guyrleech

Get driver file signing time

Dec 30th, 2024 (edited)
632
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PowerShell 0.98 KB | Cybersecurity | 0 0
  1. <# use certutil to get the signing time of a (driver) file since Microsoft's drivers deliberately have old dates https://devblogs.microsoft.com/oldnewthing/20170208-00/?p=95395
  2.  
  3. 0092:          |           18 12        ; GENERALIZED_TIME (12 Bytes)
  4. 0094:          |           |  32 30 32 34 31 31 30 32  30 33 32 30 30 32 2e 38  ; 20241102032002.8
  5. 00a4:          |           |  36 5a                                             ; 6Z
  6.                |           |     ;  02/11/2024 03:20
  7. #>
  8.  
  9. [string[]]$formats = @( 'yyyyMMddHHmmss.fff\Z' , 'yyyyMMddHHmmss.ff\Z' ,'yyyyMMddHHmmss.f\Z' , 'yyyyMMddHHmmss\Z' )
  10.  
  11. ls C:\Windows\System32\drivers\*.sys -file -PipelineVariable file |% { certutil -dump $file.FullName | sls '^[0-9a-f]{4}:.+\; GENERALIZED_TIME \(([0-9a-f]{2}) Bytes\)' -Context 0,2|select @{n='File';e={$file.Name}},@{n='Signed';e={$timestamp = ($_.Context.PostContext -replace '^[0-9a-f]{4}:.+.*;\s*(.+)$', '$1') -join ''; [datetime]::ParseExact( $timestamp , $formats , $null , 'None' ) }}  }
  12.  
Tags: Driver SIGNING
Advertisement
Add Comment
Please, Sign In to add comment