How Sigverif.exe Detected Unsigned Drivers in Windows XP

File Signature Verification (sigverif.exe) was a built-in utility in Windows XP designed to help administrators and users identify unsigned system files and device drivers. By scanning critical operating system directories, the tool determined file integrity and authenticity using cryptographic signatures verified against Microsoft's catalog files or embedded Authenticode certificates. This article explains the exact mechanisms sigverif.exe used to scan directories, parse cryptographic hashes, and report unsigned drivers to maintain system stability.

The Purpose of Digital Signatures in Windows XP

During the Windows XP era, unstable third-party drivers were a leading cause of system crashes and Stop errors (Blue Screens of Death). To combat this, Microsoft used the Windows Hardware Quality Labs (WHQL) testing process. Drivers that passed WHQL testing received a digital signature confirming that the code had not been altered since testing and was verified to run reliably on Windows XP.

The Verification Process

When executed, sigverif.exe performed a structured verification workflow across the operating system:

  1. Target Identification: By default, the utility targeted critical system locations, primarily %SystemRoot%\System32 and %SystemRoot%\System32\drivers, focusing on executable files and drivers with extensions such as .sys, .dll, .exe, and .ocx. Users could also configure advanced settings to scan specific folders or include non-driver system files.
  2. Hash Generation: For each target file, the tool generated a cryptographic hash (typically SHA-1 or MD5, common during the Windows XP lifecycle) of the file's binary contents.
  3. Catalog Database Matching: Windows XP stored digital signatures for drivers in system security catalog files (.cat) located in %SystemRoot%\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}. Rather than modifying the driver binary itself, WHQL certification often bundled the driver’s hash into a signed catalog file. The verification tool queried the Windows Cryptographic Services and the WinVerifyTrust API to check if the generated file hash matched an entry within any registered, validly signed catalog file.
  4. Embedded Signature Checking: If a file hash was not found within the central catalog database, the utility inspected the binary's header for an embedded Authenticode digital signature. It validated the certificate chain back to a trusted root Certification Authority (CA) recognized by Windows XP.

Reporting and Log Generation

Once the scan completed, sigverif.exe evaluated the results:

  • The GUI Results Window: If any files lacked a valid catalog entry or embedded signature—or if a file had been modified after signing—the utility displayed them in a list view showing the file name, directory location, modification date, file type, and version. If all scanned files were properly signed, it notified the user that no unsigned files were detected.
  • SIGVERIF.TXT: The tool automatically recorded the scan details to a text log file, typically stored at %SystemRoot%\SIGVERIF.TXT. This log provided a persistent record showing whether individual drivers were signed, the signer's identity, and the exact timestamp of the scan.