Question - Signing Office Files (XLSM)

[stephannn]

Hi,
this is more like a question. Would it also be possible to sign Excel Macros by using the Microsoft Office Subject Interface Packages (SIPs) with your tool?

Described here:
https://federicoterzi.com/blog/fixing-the-error-signersign-failed-during-signtool-codesigning/
or here:
https://www.encryptionconsulting.com/how-to-sign-excel-macro-project-with-signtool/

Thanks in advance
Stephan

[olszomal]

Please test the solution in PR #458 — it adds support for signing .xlsm files.
Let us know if it works for your use case.

[stephannn]

Hi @olszomal ,
at first I would like to thank you for your support.
I tried following command:
osslsigncode.exe sign --certs "C:\tmp\mycert2.pfx" --pass 123456 --pkcs7 --digest sha256 --in "C:\tmp\officesips_16.0.16507.43425\Macro1.xlsm" --out "C:\tmp\officesips_16.0.16507.43425\Macro3.xlsm" --force --verbose
and get following outout:

Overwriting an existing file is not supported.
Failed

I think I am generally doing something wrong because I also cannot sign an exe file. I used the same command with WINE and had no issue. If I only use one "-" I just get a failed error.

Edit:
I changed my call a bit

C:\tmp\osslsigncode-excel\build\osslsigncode.exe sign -pkcs12 "C:\tmp\mycert2.pfx" -pass 123456 -in "C:\tmp\officesips_16.0.16507.43425\Macro1.xlsm" -out "C:\tmp\officesips_16.0.16507.43425\Macro3.xlsm"

and receive this error now:

Signing C:\tmp\officesips_16.0.16507.43425\Macro1.xlsm mit osslsigncode ...
Central directory entry count: 13
Name: [Content_Types].xml Compressed: 428 Uncompressed: 1460 Offset: 0
Name: _rels/.rels Compressed: 290 Uncompressed: 734 Offset: 997
Name: xl/workbook.xml Compressed: 1005 Uncompressed: 2419 Offset: 1848
Name: xl/_rels/workbook.xml.rels Compressed: 297 Uncompressed: 948 Offset: 2898
Name: xl/worksheets/sheet1.xml Compressed: 643 Uncompressed: 1135 Offset: 3515
Name: xl/theme/theme1.xml Compressed: 1976 Uncompressed: 8721 Offset: 4212
Name: xl/styles.xml Compressed: 681 Uncompressed: 1623 Offset: 6237
Name: xl/vbaProject.bin Compressed: 5348 Uncompressed: 16896 Offset: 6961
Name: xl/metadata.xml Compressed: 422 Uncompressed: 733 Offset: 12356
Name: xl/calcChain.xml Compressed: 155 Uncompressed: 198 Offset: 12823
Name: docMetadata/LabelInfo.xml Compressed: 201 Uncompressed: 299 Offset: 13024
Name: docProps/core.xml Compressed: 329 Uncompressed: 625 Offset: 13280
Name: docProps/app.xml Compressed: 408 Uncompressed: 813 Offset: 13920
Message digest algorithm: SHA256
Hash of file : 4150505841585043D195BC0FF14CDB64210A040A449F00C9829A35FD61F273A50A3E00DA5969BC2B41584344F7831CF9DF92D1F8CCB1F1356950DE0D04945C8F9C1BEEBADB570BFF90A3AF3241584354C3183DC5AD20BE745EB1CCA0304F2321ECA65F83C7E085A5C5299476377809BB 

Signing as a package
Failed
osslsigncode.exe : Unable to get offset
In Zeile:9 Zeichen:1
+ & "$osslsigncodePath" sign -pkcs12 "$pfxPath" `
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (Unable to get offset:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
 
Failed to append zip file
Append signature to outfile failed

But because the signtool requires the msosipx.dll and vbe7.dll dll, I don't know if this makes a difference. Btw. the dlls are registered and the signtool can be used.

Edit 2:
It seems, on every run time the behavior is different:
Signing as a package Unable to get offset Failed to append zip file Append signature to outfile failed A42B0000:error:12800067:DSO support routines:win32_load:could not load the shared library:crypto\dso\dso_win32.c:108:filename(C:\vcpkg\packages\openssl_x64-windows\bin\legacy.dll) A42B0000:error:12800067:DSO support routines:DSO_load:could not load the shared library:crypto\dso\dso_lib.c:152: A42B0000:error:07880025:common libcrypto routines:provider_init:reason(524325):crypto\provider_core.c:904:name=legacy Failed

I created the folder and copied the legacy.dll and I got:

`Hash of file : 4150505841585043D195BC0FF14CDB64210A040A449F00C9829A35FD61F273A50A3E00DA5969BC2B41584344F7831CF9DF92D1F8CCB1F1356950DE0D04945C8F9C1BEEBADB570BFF90A3AF3241584354C3183DC5AD20BE745EB1CCA0304F2321ECA65F83C7E085A5C5299476377809BB 

Signing as a package
Unable to get offset
Failed to append zip file
Append signature to outfile failed
Failed`

run it again:

`Message digest algorithm: SHA256
Hash of file : 4150505841585043D195BC0FF14CDB64210A040A449F00C9829A35FD61F273A50A3E00DA5969BC2B41584344F7831CF9DF92D1F8CCB1F1356950DE0D04945C8F9C1BEEBADB570BFF90A3AF3241584354C3183DC5AD20BE745EB1CCA0304F2321ECA65F83C7E085A5C5299476377809BB 

Signing as a package`

and a Macro3.xlsm was created, but the file is broken.

[mtrojnar]

Overwriting an existing file is not supported.
Failed

Isn't the error message self-explanatory? The output file already exists, and osslsigncode refuses to overwrite it. Just delete the old file before creating a new one.

[stephannn]

Overwriting an existing file is not supported.
Failed

Isn't the error message self-explanatory? The output file already exists, and osslsigncode refuses to overwrite it. Just delete the old file before creating a new one.

Yes, the error is self explanatory. My issue was more, that the file did not exist and still got the message. Somehow something was wired in the CMD with the hyphens, in PS it worked.

[olszomal]

@stephannn I’ve corrected a small detail, please have another look.

[stephannn]

@olszomal thanks again!
The good thing is, no error anymore by opening the Excel file and also the file size increases, but unfortunately the macro is not signed. When you open Excel -> Visual Basic -> Tools -> Digital Signature it should look after signing like that:

I think this is also the difficulty and why the MS signing tool uses various DLLs to sign it.

After unzipping your signed Excel file and I saw there is a AppxSignature.p7x in the root. However, in the MS signed Excel there is a file called vbaProjectSignature.bin in the xl folder and no AppxSignature file.

I also don't want to bother you with the request, but if you are willing, I can continue testing.

[olszomal]

@stephannn thanks for the feedback — it really looks like we're on the right track.

Could you please attach two files for further analysis:

• An unsigned .xlsm file
• The same file properly signed by Microsoft tools

[stephannn]

Please find attached a zip with an unsigned and the one signed my the MS signing tool and their DLLs

[olszomal]

@stephannn You're right — signing VBA macros is quite tricky, and Microsoft relies on internal DLLs to handle it properly. The presence of the vbaProjectSignature.bin file under the xl folder in the Microsoft-signed file — compared to our package, which only includes AppxSignature.p7x in the root — suggests that our current process isn’t signing the macro in the expected way.

Unfortunately, the vbaProjectSignature.bin file contains a PKCS#7 structure preceded by a 36-byte custom header, and its exact format isn’t publicly documented, making it hard to reproduce. To proceed, we’ll need more information on how this file is generated and what its full structure looks like.

[stephannn]

Thanks for the info. Lets say it was good that I wasted our both times ;)

I also tried to take a look at the API monitor but except for me wired calls, I see nothing.

Thanks a lot for your effort

[mtrojnar]

We are unable to implement this feature without documentation. Feel free to reopen this issue when XLSM file signing format becomes available.