4

Is there any option to set new icon for a signed PE executable in windows without re-signing it again. This means that the icon image, although fully assimilated to the PE file, won't change the hash value as it's appears in the file signature part.

perhaps there's a concept where one can sign only the specific sections in the files such as .text or .data and avoid other parts of the file ?

thanks

Improve this question
1
  • There are some sections excluded from signing, e.g. the certificate section itself (which makes perfect sense). I'm not aware of code signing only parts of an executable.
    – Thomas Weller
    Commented Aug 21, 2019 at 10:08

1 Answer 1

Reset to default
3

This is normally not possible. The icon is part of the resource section (.rsrc) which is covered by the signature so any modification will invalidate it and the binary needs to be re-signed.

There may be some parts of the executable you can change without invalidating the signature, but the resource section is not one of them.

Improve this answer
6
  • I guess you're right ... but why did you say "normally", is there any case where it's possible (when the icon is embedded inside the PE) ?
    – Zohar81
    Commented Aug 21, 2019 at 20:45
  • there may be various implementation flaws, e.g. vcsjones.dev/2016/04/15/authenticode-stuffing-tricks
    – Igor Skochinsky ♦
    Commented Aug 21, 2019 at 21:06
  • Hi, I've followed the information in the article you mentioned by placing the embedded icon in the certificate section right after the pkcs7 structure, and set offsetToData in the icon record to point that place. However, it seems like explorer still cannot find the icon, perhaps its because the file length has exceeded some value inside the pe structure ? are there any more fields I need to set ?
    – Zohar81
    Commented Sep 18, 2019 at 13:57
  • @Zohar81: resources must be a part of the program image (usually .rsrc section). data in the overlay will be ignored by the OS.
    – Igor Skochinsky ♦
    Commented Sep 18, 2019 at 14:02
  • Perhaps there's a way to avoid embedding the icon into the PE file... and instead add to the .rsrc section a path to the icon file, so it could be replaced without damaging file integrity ?
    – Zohar81
    Commented Sep 18, 2019 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.