How to Sign CAB Files for Windows Mobile 6.5

Securing and distributing software on Windows Mobile 6.5 required developers to digitally sign Cabinet (.cab) archive files using Microsoft Authenticode certificates. This process ensured file integrity, verified developer identity, and allowed installations to comply with the operating system's privileged or unprivileged security policies, thereby avoiding disruptive security warnings or installation blocks on end-user devices.

Prerequisites for Signing

Before signing a .cab file, developers needed specific digital assets and tools provided by the Windows Mobile SDK and the Microsoft Windows SDK:

  • A Valid Code Signing Certificate: Typically a Software Publisher Certificate (SPC) or Personal Information Exchange (.pfx) file issued by a trusted Certification Authority (CA), such as VeriSign under the Mobile2Market program, or an enterprise private root CA.
  • Cabinet Creation Tools: CabWiz.exe (Cabinet Wizard) to package the application binaries and setup instructions.
  • Signing Utilities: Microsoft SignTool.exe (or legacy SignCode.exe) to attach the cryptographic signature.

The Signing Workflow

1. Generating the CAB File

Developers created the .cab package using the Cabinet Wizard included with the Windows Mobile 6 SDK:

cabwiz.exe "myapp.inf" /dest "C:\Output"

While individual executable files inside the package were often signed first, the resulting .cab file itself required an outer signature to pass Windows Mobile installation policy checks.

2. Applying the Digital Signature

Once generated, the .cab file was signed using SignTool.exe. Windows Mobile 6.5 relied on the SHA-1 hashing algorithm, as SHA-256 was not supported on the platform at the time.

A standard signing command using a .pfx file:

signtool.exe sign /f "MyCertificate.pfx" /p "CertificatePassword" /t "http://timestamp.verisign.com/scripts/timstamp.dll" "C:\Output\myapp.cab"

Alternatively, developers using older toolchains used SignCode.exe:

signcode.exe -spc "MyCert.spc" -v "MyKey.pvk" -t "http://timestamp.verisign.com/scripts/timstamp.dll" "C:\Output\myapp.cab"

3. Timestamping

Adding a timestamp via the /t flag was a mandatory distribution practice. The timestamp ensured that the .cab file remained valid and installable on the mobile operating system even after the underlying signing certificate expired, as long as the certificate was valid at the moment of signing.

4. Verifying the Signature

Before distribution, developers verified the signature's integrity using the verification command:

signtool.exe verify /pa "C:\Output\myapp.cab"

Impact on Device Execution

Windows Mobile 6.5 enforced a two-tier trust model managed by its Security Configuration Manager:

  • Privileged (Manager) Execution: If signed with a root certificate present in the device's Privileged Execution Trust Maker store (such as Mobile2Market Privileged), the .cab file installed silently or with minimal prompts and could access restricted APIs.
  • Unprivileged (Normal) Execution: If signed with a standard Authenticode certificate, the installer could run but required explicit user consent and could not interact with low-level system APIs.
  • Unsigned: Depending on the mobile carrier's lock-down policies, unsigned .cab files either produced severe security warning dialogues upon installation or were blocked entirely.