cli: verify signatures of side-loadable DLLs on Windows (#2411)

The Windows loader resolves rnp.dll and any other DLL from the
executable's directory before main() runs, so replacing a DLL next to a
signed rnpkeys.exe (as shipped with Thunderbird) runs attacker code
inside a trusted-looking process.

rnp and rnpkeys now refuse to continue when a module loaded from the
executable's own directory has no valid Authenticode signature, but only
if the executable itself is signed - unsigned development builds are
unaffected. The check cannot undo the loader-time DLL initialization, so
signed distributions are also advised to build the tools statically
(BUILD_SHARED_LIBS=OFF), documented in docs/packaging.adoc.

Author: ronaldtse

docs/packaging.adoc

@@ -40,6 +40,39 @@ C project, the C++ runtime must be linked as well: with CMake enable the CXX
 language in your project, with manual flags link via the C++ compiler driver
 or add the C++ standard library explicitly (`-lc++` or `-lstdc++`).
 
+== Hardening signed Windows distributions (DLL side-loading)
+
+The `rnp` and `rnpkeys` command-line tools are attractive side-loading
+targets on Windows when shipped inside a digitally signed application (see
+issue #2411): the Windows loader resolves `rnp.dll` (and any other DLL) from
+the executable's directory *before* `main()` runs, so replacing a DLL next
+to a signed `rnpkeys.exe` results in attacker-controlled code running
+inside a process that appears trusted to EDR/AV products.
+
+Two complementary mitigations are available:
+
+. *Prefer static linking for signed distributions.* Building the tools with
+  `-DBUILD_SHARED_LIBS=OFF` removes the `rnp.dll` import entirely (the CLI
+  executables statically link librnp), which also closes the
+  loader-resolves-before-main window for the library itself. This is the
+  recommended configuration for distributors who sign and ship the
+  executables.
+. *Runtime module verification (default on Windows).* On startup, `rnp` and
+  `rnpkeys` check every module loaded from the executable's own directory
+  for a valid Authenticode signature, but only when the executable itself is
+  signed — unsigned development builds are unaffected. If an unsigned or
+  invalidly signed module is found, the tool refuses to continue with a
+  clear error message. Note that a startup check runs after the loader has
+  already mapped the DLLs, so it detects the substitution and aborts before
+  the tool is abused further, but cannot fully prevent execution of the
+  replaced module's initialization code — hence the static-linking
+  recommendation above.
+
+Projects embedding the rnp sources directly (rather than building through
+rnp's CMake) must compile `src/common/dll-verify.cpp` into the CLI
+executables on Windows and link `crypt32` and `wintrust` (see
+Thunderbird's `third_party/rnp` `moz.build` setup).
+
 == CMake find_package
 
 The installed CMake package (`<prefix>/lib/cmake/rnp/rnp-config.cmake`)

src/common/CMakeLists.txt

@@ -28,6 +28,10 @@ add_library(rnp-common OBJECT
   time-utils.cpp
 )
 
+if(WIN32)
+  target_sources(rnp-common PRIVATE dll-verify.cpp)
+endif()
+
 if(MSVC)
   find_path(GETOPT_INCLUDE_DIR
     NAMES getopt.h

src/common/dll-verify.cpp

@@ -0,0 +1,128 @@
+/*
+ * Copyright (c) 2026 [Ribose Inc](https://www.ribose.com).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *
+ * 2.  Redistributions in binary form must reproduce the above copyright notice,
+ *     this list of conditions and the following disclaimer in the documentation
+ *     and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <windows.h>
+#include <wintrust.h>
+#include <softpub.h>
+#include <tlhelp32.h>
+
+#include <stdio.h>
+#include <string>
+
+#include "dll-verify.h"
+
+namespace {
+
+/* Checks whether the file has a valid embedded Authenticode signature which
+ * chains to a trusted root. Revocation is not checked so the verification
+ * also works on offline systems. */
+bool
+file_has_valid_signature(const std::wstring &path)
+{
+    WINTRUST_FILE_INFOW file = {};
+    file.cbStruct = sizeof(file);
+    file.pcwszFilePath = path.c_str();
+
+    GUID           policy = WINTRUST_ACTION_GENERIC_VERIFY_V2;
+    WINTRUST_DATAW data = {};
+    data.cbStruct = sizeof(data);
+    data.dwUIChoice = WTD_UI_NONE;
+    data.fdwRevocationChecks = WTD_REVOCATION_CHECK_NONE;
+    data.dwUnionChoice = WTD_CHOICE_FILE;
+    data.pFile = &file;
+    data.dwStateAction = WTD_STATEACTION_VERIFY;
+
+    HWND dummy = static_cast<HWND>(INVALID_HANDLE_VALUE);
+    LONG res = WinVerifyTrustW(dummy, &policy, &data);
+    data.dwStateAction = WTD_STATEACTION_CLOSE;
+    WinVerifyTrustW(dummy, &policy, &data);
+    return res == ERROR_SUCCESS;
+}
+
+std::wstring
+directory_of(const std::wstring &path)
+{
+    size_t pos = path.find_last_of(L"\\/");
+    return (pos == std::wstring::npos) ? std::wstring() : path.substr(0, pos);
+}
+
+bool
+path_in_directory(const std::wstring &path, const std::wstring &dir)
+{
+    if (dir.empty() || path.size() <= dir.size() + 1) {
+        return false;
+    }
+    if (_wcsnicmp(path.c_str(), dir.c_str(), dir.size()) != 0) {
+        return false;
+    }
+    return path[dir.size()] == L'\\' || path[dir.size()] == L'/';
+}
+
+} // namespace
+
+bool
+rnp_dll_verify_modules()
+{
+    wchar_t exepath[32768] = {0};
+    if (!GetModuleFileNameW(NULL, exepath, 32768)) {
+        return true;
+    }
+    std::wstring exe(exepath);
+    /* Unsigned executable is a development build: a swapped DLL does not gain
+     * any trusted-process status, so there is nothing to enforce. */
+    if (!file_has_valid_signature(exe)) {
+        return true;
+    }
+
+    HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetCurrentProcessId());
+    if (snap == INVALID_HANDLE_VALUE) {
+        fwprintf(stderr, L"warning: could not enumerate loaded modules.\n");
+        return true;
+    }
+
+    std::wstring   exedir = directory_of(exe);
+    bool           trusted = true;
+    MODULEENTRY32W entry = {};
+    entry.dwSize = sizeof(entry);
+    if (Module32FirstW(snap, &entry)) {
+        do {
+            std::wstring path(entry.szExePath);
+            if (path == exe || !path_in_directory(path, exedir)) {
+                continue;
+            }
+            if (!file_has_valid_signature(path)) {
+                fwprintf(stderr,
+                         L"error: module '%s' is loaded from the application directory "
+                         L"but has no valid digital signature - possible DLL "
+                         L"side-loading. Refusing to continue.\n",
+                         path.c_str());
+                trusted = false;
+            }
+        } while (Module32NextW(snap, &entry));
+    }
+    CloseHandle(snap);
+    return trusted;
+}

src/common/dll-verify.h

@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2026 [Ribose Inc](https://www.ribose.com).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *
+ * 2.  Redistributions in binary form must reproduce the above copyright notice,
+ *     this list of conditions and the following disclaimer in the documentation
+ *     and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DLL_VERIFY_H_
+#define DLL_VERIFY_H_
+
+#if defined(_WIN32)
+/* DLL side-loading protection (issue #2411).
+ *
+ * Verifies that every module loaded from the executable's own directory
+ * carries a valid Authenticode signature, but only when the executable
+ * itself is signed - unsigned development builds are skipped. Returns
+ * false (after printing a diagnostic) when an unsigned or badly signed
+ * module was found, i.e. a likely side-loaded replacement. */
+bool rnp_dll_verify_modules();
+#endif
+
+#endif

src/rnp/CMakeLists.txt

@@ -84,6 +84,9 @@ target_link_libraries(rnp
   PRIVATE
     librnp
 )
+if(WIN32)
+  target_link_libraries(rnp PRIVATE crypt32 wintrust)
+endif()
 if(MSVC)
   target_link_libraries(rnp
     PRIVATE

src/rnp/rnp.cpp

@@ -49,6 +49,9 @@
 #include <errno.h>
 
 #include "fficli.h"
+#if defined(_WIN32)
+#include "common/dll-verify.h"
+#endif
 #include "str-utils.h"
 #include "logging.h"
 
@@ -641,6 +644,12 @@ int
 rnp_main(int argc, char **argv)
 #endif
 {
+#if !defined(RNP_RUN_TESTS) && defined(_WIN32)
+    if (!rnp_dll_verify_modules()) {
+        return EXIT_ERROR;
+    }
+#endif
+
     if (argc < 2) {
         print_usage(usage);
         return EXIT_ERROR;

src/rnpkeys/CMakeLists.txt

@@ -85,6 +85,9 @@ target_link_libraries(rnpkeys
   PRIVATE
     librnp
 )
+if(WIN32)
+  target_link_libraries(rnpkeys PRIVATE crypt32 wintrust)
+endif()
 if(MSVC)
   target_link_libraries(rnpkeys
     PRIVATE

src/rnpkeys/main.cpp

@@ -37,6 +37,9 @@
 #include <stdio.h>
 #include <string.h>
 #include "rnpkeys.h"
+#if defined(_WIN32)
+#include "common/dll-verify.h"
+#endif
 
 extern struct option options[];
 extern const char *  usage;
@@ -67,6 +70,12 @@ int
 rnpkeys_main(int argc, char **argv)
 #endif
 {
+#if !defined(RNP_RUN_TESTS) && defined(_WIN32)
+    if (!rnp_dll_verify_modules()) {
+        return EXIT_FAILURE;
+    }
+#endif
+
     if (argc < 2) {
         print_usage(usage);
         return EXIT_FAILURE;

src/tests/CMakeLists.txt

@@ -113,6 +113,7 @@ set(RNP_TEST_SOURCES
   ffi-key-prop.cpp
   ffi-key.cpp
   file-utils.cpp
+  dll-verify.cpp
   generatekey.cpp
   kbx-nsigs-test.cpp
   key-add-userid.cpp
@@ -191,6 +192,13 @@ if(MSVC)
       "${GETOPT_LIBRARY}"
     )
 endif()
+if(WIN32)
+  target_link_libraries(rnp_tests
+    PRIVATE
+      crypt32
+      wintrust
+    )
+endif()
 if (CRYPTO_BACKEND_BOTAN)
   get_target_property(BOTAN_INCLUDE_DIRS Botan::Botan INTERFACE_INCLUDE_DIRECTORIES)
 endif()

src/tests/dll-verify.cpp

@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2026 [Ribose Inc](https://www.ribose.com).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *
+ * 2.  Redistributions in binary form must reproduce the above copyright notice,
+ *     this list of conditions and the following disclaimer in the documentation
+ *     and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "rnp_tests.h"
+
+#if defined(_WIN32)
+#include "common/dll-verify.h"
+
+TEST_F(rnp_tests, test_dll_verify_unsigned)
+{
+    /* CI and development builds are unsigned, so the module verification
+     * must succeed as a no-op (the check only activates for signed
+     * executables). */
+    assert_true(rnp_dll_verify_modules());
+}
+#endif