From 68f0b11b6f075a170e85c830cd558ec35a47272f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Tue, 3 Mar 2026 11:00:05 +0800
Subject: [PATCH] WM (Windows): loads `wintrust` lazily

---
 CMakeLists.txt                |  1 -
 src/detection/wm/wm_windows.c | 54 ++++++++++++++++++++---------------
 2 files changed, 31 insertions(+), 24 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index ec4525a57..2ff2bdf94 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1737,7 +1737,6 @@ elseif(WIN32)
         PRIVATE "cfgmgr32"
         PRIVATE "winbrand"
         PRIVATE "secur32"
-        PRIVATE "wintrust"
     )
     if(NOT ENABLE_WIN7_COMPAT)
         target_link_libraries(libfastfetch
diff --git a/src/detection/wm/wm_windows.c b/src/detection/wm/wm_windows.c
index 5ea462971..c89339a7f 100644
--- a/src/detection/wm/wm_windows.c
+++ b/src/detection/wm/wm_windows.c
@@ -1,6 +1,7 @@
 #include "wm.h"
 #include "common/mallocHelper.h"
 #include "common/io.h"
+#include "common/library.h"
 #include "common/processing.h"
 #include "common/windows/nt.h"
 #include "common/windows/unicode.h"
@@ -21,6 +22,35 @@ typedef enum {
     FF_PROCESS_TYPE_CUI = 1 << 3,
 } FFProcessType;
 
+bool verifySignature(const wchar_t* filePath)
+{
+    FF_LIBRARY_LOAD(wintrust, true, "wintrust" FF_LIBRARY_EXTENSION, -1)
+    FF_LIBRARY_LOAD_SYMBOL(wintrust, WinVerifyTrustEx, true)
+
+    WINTRUST_FILE_INFO fileInfo = {
+        .cbStruct = sizeof(fileInfo),
+        .pcwszFilePath = filePath,
+    };
+
+    GUID actionID = WINTRUST_ACTION_GENERIC_VERIFY_V2;
+
+    WINTRUST_DATA trustData = {
+        .cbStruct = sizeof(trustData),
+        .dwUIChoice = WTD_UI_NONE,
+        .fdwRevocationChecks = WTD_REVOKE_NONE,
+        .dwUnionChoice = WTD_CHOICE_FILE,
+        .pFile = &fileInfo,
+        .dwStateAction = WTD_STATEACTION_VERIFY,
+        .dwProvFlags = WTD_SAFER_FLAG,
+    };
+
+    LONG status = ffWinVerifyTrustEx(NULL, &actionID, &trustData);
+    trustData.dwStateAction = WTD_STATEACTION_CLOSE;
+    ffWinVerifyTrustEx(NULL, &actionID, &trustData);
+
+    return status == ERROR_SUCCESS;
+}
+
 bool isProcessTrusted(DWORD processId, FFProcessType processType, UNICODE_STRING* buffer, size_t bufSize)
 {
     FF_AUTO_CLOSE_FD HANDLE hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, processId);
@@ -60,29 +90,7 @@ bool isProcessTrusted(DWORD processId, FFProcessType processType, UNICODE_STRING
 
     if (processType & FF_PROCESS_TYPE_SIGNED)
     {
-        WINTRUST_FILE_INFO fileInfo = {
-            .cbStruct = sizeof(fileInfo),
-            .pcwszFilePath = buffer->Buffer,
-        };
-
-        GUID actionID = WINTRUST_ACTION_GENERIC_VERIFY_V2;
-
-        WINTRUST_DATA trustData = {
-            .cbStruct = sizeof(trustData),
-            .dwUIChoice = WTD_UI_NONE,
-            .fdwRevocationChecks = WTD_REVOKE_NONE,
-            .dwUnionChoice = WTD_CHOICE_FILE,
-            .pFile = &fileInfo,
-            .dwStateAction = WTD_STATEACTION_VERIFY,
-            .dwProvFlags = WTD_SAFER_FLAG,
-        };
-
-        LONG status = WinVerifyTrustEx(NULL, &actionID, &trustData);
-        trustData.dwStateAction = WTD_STATEACTION_CLOSE;
-        WinVerifyTrustEx(NULL, &actionID, &trustData);
-
-        if (status != ERROR_SUCCESS)
-            return false;
+        if (!verifySignature(buffer->Buffer)) return false;
     }
 
     if (processType & (FF_PROCESS_TYPE_GUI | FF_PROCESS_TYPE_CUI))