"unknown publisher" after adding new PE section

Question

I'm starting to learn about reverse engineering and I'm currently encountering a problem with a game I'm trying to patch. I needed more space to insert instructions in my program so I followed the method described here: https://stackoverflow.com/questions/35685589/how-do-i-make-space-for-my-code-cave-in-a-windows-pe-32bit-executable and added a new section where I could put my new instructions. Then when I run the program, the instructions are properly executed, no crash happening.

My issue is that when I'm launching the game, I get a popup asking if I want to "allow this app from an unknown publisher to make changes to your device", which is annoying. If I display the "Details" tab in the properties of the file, most of the information (such as File Description, File version...) are missing when they were there before the patch. Is it an expected consequence of adding a new section at the end of the executable? It looks like those information are inside the .rsrc section. And is there something I can do to fix it so I don't get the popup?

Answer 1

By adding an additional section you have broken the Authenticode signature.

There is a great primer about how signatures work and are validated on this blog, which says:

Integrity: Each Authenticode signature includes a cryptographic hash of the signed binary. This hash is compared against the binary’s in-memory representation at load time, preventing malicious modifications.

Technically it prevents all modifications, not just malicious ones. Crucially, the Authenticode signature covers all data except (also see Note 1):

• The PE checksum.
• The certificate data directory entry.
• The certificate table (and signatures).

This article discusses various ways of potentially breaking the Authenticode model (but none are likely to help what you are trying to do).

Authenticode is designed to stop what you are attempting: modifying the executable without providing a warning. Other runtime code injection techniques are not prevented (except perhaps in device drivers), so you could potentially modify the code in a different way.

---

Note 1 - The PE "overlay" was historically not covered, but see Microsoft's details about MS13-098 and security advisory 2915720.

Answer 2

If changing the signature won't affect the game (i.e. no part of the game checks the publisher, which is rare) you can simply create your own certificate, install it and use it to resign the application after the changes. Alternatively, you can remove it.

Authenticode signature is the cryptographic way to prove that the binaries haven't been tampered with after publishing. If you sign the application again, you become the publisher.

You can start from MSDN.