I'm looking to improve defense-in-depth on a system, primarily by closing some holes in injected DLLs. Certain applications installed on the system cause helper DLLs (e.g. shell extensions, BHOs, etc.) to be loaded into processes. Unfortunately, many of these were not compiled with ASLR / DEP opt-in flags. Since the affected processes are prime targets for exploitation, I've been going through manually and patching the support in so that so-called "universal" ROP chains can't be exploited.
One side-effect of my changes is that a lot of the components now have invalid code signatures. This doesn't seem to have broken anything, but I'd like to re-sign them with a locally installed certificate, using some kind of personal root certificate as a parent. As a bonus, I can take advantage of the force integrity flag.
What steps should I take to do the following?
- Create and install a root certificate, with a child (intermediate?) certificate for code signing.
- Strip the existing certificates from binaries.
- Re-sign binaries with the new certificate.
I've never really messed with the certificate store on Windows, beyond a few quick forays into checking existing ones or installing the Burp CA, so I'm a little lost here. Is OpenSSL a good option for generating the certificates, or is there a better Windows-specific solution? What tools are ideal for re-signing binaries?