title: How does Windows link a pe file to its signature in a catalog file?
body: <p>Running <code>signtool.exe verify /a /v C:\Windows\notepad.exe</code> I can see the signature for notepad.exe is in <code>C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntexe.cat</code>. How does signtool know that is where the signature exists for this pe file?</p>
  
  <p>I am trying to replicate this signtool behaviour in python. Once I have the catalog file I can get the certificate information with the code below but I cannot see how windows links the file to the catalog.
  </p>
  
  <pre><code>import win32com.client
  catpath = "C:\\Windows\\system32\\CatRoot\\{F----E}\\nt5.cat"
  signedCode = win32com.client.Dispatch('capicom.signedcode')
  signedCode.FileName=catpath
  signedCode.Verify()
  certs = signedCode.Certificates
  for cert in certs:
      print cert.Archived
      print cert.IssuerName
      print cert.SerialNumber
      print cert.SubjectName
      print cert.Thumbprint
      print cert.ValidFromDate
      print cert.ValidToDate
      print cert.Version
  </code></pre>
  
  <p>But how do I get which security catalog file the executable is in?</p>