Author Topic: DONE: Tool that lists digitally signed files from a folder/disk (Read 105117 times)

neverlight · « **Reply #25 on:** September 13, 2014, 08:02 AM »

Thank you. I will spread the word about this amazing piece of software.
You should add a stop/pause/resume feature & process priority (foreground,background) feature.

Kinds Regards,
Marius

skwire · « **Reply #26 on:** September 13, 2014, 02:08 PM »

Nice tool. Thank you!
-Mattes57 (September 12, 2014, 04:01 AM)

Thank you. I will spread the word about this amazing piece of software.
-neverlight (September 13, 2014, 08:02 AM)

Thank you, Mattes57 & neverlight. I'm glad you like the software.

You should add a stop/pause/resume feature & process priority (foreground,background) feature.
-neverlight (September 13, 2014, 08:02 AM)

"Cancelling a scan" feature is forthcoming. Regarding the process priority request, what do you expect to gain from such (honest question)?

skwire · « **Reply #27 on:** September 13, 2014, 03:42 PM »

Website | Download v1.0.7 - 2014-09-13 + Pressing the Escape key while a scan is going now cancels the scan.

x16wda · « **Reply #28 on:** September 13, 2014, 05:05 PM »

Good stuff. Although the help still says it's a front end for tiffinfo. :-)

skwire · « **Reply #29 on:** September 13, 2014, 05:51 PM »

Good stuff. Although the help still says it's a front end for tiffinfo. :-)
-x16wda (September 13, 2014, 05:05 PM)

Thanks! I uploaded a silent build that should fix that help issue.

neverlight · « **Reply #30 on:** September 14, 2014, 10:32 AM »

"Cancelling a scan" feature is forthcoming. Regarding the process priority request, what do you expect to gain from such (honest question)?
-skwire (September 13, 2014, 02:08 PM)

Sometimes the window gets unresponsive while handling a lot of files. That's why I suggested priority similarly to how archive managers handle things. I'm not sure if it's possible.

Also, it would be very interesting to see a cache system that might speed up the process since some files might have been (already) processed.
Perhaps there should be another action in "View" tab that gives end-users the ability to show only unique files (not duplicates).

Another issue that I've observed is that it does not handle special characters well. Probably a display issue.

And another suggestion would be to rename "Trusted list" to "Trusted Vendors" as this might avoid possible confusion & make the box re-sizable.

I've seen that you get to choose from three different search providers. However, why not let the user choose additional ones? Perhaps it should be configurable since some users might have access to executable databases by using hashes (or other information). Thus, another useful suggestion would be to allow macros. As for example, the user could input $SHA1 (and other) in the url.
Example of such usage (but not necessarily limited to VirusTotal) : https://www.virustotal.com/en/file/$SHA256/analysis/

While I do like that you can use "Open VirusTotal URL(s)" from the right-click menu, it is unclear on how to actually use it from a novice user point of view. This action is available/enabled by default. I'm not sure if it is intended since you can spam this action while not doing anything and not being ok from aesthetics point of view.

Also, the clean action will not do anything if files are being processed. I'm guessing this option could be grayed out or/and inform the user that it is not possible, maybe.

Under "Help" tab > "Contents", users would expect a help file and not a pop-up that describes SigcheckGUI since there is an "About" button. Superseded.

Another suggestion that might be useful regarding quick access would be to add another action in the right-click menu named, for example, "Open File Location".

Maybe, the "Info Box" action from right-click menu should be grayed out for multiple files.

SigcheckGUI or SigCheckGUI -- Is it intended?

Thanks,
Marius

skwire · « **Reply #31 on:** September 14, 2014, 11:06 AM »

Sometimes the window gets unresponsive while handling a lot of files. That's why I suggested priority similarly to how archive managers handle things. I'm not sure if it's possible.
-neverlight (September 14, 2014, 10:32 AM)

Unfortunately, that unresponsiveness has nothing to do with the process priority. It has to do with the fact that the UI is waiting for the commandline sigcheck.exe to finish. There are a few different methods I can use for this so it might be something I can alleviate.

Also, it would be very interesting to see a cache system that might speed up the process since some files might have been (already) processed.
-neverlight (September 14, 2014, 10:32 AM)

Doubtful that I'd add this.

Perhaps there should be another action in "View" tab that gives end-users the ability to show only unique files (not duplicates).
-neverlight (September 14, 2014, 10:32 AM)

I can add an option like "Skip duplicates in list" or something like that. If this is enabled, files that already exist in the list will be skipped. I'd think the full path would have to match exactly for this to be useful, though.

Another issue that I've observed is that it does not handle special characters well. Probably a display issue.
-neverlight (September 14, 2014, 10:32 AM)

The app does seem to handle Unicode paths and Unicode filenames without issue so I'll assume you're talking about the actual displayed data. If so, can you provide me an example of what you're seeing?

And another suggestion would be to rename "Trusted list" to "Trusted Vendors" as this might avoid possible confusion & make the box re-sizable.
-neverlight (September 14, 2014, 10:32 AM)

Can do.

Also, the clean action will not do anything if files are being processed. I'm guessing this option could be grayed out or/and inform the user that it is not possible, maybe.
-neverlight (September 14, 2014, 10:32 AM)

Can do.

Under "Help" tab > "Contents", users would expect a help file and not a pop-up that describes SigcheckGUI since there is an "About" button. Superseded.
-neverlight (September 14, 2014, 10:32 AM)

Ah, help files. The bane of developers everywhere.

I'm terrible at providing them.

That said, I do try to write my applications such that, hopefully, a help file shouldn't be needed for the most part.

Another suggestion that might be useful regarding quick access would be to add another action in the right-click menu named, for example, "Open File Location".
-neverlight (September 14, 2014, 10:32 AM)

Can do.

Maybe, the "Info Box" action from right-click menu should be grayed out for multiple files.
-neverlight (September 14, 2014, 10:32 AM)

Good point.

SigcheckGUI or SigCheckGUI -- Is it intended?
-neverlight (September 14, 2014, 10:32 AM)

I've seen both. However, the official site for the sigcheck.exe program that does the grunt work has it spelled Sigcheck so that's what I went with.

neverlight · « **Reply #32 on:** September 14, 2014, 11:22 AM »

The app does seem to handle Unicode paths and Unicode filenames without issue so I'll assume you're talking about the actual displayed data. If so, can you provide me an example of what you're seeing?
-skwire (September 14, 2014, 11:06 AM)

"Product" & "Copyright" columns, for example. Please check attachment.

Thanks,
Marius

skwire · « **Reply #33 on:** September 14, 2014, 11:37 AM »

"Product" & "Copyright" columns, for example. Please check attachment.
-neverlight (September 14, 2014, 11:22 AM)

This looks to be an issue with sigcheck.exe itself not being able to handle those characters. Run a "sigcheck -a c:\windows\explorer.exe" and you'll see what I mean.

neverlight · « **Reply #34 on:** September 14, 2014, 11:47 AM »

sigcheck.exe itself not being able to handle those characters. Run a "sigcheck -a c:\windows\explorer.exe
-skwire (September 14, 2014, 11:37 AM)

Those are not really important anyway. Future versions of Sigcheck might have it fixed.

Thanks,
Marius

neverlight · « **Reply #35 on:** September 15, 2014, 08:29 AM »

Another review,
http://www.softpedia...ed/SigcheckGUI.shtml
&
http://www.appinn.co...sigcheckgui-for-win/

Thanks,
Marius

skwire · « **Reply #36 on:** September 16, 2014, 12:37 AM »

Another review,
http://www.softpedia...ed/SigcheckGUI.shtml
&
http://www.appinn.co...sigcheckgui-for-win/
-neverlight (September 15, 2014, 08:29 AM)

Thanks for the heads up. Looks like SigcheckGUI is starting to make some rounds around the internet.

skwire · « **Reply #37 on:** September 17, 2014, 02:38 PM »

Website | Download v1.0.8 - 2014-09-17 + Added an option to disallow duplicates in the list. (Thanks, neverlight) + Added icons to the statusbar for the Sigcheck and VirusTotal websites. + Added "Open file location" feature to the toolbar and context menu. (Thanks, neverlight) * Disabled certain GUI elements during a scan. * Changed "Trusted list" to "Trusted vendors." (Thanks, neverlight)

neverlight · « **Reply #38 on:** September 19, 2014, 03:54 PM »

Thanks for the update, skwire.

Another suggestion would be search functionality.

Thanks,
Marius

skwire · « **Reply #39 on:** September 19, 2014, 04:06 PM »

Another suggestion would be search functionality.
-neverlight (September 19, 2014, 03:54 PM)

To clarify, I think you mean a list filter, right? That is, you type a string in a field and the list is reduced (filtered) to only those processes that match the search string. I say this, because you can already "type" while in the list and it should match on the filename and highlight it. Am I correct?

neverlight · « **Reply #40 on:** September 21, 2014, 02:30 PM »

To clarify, I think you mean a list filter, right? That is, you type a string in a field and the list is reduced (filtered) to only those processes that match the search string. I say this, because you can already "type" while in the list and it should match on the filename and highlight it. Am I correct?
-skwire (September 19, 2014, 04:06 PM)

A filtering function based on column data. As for example, searching for a certain vendor, hash, etc.

Also, you should add a message or something for missing <sigcheck.exe>. That might cause some trouble.

Thanks,
Marius

skwire · « **Reply #41 on:** September 22, 2014, 12:01 AM »

I'm out of town this week for work but let me see what I can do when I get back.

skwire · « **Reply #42 on:** October 01, 2014, 02:12 PM »

A filtering function based on column data. As for example, searching for a certain vendor, hash, etc.
Also, you should add a message or something for missing <sigcheck.exe>. That might cause some trouble.
-neverlight (September 21, 2014, 02:30 PM)

Both covered in the latest build. How does this look?

DONE: Tool that lists digitally signed files from a folder/disk

Give it a try and let me know what think. Thank you.

Website | Download v1.0.9 - 2014-10-01 + Added comprehensive search functionality. (Thanks, neverlight) + SigcheckGUI now checks for the presence of sigcheck.exe when it starts up and, if it's not found, offers to take the user to the Sysinternals website to download it. (Thanks, neverlight) + Added "Scan all running processes" to the File menu. (Thanks, mouser) + Added "Clear list" functionality to the Edit menu.

mouser · « **Reply #43 on:** October 01, 2014, 02:31 PM »

The search functionality rocks

neverlight · « **Reply #44 on:** October 04, 2014, 08:38 AM »

Good work!! I like it. I'm also kind of impressed while looking trough memory usage.

Thanks,
Marius

skwire · « **Reply #45 on:** October 04, 2014, 09:43 AM »

The search functionality rocks
-mouser (October 01, 2014, 02:31 PM)

Thanks, mouser.

Good work!! I like it. I'm also kind of impressed while looking trough memory usage.
-neverlight (October 04, 2014, 08:38 AM)

Right on. I'm glad you like it. I think we can call this one done, eh?

neverlight · « **Reply #46 on:** October 05, 2014, 01:28 PM »

Right on. I'm glad you like it. I think we can call this one done, eh?
-skwire (October 04, 2014, 09:43 AM)

Of course.

Thanks,
Marius

skwire · « **Reply #47 on:** October 05, 2014, 03:14 PM »

Great, thanks. I'll move this thread to the Finished section.

DRMex · « **Reply #48 on:** December 11, 2014, 08:10 PM »

Hi

Great front-end
have one question, i don't see any drivers on the list, whether you select folder with drivers or select manual some driver (.sys), list is empty
actually when i choose add files, in opened window of \windows\system32\drivers\ i see only few sys files and even i choose them nothing happens, empty columns
i use win 7 sp1 ultimate x64, i'm admin and UAC is turned off
if i copy dozen of drivers for example to desktop i now can see them in add files open window but when select them again nothing happens, columns stay empty
didn't know for sure is it problem on my side, some restriction maybe or with GUI (runned as admin)

if i use just sigcheck.exe everythig is fine
this is shorter example of output from sigcheck, it can check SbieDrv.sys

[Select]

C:\Program Files\Sandboxie>sigcheck -a -e

Sigcheck v2.1 - File version and signature viewer
Copyright (C) 2004-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

C:\Program Files\Sandboxie\SandboxieCrypto.exe:
   Verified: Signed
   Signing date: 20:29 9.12.2014.
   Publisher: Invincea
   Description: Sandboxie COM Services (CryptSvc)
   Product: Sandboxie
   Prod version: 4.15.6
   File version: 4.15.6
   MachineType: 64-bit
   Binary Version: 4.15.6.0
   Original Name: SandboxieCrypto.exe
   Internal Name: Crypto
   Copyright: Copyright ę 2004-2014 by Sandboxie Holdings, LLC
   Comments: n/a
   Entropy: 5.954
C:\Program Files\Sandboxie\SbieDrv.sys:
   Verified: Signed
   Signing date: 20:30 9.12.2014.
   Publisher: Invincea
   Description: Sandboxie Kernel Mode Driver
   Product: Sandboxie
   Prod version: 4.15.6
   File version: 4.15.6
   MachineType: 64-bit
   Binary Version: 4.15.6.0
   Original Name: SbieDrv.sys
   Internal Name: SbieDrv
   Copyright: Copyright ę 2004-2014 by Sandboxie Holdings, LLC
   Comments: n/a
   Entropy: 6.279
C:\Program Files\Sandboxie\SbieMsg.dll:
   Verified: Signed
   Signing date: 20:29 9.12.2014.
   Publisher: Invincea
   Description: Sandboxie Messages and Text
   Product: Sandboxie
   Prod version: 4.15.6
   File version: 4.15.6
   MachineType: 64-bit
   Binary Version: 4.15.6.0
   Original Name: SbieMsg.dll
   Internal Name: SbieMsg
   Copyright: Copyright ę 2004-2014 by Sandboxie Holdings, LLC
   Comments: n/a
   Entropy: 4.624
C:\Program Files\Sandboxie\sigcheck.exe:
   Verified: Signed
   Signing date: 22:45 28.4.2014.
   Publisher: Microsoft Corporation
   Description: File version and signature viewer
   Product: Sysinternals Sigcheck
   Prod version: 2.1
   File version: 2.1
   MachineType: 32-bit
   Binary Version: 2.10.0.0
   Original Name: sigcheck.exe
   Internal Name: Sigcheck
   Copyright: Copyright (C) 2004-2014 Mark Russinovich
   Comments: n/a
   Entropy: 6.447

telealex · « **Reply #49 on:** June 22, 2015, 05:34 PM »

skwire, many thanks for this tool!

but I've idea for improve it a little bit

a) can you please add a context menu point on items - "System menu". (near current "Open file location") because PC where I'm using this tool is pretty slow and it have a problem (time) to open "System menu", but open folder/explorer's window with content where I can make right click it takes a lot of time! and more, than I need go back to opened explorer and close it! it's too hard work

instead of one right click on item in the list

and other thing. now in case of "Unknown" (column "Virus Total Detection", because it wasn't analyze steel - new file) I need to open folder, than right click on file, and select point "Send to VirusTotal" (I'm using for this point official tool)......

b) I think it more important of all my points. Can you please make possibility to save (automatically or CFGble in Options) results of scann and downloading result's data from VirusTotal web site? because it so loooong to wait each scann.
e.g. now I've waited more than 2hours for analyze 3431 elems (w7x64,x86Folder) and waiting for download results from VirusTotal. And of course this PC have been a spy proxy...
e.g. you can save VT data only if there is HASH of files. and it's better to have possibility to cgf which HASH need to show/calculate. I think you have hash of files in the list, because it need for VirusTotal?
There is need only DB with HASH and quantity of VT detections. I'm right? and it will take not so big size (for this functionality!!!). than other projects can use (download from your project) this DB.

c) columns lose sorting order triangle

what do you think about?