title: How to Verify a Digital Signature of a DLL in .NET
body: <p>I've written a C# .NET application that uses a popular unmanaged DLL file for part of its functionality.
  The DLL is imported using the standard DllImport from System.Runtime.InteropServices.</p>
  
  <p>However, unfortunately, my application (along with most .NET applications using DllImport) is vulnerable to DLL Hijacking.
  I.e. an attacker can place a malicous copy of the imported DLL in the same directory as any file opened by my application.
  This could give the attacker full control of the user's machine.</p>
  
  <p>To mitigate this vulnerability I'd like to verify that the DLL file is properly signed (with default Authenticode) before importing it.
  I know that signatures can be verified with tools like sigcheck.exe, but this isn't a viable solution for me since I need to do it from within my C# code.</p>
  
  <p>So my question is simply: <strong>How can I verify that a DLL has a valid Authenticode signature, from within my managed C# code, before loading the DLL?</strong></p>
  
  <p>Limitations:</p>
  
  <ul>
  <li>The imported DLL isn't developed by me, it's from an external company.</li>
  <li>The DLL is not distributed with my application, it is expected to already be installed prior to running my app.</li>
  <li>The imported DLL exists in many different versions (and even more will come), so I can't simply  <a href="https://stackoverflow.com/a/9502924">verify an MD5 checksum of the DLL</a> before importing it.</li>
  </ul>
  
  <p>Failed approaches:</p>
  
  <ul>
  <li>Microsoft have a nice writeup on <a href="http://msdn.microsoft.com/en-us/library/ff919712%28VS.85%29.aspx" rel="noreferrer">preventing "DLL preloading attacks"</a>, 
  however, this info isn't applicable for .NET's DllImport.</li>
  <li>I've seen some people suggesting the use of the unmanaged function WinVerifyTrust from Wintrust.dll.
  This is of course a stupid solution, since that would instead make my application vulnerable to DLL injection via Wintrust.dll.</li>
  </ul>