poka.sh

 Docs

CAT

Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.

Windows Security Catalog.

At a glance
Original creator Microsoft
Purpose A Windows security catalog: a signed list of file hashes that vouches for a set of files, such as a driver package, without signing each file.
Extensions .cat
Poka parser poka-cat
Viewer poka-tree-viewer
Depth tier Parser with a shared viewer (see Depth tiers)
Breadth tier B4 Summary (see Breadth tiers)

How much Poka reads

B4 Summary. The container and metadata are read and summarised (counts, properties, structure), but the main content is not rendered.

Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-16: parsers/poka-cat/src/lib.rs (hand-written DER walk, x509-parser for certificates, OID naming), its unit tests and tests/samples.rs. The corpus holds 16 real .cat catalogs (MIT, BSD-3-Clause and GPL-2.0 sources, pinned by commit), so the floor of 15, the member count and the certificate chain are all proven on catalogs Windows actually signed; confidence is medium. The output is a tree of the structure label, member count, digest algorithm, the certificates found and the recognised OIDs. Covers PKCS#7 SignedData catalogs with a Microsoft CTL.

What Poka does not read

  • The individual member files (file names, hashes, hardware IDs, OS version attributes) are counted but never listed
  • Catalog name-value attributes and the catalog version and timestamp are not decoded
  • SignerInfo is not decoded: signing time, countersignature (timestamp) and which certificate actually signed
  • Signature is not verified and certificate trust is not checked
  • The signer shown is the first certificate found in the chain, which is not guaranteed to be the signing certificate

Background

Microsoft's driver documentation says a digitally signed catalog file can serve as the signature for any collection of files: it holds one cryptographic hash (thumbprint) per file, and Windows checks a file by looking its hash up. Structurally it is PKCS#7 SignedData in DER with a Microsoft certificate trust list as its content. Poka reads the structure rather than fully decoding PKCS#7, since the catalog payload has no public ASN.1 module, and shows what a reader wants: the first certificate in the chain (which may not be the signer, since SignerInfo is not read), with what algorithm, when the signing certificate expires and how many files it covers. It does not verify the signature.

Versions

Version Identifier Poka Note
PKCS#7 SignedData with a Microsoft CTL OID 1.3.6.1.4.1.311.10.1 Read No catalogue sample remains in the corpus, so the parser is unverified on real files.

Libraries

Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.

  • x509-parser (used; MIT OR Apache-2.0; Rust)
  • windows-ctl (candidate; Apache-2.0; Rust; https://github.com/trailofbits/windows-ctl) — Parses Windows Certificate Trust Lists (crates.io v0.1.2, August 2023); not confirmed whether it accepts the whole .cat PKCS#7 container or only the bare CTL
  • signify (candidate; MIT; Python; https://github.com/ralphje/signify) — Documents catalogue files as a special CTL and exposes a CertificateTrustList class; mainly an Authenticode library

Sources