When building Windows drivers for 64 bit versions of Windows
a Microsoft Security Catalog (.cat) file is required when
the driver is added to the driver store. This file contains
SHA1 hashes of other files used by the driver (usually the
mydriver.sys and the mydriver.inf file). To date as of my
knowledge there is no open source implementation that does
not depend on the wintrust.dll library (which would require
either a Windows build machine or wine which unfortunately
does not implement this particular feature). So I wrote
a small C program from scratch that creates the .cat
file.
You would normally use the utility via the gencat.sh (bash) shell script as follows:
./gencat.sh -o mydriver.cat -h myhardwareID mydriver.inf mydriver.sys
So for (example) WinDRBD the command line would be:
generate-cat-file/gencat.sh -o windrbd.cat-unsigned -h windrbd windrbd.inf windrbd.sys
Note that the gencat just generates the cat file with the
SHA1 hashes of the files you specify on the command line
(mydriver.inf and mydriver.sys in our example). It does
not sign the .cat file. Signing a cat file (and also a
.sys file) can be done with the osslsigncode utility,
which is also open source and runs on Linux. Be sure to
pick a modern (2022) version of osslsigncode since
.cat file support was only added recently.
There are two C programs: generate-cat-file.c and
strip-pe-image. To compile them any C compiler
that supports the C99 standard (required for the
bool datatype) should be sufficient. There are no
library dependencies for the C programs. To build
them run (from the project root file):
make
To install them on your system, do
sudo make install
which would install it into /usr/local/bin.
The only other dependency that comes to my mind is
that the sha1sum utility must be installed on
your system which is usually the case.
Cat files are at least in theory PKCS7 encoded
binary files which are described in ASN.1 syntax.
ASN.1 is a meta language for data structures that
originates in the early 1980's when every single
byte counted. Therefore it is a rather complex
data structure. Furthermore there are different
encodings on the binary level for this data
structure. .cat files use the ASN.1 DER format.
Instead of reading through the various definitions I used a (publically available) ASN.1 DER parser written in Java script to understand the format. The URL of this parser is:
http://lapo.it/asn1js/
Furthermore this introduction to the DER encoding was very useful:
https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/
As a last step it was neccessary to strip existing
signatures and their checksums from a .sys file
(which is similar to an .exe file) when the
SHA1 checksum was computed. This allows for changing
signatures in the .sys file later without having
to rebuild the .cat file.