README for Signtool
-------------------

1. Purpose
2. Comments
3. License
4. Guarantee
5. Compiling
6. Installing
7. Author

1. Purpose
----------
This is an investigation of the Microsoft CryptoAPI. This is a very badly 
documented API, although it seems like new information becomes available 
with time.

This application can query, verify and sign an Authenticode (Microsoft 
Copyrighted word!) signed file and report some information on it. 

2. Comments
-----------
This program is seriously beta. Expect it to have lots of bugs. 
It was developed under Borland C++ Builder 5.0. 

3. License
----------
It is released under a "Do what you want with it license". It is just I 
playing and sharing my attempts with you. 

4. Guarantee
------------
The guarantee is therefore of the nature that if it breaks, you get to 
keep all the little and big pieces.

5. Compiling
------------
You need Borland C++ Builder 5 to compile this process. You also need to 
make sure you have the latest wincrypt.h and wintrust.h from the 
Microsoft Platform SDK and copy this over the versions distributed by 
Borland. You will also need to replace the advapi32.lib and crypt32.lib 
distributed by Borland. Borland distributes a nifty tool to convert the 
Microsoft .lib files to files that Borland can understand. It is called 
coff2omf.exe.

You will also need to install and register CAPICOM. Then you need to 
import it as an ActiveX control under the Component menu.

You need at least the October 2002 MS SDK installed to be able to compile.

6. Installing
-------------
You need to be able to generate your own keys. Look at makecert.exe and
certmgr.exe for that. It needs keys in .pfx format. For the CAPICOM 
version of the signing routine it assumes you have only one key in your 
MY store that can be used for signing.

7. Author
---------
Robert Sandilands <rsandila@netscape.net>
