I’ve used the WinVerifyTrust example from here, but I’m finding that it is getting a TRUST_E_NOSIGNATURE for some files that SysInternals sigcheck reports as signed. For example, c:\windows\system32\mfc42.dll is reported by WinVerifyTrust as signed, but c:\windows\system32\mfc42u.dll is reported as unsigned — sigcheck reports both as being signed.
I believe sigcheck is using WinVerifyTrust internally, but it must be using it differently than in the example I’m looking at — any suggestions?
I think this has to do with something called security catalog. Check out this example code: http://forum.sysinternals.com/howto-verify-the-digital-signature-of-a-file_topic19247.html