2

I am using signtool.exe to sign exe file. I am trying to embed my exe file with the .pfx certificate along with the signed hash of exe(generated signed hash using openssl). I am able to sign only with certificate. But I need to embed the signed hash in the exe as well. Probably signtool.exe sign /as could help. /as option does not expect any argument so not able to pass my hash there.

Could someone please help me sign my exe with certificate and hash.

Thanks,

Ravi
  • 21
  • 3

1 Answers1

3

The version of Signtool shipped with the Windows 10 SDK includes the capability to embed a signed hash into an exe.

From the following page: https://vcsjones.com/2017/05/07/custom-authenticode-signing/

Starting in the Windows 10 SDK, two new command line switches are available, dg and di. Recall that a signature is always performed on a hash on Authenticode. The dg option changes signtool’s behavior to output a digest that you can sign using anything you’d like. Let’s try this on a copy of notepad.exe.

signtool sign /dg "C:\scratch\dir" /fd SHA256 /f public-cert.cer notepad.exe

This takes a file to a public certificate - there is no key in public-cert.cer. You could also use the /sha1 option to specify a certificate in the certificate store that also has only a public key. This will output a few files in the “C:\scratch\dir” directory. The digest is the one with the “.dig” extension. This file will have the Base64 encoded digest to sign. Next, using your custom tool, sign the digest with the private key for the certificate. You should decode the Base64 signature before signing if the signing API expects a raw binary digest.

Next, encode your signature in base64 and place it in a file in the “C:\scratch\dir” directory with the same name as the digest file, with the “signed” extension. For example, “notepad.exe.dig.signed”.

The next step is to ingest the signed digest along with the rest of the Authenticode signature to complete the signing.

signtool sign /di "C:\scratch\dir" notepad.exe

This will complete the signing process, and we now have our own signed copy of notepad.exe. Appending a signature is done just as before, except with the /as flag.

This provides great flexibility for signers to use non CSP / CNG signing options, or offloading the signing process. Signtool can now also sign just a plain digest file using the /ds option. If you have a dedicated server for performing Authenticode signing, you can now use the /dg, /ds, /di options so that only a very small file needs to be moved to the signing server, instead of the entirely binary if they are large in size.

Gregordinary
  • 131
  • 2
  • 1
    Unfortunately, this does not work: SignTool Error: The /dg /ds /di option is incompatible with the /seal /itos /as option. – Alex I Sep 13 '19 at 21:31
  • The /as flag is only needed when appending an additional signature. If there is only one signature then just using the /di flag should work. If you get an error that no signature is present, your signed digest is probably wrong. – Dan Dec 05 '19 at 19:40