Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have had some binary executable files (.exe) for Windows signed, I have checked the signature of the signed files, but I would also like to check that the file that I sent for signing is indeed identical to the signed file that I got back.
Obviously, the sha-256 hash of the signed and unsigned version of the executable file will not be identical since the signed file includes the signature.
So, how do I compare a signed .exe file with the unsigned version of the same .exe file on Windows?
I have solved my problem, and I will just post the solution that I ended up using.
As @mti2935 mentioned the Microsoft signtool can be used to remove the signature of the files with the remove option.
But in my case, removing the signature did not result in the sha-256's being identical for the original unsigned file and for the signed file with the signature removed. After looking at a binary diff of the two files and some reverse engineering of the PE file format. It turns out that there is a checksum field in the PE Optional Header that is set to zero by the compiler. The Microsoft Signtool does set this checksum initially when the signature is added and again when the signature is removed. This is the reason that the sha-256 sums of the unsigned file and of the file with the signature removed.
After setting the 4 bytes of the checksum to 0 in the file with the signature removed, the sha-256 sum is identical to the original unsigned file.
signtoolappends a signature to a Windows .exe file: stackoverflow.com/questions/47646135/… Perhaps it's possible to reverse-engineer this process to remove the signature from the signed file, then compare this file to the unsigned file.