A way to check GOG games/goodies files validity.

casper · Post by **casper** » 03 Apr 2024, 14:50

Thank you very much for all these explanations. I use Msys2 and it works like a charm. It's not very complicated to use, but I've put together a short tutorial for those who don't know what it's all about.

- Download Msys2 : https://www.msys2.org/
- Install and launch MSYS2 UCRT64

- Update it with the command :

Code: Select all

pacman -Suy

- After all the updates you need to restart it and relaunch the command to finalize the updates

- Install the packages :

Code: Select all

pacman -S ucrt64/mingw-w64-ucrt-x86_64-osslsigncode
pacman -S ucrt64/mingw-w64-ucrt-x86_64-innoextract
pacman -S unrar

- After placing the certificate supplied by Thircase in the same directory as the script, the script must be modified to indicate the path to the certificate :

Code: Select all

#certfile=
to
certfile=cacert.pem

- Launch the script, for example :

Code: Select all

cd C:/tools/gogcheck/
./gogcheck "D:/games/game.exe"

casper · Post by **casper** » 03 Apr 2024, 16:37

I'll post as I discover errors (it will take time). I redownloaded faulty ones from kevinj93's collection to be sure. DONE

Code: Select all

setup_aquanox_1.18_(19599).exe (not a GOG installer?)
setup_battletech_1.9.1-686r_(64bit)_(36427).exe (innoextract extraction)
setup_civilization4_complete_2.0.0.4.exe (innoextract extraction)
setup_combat_chess_3.0_(19162).exe (not a GOG installer?)
setup_defcon_1.6_(20793) (digital signature error)
setup_enemy_engaged_-_apache_vs_havoc_1.1_e_(19140).exe (not a GOG installer?)
setup_enemy_engaged_-_comanche_vs_hokum_1.11.1_(19258).exe (not a GOG installer?)
setup_blood-ice_1.0.7.4_(19111).exe (not a GOG installer?)
setup_expeditions_viking_1.0.7.4_(19111).exe (.bin checksums missing)
setup_fear_platinum_collection_2.0.0.5.exe (innoextract extraction)
setup_hidden_and_dangerous2_courage_under_fire_2.0.0.5.exe (wrong number of .bin files)
setup_hidden_and_dangerous2_courage_under_fire_2.0.0.5.exe (innoextract extraction)
setup_hostile_waters_-_antaeus_rising_1.0_(19572).exe (not a GOG installer?)
setup_jupiter_hell_1.8b_(64bit)_(71869).exe (wrong number of .bin files)
setup_kingpin_life_of_crime_1.21_(19594).exe (not a GOG installer?)
setup_lsl_reloaded_2.1.0.11.exe (wrong number of .bin files)
setup_lsl_reloaded_2.1.0.11.exe (innoextract extraction)
setup_lords_of_magic_special_edition_3.01_(19308).exe (not a GOG installer?)
setup_maniac_mansion_1.0_(19476).exe (not a GOG installer?)
setup_miasmata_1.0_(19144).exe (.bin checksums missing)
setup_nwn2_complete_2.2.0.10.exe (innoextract extraction)
setup_nexus_2.3.0.15.exe (innoextract extraction)
setup_odallus_the_dark_call_1.1.3_(19598) (not a GOG installer?)
setup_oddworld_abe_exoddus_1.0_(19118).exe (not a GOG installer?)
setup_operation_flashpoint.exe (no digital signature found)
setup_operation_flashpoint.exe (not a GOG installer?)
setup_outcast_18970_(19502) (not a GOG installer?)
setup_psychonauts_2.2.0.13.exe (innoextract extraction)
setup_runaway2_2.0.0.5 (innoextract extraction)
setup_runaway3_2.0.0.9 (innoextract extraction)
setup_shogo_2.2.1.4.exe (not a GOG installer?)
setup_starfleet_academy_2.0.0.4.exe (innoextract extraction)
setup_star_wolves3_2.0.0.2.exe (innoextract extraction)
setup_strategic_command_-_european_theater_1.07_(19451).exe (not a GOG installer?)
setup_the_guild2_renaissance_2.2.0.5.exe (innoextract extraction)
setup_the_witness_21-12-2017_(19091).exe (.bin checksums missing)
setup_ransome_unbeeped_1.0.958_(19287).exe (not a GOG installer?)
setup_thimbleweed_park_1.0.958_(19287).exe (not a GOG installer?)
setup_world_in_conflict_2.0.0.3.exe (innoextract extraction)
setup_xenonauts_2.3.0.13.exe (innoextract extraction)

Post by **Thircase** » 04 Apr 2024, 02:19

@casper

It seems that some installers will trigger the "(not a GOG installer?)" error if you try to do a binary check when they don't have any bin(s).

I think it should be enough if you check the "just .exe" installers with -s and -i options.

I own AquaNox on GOG and I got the same error as you, even if the md5 hash matches GOG's metadata.

If binary check process is not done, there will be no errors.

Now...
About Defcon...
I also own this game on GOG, and it's digital signature is bad.

brotbertaa · Post by **brotbertaa** » 04 Apr 2024, 03:34

In that case the certificate validation date expired.

casper · Post by **casper** » 04 Apr 2024, 17:36

Most of the problem seems to come from "old" installers (prior to 2020). There is two who are "modern", Battletech and Jupiter Hell. If anyone have those, can you confirm the installer are faulty ?

I redo the bad ones with options -is and -s as you say Thircase :

Option -is

Code: Select all

setup_battletech_1.9.1-686r_(64bit)_(36427).exe (innoextract extraction)
setup_civilization4_complete_2.0.0.4.exe (innoextract extraction)
setup_defcon_1.6_(20793) (digital signature error)
setup_fear_platinum_collection_2.0.0.5.exe (innoextract extraction)
setup_hidden_and_dangerous2_courage_under_fire_2.0.0.5.exe (innoextract extraction)
setup_lsl_reloaded_2.1.0.11.exe (innoextract extraction)
setup_nwn2_complete_2.2.0.10.exe (innoextract extraction)
setup_nexus_2.3.0.15.exe (innoextract extraction)
setup_operation_flashpoint.exe (no digital signature found)
setup_psychonauts_2.2.0.13.exe (innoextract extraction)
setup_runaway2_2.0.0.5 (innoextract extraction)
setup_runaway3_2.0.0.9 (innoextract extraction)
setup_starfleet_academy_2.0.0.4.exe (innoextract extraction)
setup_star_wolves3_2.0.0.2.exe (innoextract extraction)
setup_the_guild2_renaissance_2.2.0.5.exe (innoextract extraction)
setup_world_in_conflict_2.0.0.3.exe (innoextract extraction)

Option -s

Code: Select all

setup_defcon_1.6_(20793) (digital signature error)
setup_operation_flashpoint.exe (no digital signature found)

Post by **Thircase** » 07 Apr 2024, 05:41

Psychonauts files are fine, but innoextract have some issues under MSYS2/Cygwin.

► Show Spoiler

Testings under Windows Subsystem for Linux (WSL) will be OK.
Note: Installer "slices" must be .bin.

Neverwinter Nights 2 Complete files are fine too, but will show the same errors if we use MSYS2/Cygwin.

► Show Spoiler

Probably the other old installers are failing too because of the innoextract issue.

I also checked Jupiter Hell and tests were OK.
Be sure you are not using a backslash (\) in your path, as this will cause the .bin to not be found.

► Show Spoiler

Post by **Leader RG GOGFAN** » 07 Apr 2024, 10:31

Please suggest a program for checking the authenticity and integrity of gog files for Windows with a friendly interface without the need to work with the command line. Thank you

Meditaremi · Post by **Meditaremi** » 09 Apr 2024, 12:33

Thircase wrote: ↑29 Mar 2024, 22:36 A couple of weeks ago I noticed I was missing a certificate required to verify the Sectigo certs.
The missing certificate was: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1

So, I grabbed this Mozilla CA certificate Bundle and added the missing certificate to the .pem file, and solved the issue.

Hi, THanks for the guide. Unfortunately this still did not work for me, Wondering if I am missing another cert perhaps? Appreciated the help.

",,,Timestamp Verified by:
Issuer : /C=GB/ST=Greater Manchester/L=Salford/O=Sectigo Limited/CN=Sectigo RSA Time Stamping CA
Serial : 394C25E17CA06D27A865E23BD91D22D4
CMS_verify error
8009AF5D0E7F0000:error:1700006B:CMS routines:cms_get_enveloped_type:content type not enveloped data:../crypto/cms/cms_env.c:41:
8009AF5D0E7F0000:error:17000064:CMS routines:cms_signerinfo_verify_cert:certificate verify error:../crypto/cms/cms_smime.c:289:Verify error: unable to get local issuer certificate
Timestamp Server Signature verification: failed
PKCS7_verify error
8009AF5D0E7F0000:error:10800075:PKCS7 routines:PKCS7_verify:certificate verify error:../crypto/pkcs7/pk7_smime.c:293:Verify error: unable to get issuer certificate
Signature verification: failed
Number of verified signatures: 1
Failed"

Login • Register