Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I cannot find any specific information about how is code signing implemented in Windows (specifically PE executables).
I only find a lot of tutorials on how to sign an app but this is not what I want. I’m looking for low-level details.
I’m writing an article about security and data integrity and can’t find any information whether a signed code could possibly be “unsigned” by malware.
Thanks.
Yes, the signature can be removed easily. The point of the signature is to prove authenticity of the software. The signature is not intended to be used for protection of code.
Windows PE code signing is properly named “Microsoft Authenticode” and doing google search for Authenticode will give you plenty of information about internal structure. But I think I’ve answered your real question above.