Windows Catalog file is used to store hash checksums or thumbprints of any collection of files to validate its authenticity. Besides the Catalog file may be digitally signed and be used as group digital signature of the files which thumbprints are presented in this Catalog file. Catalog file may be generated from text catalog definition file (CDF) using makecat utility from Microsoft Windows Software Development Kit or programmatically using API functions defined in mscat.h header file. Catalog definition text file should satisfied appropriate template rules. This is example of catalog definition file (cdf.txt):
Creating js.cat using makecat:
C:\CDF>makecat.exe -v cdf.txt
Catalog file may be signed:
C:\CDF>signtool.exe sign /f selfsigned.pfx /p Password1 /fd sha256 /tr http://timestamp.digicert.com js.cat
Done Adding Additional Store
Successfully signed: js.cat
Now how to view file thumbprints: double click on catalog file in file explore or run rundll32.exe utility from command line (CryptExtOpenCAT is case sensitive key):
C:\CDF>rundll32 cryptext.dll,CryptExtOpenCAT js.cat
Select Security Catalog tab:
Compare thumbprint checksum with checksum of file:
Copyright (C) 2014 Microsoft Corporation. All rights reserved.
Again everything presented here is possible to do programmatically using mscat.h API.