2

Is there any option to set new icon for a signed PE executable in windows without re-signing it again. This means that the icon image, although fully assimilated to the PE file, won't change the hash value as it's appears in the file signature part.

perhaps there's a concept where one can sign only the specific sections in the files such as .text or .data and avoid other parts of the file ?

thanks

  • There are some sections excluded from signing, e.g. the certificate section itself (which makes perfect sense). I'm not aware of code signing only parts of an executable. – Thomas Weller Aug 21 at 10:08
2

This is normally not possible. The icon is part of the resource section (.rsrc) which is covered by the signature so any modification will invalidate it and the binary needs to be re-signed.

There may be some parts of the executable you can change without invalidating the signature, but the resource section is not one of them.

  • I guess you're right ... but why did you say "normally", is there any case where it's possible (when the icon is embedded inside the PE) ? – Zohar81 Aug 21 at 20:45
  • there may be various implementation flaws, e.g. vcsjones.dev/2016/04/15/authenticode-stuffing-tricks – Igor Skochinsky Aug 21 at 21:06
  • Hi, I've followed the information in the article you mentioned by placing the embedded icon in the certificate section right after the pkcs7 structure, and set offsetToData in the icon record to point that place. However, it seems like explorer still cannot find the icon, perhaps its because the file length has exceeded some value inside the pe structure ? are there any more fields I need to set ? – Zohar81 Sep 18 at 13:57
  • @Zohar81: resources must be a part of the program image (usually .rsrc section). data in the overlay will be ignored by the OS. – Igor Skochinsky Sep 18 at 14:02
  • Perhaps there's a way to avoid embedding the icon into the PE file... and instead add to the .rsrc section a path to the icon file, so it could be replaced without damaging file integrity ? – Zohar81 Sep 18 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.