1

I have had some binary executable files (.exe) for Windows signed, I have checked the signature of the signed files, but I would also like to check that the file that I sent for signing is indeed identical to the signed file that I got back.

Obviously, the sha-256 hash of the signed and unsigned version of the executable file will not be identical since the signed file includes the signature.

So, how do I compare a signed .exe file with the unsigned version of the same .exe file on Windows?

2
  • 1
    The following page on stackoverflow looks like it contains some information on how signtool appends a signature to a Windows .exe file: stackoverflow.com/questions/47646135/… Perhaps it's possible to reverse-engineer this process to remove the signature from the signed file, then compare this file to the unsigned file.
    – mti2935
    May 25, 2022 at 19:51
  • @mti2935 Thanks for the suggestion. I tried removing the signature with the signtool. The signature was removed, but afterwards the sha256 hash was not the same as of the original file. It seems that some metadata had changed. May 31, 2022 at 5:47

1 Answer 1

4

I have solved my problem, and I will just post the solution that I ended up using.

As @mti2935 mentioned the Microsoft signtool can be used to remove the signature of the files with the remove option.

But in my case, removing the signature did not result in the sha-256's being identical for the original unsigned file and for the signed file with the signature removed. After looking at a binary diff of the two files and some reverse engineering of the PE file format. It turns out that there is a checksum field in the PE Optional Header that is set to zero by the compiler. The Microsoft Signtool does set this checksum initially when the signature is added and again when the signature is removed. This is the reason that the sha-256 sums of the unsigned file and of the file with the signature removed.

After setting the 4 bytes of the checksum to 0 in the file with the signature removed, the sha-256 sum is identical to the original unsigned file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .