Question

From what I understand about digital signatures, when code-signing exe’s it the “signer” modifies the PE itself. I noticed that it adds the certificate content to the end of the PE and also (obviously) adds some kind of reference to the headers.

My question is: How secure is this ? Wouldn’t someone capable of reverse engineering the executable be able to forge that onto his own executable thereby forging a digital signature ?

Answer 1

Code signing is a public-private key operation. The signing operation calculates a hash of the .exe file (minus the bits where the signature is stored), then encrypts the hash with the signer’s private key.

On client-side validation, the client will redo the hash calculation, and decrypt the stored signature using the public key. If the two hashes match, then the exe has not been tampered with.

The only bits of the file are are encrypted are the signature – everythign else is stored in the clear. Nothing stops you from ripping apart the exe and stuff it (or parts of it) into another .exe.

Signing is not there to prevent theft – it’s there to detect tampering.