCms constructor can block for a long time --- I'm seeing about 15 seconds on a test I'm currently running. Alejandro Campos Magencio has some information on this on his MSDN blog in a post titled <a href="http://blogs.msdn.com/b/alejacma/archive/2010/12/20/big-delay-while-calling-envelopedcms-constructor.aspx" rel="nofollow">Big delay while calling EnvelopedCms constructor</a>.

blocks|key|305188|text|我想把主题从数字证书中去掉，它是一个OU类型的字符串，比如|type|unstyled|depth|inlineStyleRanges|entityRanges|data|305189|305190|CN=Microsoft公司，OU=MOPR，O=Microsoft公司，L=Redmond，S=Washington，C=US|unordered-list-item|305191|305192|我发现X509Certificate非常慢，并将整个文件加载到内存中。我试图读取一个800Mb的补丁文件，当它读取它时，我的内存增加了800Mb，这花费了超过30秒！|305193|我站在上面的海报上，设法调整了上面的代码，以获得一个比使用X509对象快数百倍的X509Certificate2对象。|305194|请阅读我的博客文章，了解更多关于性能差异的图像的详细信息。X509Certificate+object+c#+performance+and+memory+issues+alternative+–+fixed|offset|length|305195|试试这个：|305196|public+static+X509Certificate2+GetDigitalCertificate(string+filename)
++++{
++++++++X509Certificate2+cert+=+null;

++++++++int+encodingType;
++++++++int+contentType;
++++++++int+formatType;
++++++++IntPtr+certStore+=+IntPtr.Zero;
++++++++IntPtr+cryptMsg+=+IntPtr.Zero;
++++++++IntPtr+context+=+IntPtr.Zero;

++++++++if+(!WinCrypt.CryptQueryObject(
++++++++++++WinCrypt.CERT_QUERY_OBJECT_FILE,
++++++++++++Marshal.StringToHGlobalUni(filename),
++++++++++++(WinCrypt.CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED
++++++++++++%7C+WinCrypt.CERT_QUERY_CONTENT_FLAG_PKCS7_UNSIGNED
++++++++++++%7C+WinCrypt.CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED),+//+<--+These+are+the+attributes+that+makes+it+fast!!
++++++++++++WinCrypt.CERT_QUERY_FORMAT_FLAG_ALL,
++++++++++++0,
++++++++++++out+encodingType,
++++++++++++out+contentType,
++++++++++++out+formatType,
++++++++++++ref+certStore,
++++++++++++ref+cryptMsg,
++++++++++++ref+context))
++++++++{
++++++++++++throw+new+Win32Exception(Marshal.GetLastWin32Error());
++++++++}

++++++++//+Get+size+of+the+encoded+message.
++++++++int+cbData+=+0;
++++++++if+(!WinCrypt.CryptMsgGetParam(
++++++++++++cryptMsg,
++++++++++++WinCrypt.CMSG_ENCODED_MESSAGE,
++++++++++++0,
++++++++++++IntPtr.Zero,
++++++++++++ref+cbData))
++++++++{
++++++++++++throw+new+Win32Exception(Marshal.GetLastWin32Error());
++++++++}

++++++++var+vData+=+new+byte[cbData];

++++++++//+Get+the+encoded+message.
++++++++if+(!WinCrypt.CryptMsgGetParam(
++++++++++++cryptMsg,
++++++++++++WinCrypt.CMSG_ENCODED_MESSAGE,
++++++++++++0,
++++++++++++vData,
++++++++++++ref+cbData))
++++++++{
++++++++++++throw+new+Win32Exception(Marshal.GetLastWin32Error());
++++++++}

++++++++var+signedCms+=+new+SignedCms();
++++++++signedCms.Decode(vData);

++++++++if+(signedCms.SignerInfos.Count+>+0)
++++++++{
++++++++++++var+signerInfo+=+signedCms.SignerInfos[0];

++++++++++++if+(signerInfo.Certificate+!=+null)
++++++++++++{
++++++++++++++++cert+=+signerInfo.Certificate;
++++++++++++}
++++++++}

++++++++return+cert;
++++}|code-block|syntax|javascript|305197|看起来，如果在CryptQueryObject调用中使用"WinCrypt.CERT_QUERY_CONTENT_FLAG_ALL“，它会受到与X509Certificate对象相同的内存性能影响，但如果你将其裁剪为PKCS7内容类型，它的表现就像做梦一样，似乎给了我所需的信息。|305198|entityMap|0|LINK|mutability|MUTABLE|url|http://ntsblog.homedev.com.au/index.php/2016/02/17/x509certificate-object-c-performance-memory-issues-alternative-fixed/^0|0|0|0|0|0|0|T|23|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|15|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|16|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|17|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|18|8|@]|9|@]|A|$]]|$1|G|3|H|5|6|7|19|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|1A|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|1B|8|@]|9|@$M|1C|N|1D|1|1E]]|A|$]]|$1|O|3|P|5|6|7|1F|8|@]|9|@]|A|$]]|$1|Q|3|R|5|S|7|1G|8|@]|9|@]|A|$T|U]]|$1|V|3|W|5|6|7|1H|8|@]|9|@]|A|$]]|$1|X|3|-4|5|6|7|1I|8|@]|9|@]|A|$]]]|Y|$Z|$5|10|11|12|A|$13|14]]]]

I wanted to get the subject off the digital certificate, its an OU type string like 

<ul>
<li>CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US</li>
</ul>

I found the X509Certificate to be really slow and load the entire file into memory. I tried to read an 800Mb patch file and my memory increased by 800Mb as it read it, and it took over 30 seconds!!

I have stood on the sholders of the posters above an managed to tweak the above code to get an X509Certificate2 object hundreds of time faster than using the X509 Object.

Please read my blog post for more details with images of the performance differences. <a href="http://ntsblog.homedev.com.au/index.php/2016/02/17/x509certificate-object-c-performance-memory-issues-alternative-fixed/" rel="nofollow">X509Certificate object c# performance and memory issues alternative – fixed</a>

Try this:

<pre><code>public static X509Certificate2 GetDigitalCertificate(string filename)
 {
 X509Certificate2 cert = null;

 int encodingType;
 int contentType;
 int formatType;
 IntPtr certStore = IntPtr.Zero;
 IntPtr cryptMsg = IntPtr.Zero;
 IntPtr context = IntPtr.Zero;

 if (!WinCrypt.CryptQueryObject(
 WinCrypt.CERT_QUERY_OBJECT_FILE,
 Marshal.StringToHGlobalUni(filename),
 (WinCrypt.CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED
 | WinCrypt.CERT_QUERY_CONTENT_FLAG_PKCS7_UNSIGNED
 | WinCrypt.CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED), // &lt;-- These are the attributes that makes it fast!!
 WinCrypt.CERT_QUERY_FORMAT_FLAG_ALL,
 0,
 out encodingType,
 out contentType,
 out formatType,
 ref certStore,
 ref cryptMsg,
 ref context))
 {
 throw new Win32Exception(Marshal.GetLastWin32Error());
 }

 // Get size of the encoded message.
 int cbData = 0;
 if (!WinCrypt.CryptMsgGetParam(
 cryptMsg,
 WinCrypt.CMSG_ENCODED_MESSAGE,
 0,
 IntPtr.Zero,
 ref cbData))
 {
 throw new Win32Exception(Marshal.GetLastWin32Error());
 }

 var vData = new byte[cbData];

 // Get the encoded message.
 if (!WinCrypt.CryptMsgGetParam(
 cryptMsg,
 WinCrypt.CMSG_ENCODED_MESSAGE,
 0,
 vData,
 ref cbData))
 {
 throw new Win32Exception(Marshal.GetLastWin32Error());
 }

 var signedCms = new SignedCms();
 signedCms.Decode(vData);

 if (signedCms.SignerInfos.Count &gt; 0)
 {
 var signerInfo = signedCms.SignerInfos[0];

 if (signerInfo.Certificate != null)
 {
 cert = signerInfo.Certificate;
 }
 }

 return cert;
 }
</code></pre>

It seems that if you use the "WinCrypt.CERT_QUERY_CONTENT_FLAG_ALL" on the CryptQueryObject call it suffers from the same memory performance hit as the X509Certificate object, but if you trim it down to just the PKCS7 content types it performs like a dream and seems to give me the info I need.

blocks|key|305200|text|提供的答案在我的SHA256签名方法中不起作用。我最近在那些嵌套的foreach循环中到达了底部。但Nuget+AuthenticodeExaminer+seams+to工作得很好。以下是具有单个时间戳的单个证书的示例：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|305201|++++++++var+extractor+=+new+FileInspector(@"D:\Temp\file.exe");
++++++++var+signTime+=+extractor.GetSignatures().FirstOrDefault()?.TimestampSignatures.FirstOrDefault()?.TimestampDateTime?.UtcDateTime;|code-block|syntax|javascript|305202|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/vcsjones/AuthenticodeExaminer^0|1K|K|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@$A|R|B|S|1|T]]|C|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|C|$G|H]]|$1|I|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|J|$K|$5|L|M|N|C|$O|P]]]]

The provided answers didn't worked in my case for SHA256 signing method. I newer reached the bottom within those nested foreach loops. But Nuget <a href="https://github.com/vcsjones/AuthenticodeExaminer" rel="nofollow noreferrer">AuthenticodeExaminer</a> seams to works just fine. Here is example for single certificate with single timestamp:

<pre><code> var extractor = new FileInspector(@"D:\Temp\file.exe");
 var signTime = extractor.GetSignatures().FirstOrDefault()?.TimestampSignatures.FirstOrDefault()?.TimestampDateTime?.UtcDateTime;
</code></pre>

We need to verify that binary files are signed properly with digital signature (Authenticode). This can be achieved with signtool.exe pretty easily. However, we need an automatic way that also verifies signer name and timestamp. This is doable in native C++ with <code>CryptQueryObject()</code> API as shown in this wonderful sample: <a href="http://support.microsoft.com/kb/323809" rel="noreferrer">How To Get Information from Authenticode Signed Executables</a>

However we live in a managed world :) hence looking for C# solution to the same problem. Straight approach would be to pInvoke Crypt32.dll and all is done. But there is similar managed API in <code>System.Security.Cryptography.X509Certificates</code> Namespace. <code>X509Certificate2</code> Class seems to provide some information but no timestamp. Now we came to the original question how can we get that timestamp of a digital signature in C Sharp?

Get timestamp from Authenticode Signed files in .NET

数字签名

我们需要验证二进制文件是否使用数字签名(Authenticode)正确签名。使用signtool.exe可以很容易地实现这一点。然而，我们需要一种自动的方法来验证签名者的名字和时间戳。在原生C++中使用CryptQueryObject() API可以做到这一点，如下面的示例所示：然而，我们生活在一个托管的世界中:)因此...

问从.NET中的Authenticode签名文件中获取时间戳
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问从.NET中的Authenticode签名文件中获取时间戳EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问从.NET中的Authenticode签名文件中获取时间戳
EN