petools icon indicating copy to clipboard operation
petools copied to clipboard

Digital Signature corruption on adding new import

Open greenozon opened this issue 6 years ago • 2 comments

Info

Once you add a new dll into Import Section the existing "Digital Signatures" tab stops to show in File Properties

Details

Open up your exe with Digital Signature present go to Directories -> Import Directory Right click on dll list, click "Add Imports..." Fill in

  • new section name
  • Dll name
  • API name

click OK Save your file

open up File properties in explorer - "DIgital SIgnatures" section is gone.

Here is a visual comparison of added section data (left) and old certificate data that was corrupted (right)

http://prntscr.com/jbcdnf

Tool used - http://prntscr.com/jbcee0

greenozon avatar Apr 28 '18 18:04 greenozon

Bug Status

  • Confirmed
  • Initially reported by @greenozon
  • Checked by @upiter

Workaround

  • Remove certificates before any modification

Bug fix Progress

  • Added to non-critical bug list
  • Possible bug fix date: not assigned

Bug fix Suggestion

  • Check for presence of digital signatures (certificate info)
  • Warn in case of modification and propose to remove digital signature from file
  • Add an option to automatically remove any digital signatures from file in case of any modification

upiter avatar Apr 30 '18 23:04 upiter

Thank you for accepting the issue, I'd like to say that Workaround might be good for some cases, but thats not my case. As far as I see certificate is embedded into executable as overlay, maybe thats the reason of mis-behavior?

Anyway, digital certs removal as an option is already present, so it might be done for sure by hands, but this issue goal is to automatically take into account the fact of presence of digital cert in case when one is adding new import... is it doable? I tried some other tools - all are corrupting cert in this scenario, so that might be a magic feature successfully performed by this grand tool

PS I understand that purpose of cert is to ensure the input file is genuine, but... in some cases this is still an option to leave it as is. so ideally would be to ask user in twofold- a) remove cert b) leave it and do the job

greenozon avatar May 01 '18 06:05 greenozon