It's not so difficult to produce two md5-collided exe files

[Kerlingen]

I don't really get it. In order to produce two EXE with identical MD5, the two EXE must be identical before appending the overlay. This way it's not possible to produce one fraudulent EXE with the same MD5 as the original EXE.

You can only append different random data producing the same MD5, but this cannot influence the execution of the EXE since it doesn't rely on that information in it's unmodified state (the overlay is not present in the unmodified state).

[BlackWhite]

Originally Posted by Kerlingen

I don't really get it. In order to produce two EXE with identical MD5, the two EXE must be identical before appending the overlay. This way it's not possible to produce one fraudulent EXE with the same MD5 as the original EXE.

You can only append different random data producing the same MD5, but this cannot influence the execution of the EXE since it doesn't rely on that information in it's unmodified state (the overlay is not present in the unmodified state).

1. You may take func1() as exe1, and func2() as exe2

2. Though md5_1 & md5_2 seem random and their values rely on the
compiled exe file, yet there are rules in the variation according to Wang's
theory, and you can rely on the difference of one bit located at some position say byte 0x13 bit 7
between md5_1 & md5_2 to control the execution of func1() or func2().

[Kerlingen]

You only influence the execution from an external source. If the software you're trying does not rely on an external source (and why would it ever do that?), you have no way to change the execution path, since you cannot modify any code without blowing up the hash.

[BlackWhite]

Originally Posted by Kerlingen

You only influence the execution from an external source. If the software you're trying does not rely on an external source (and why would it ever do that?), you have no way to change the execution path, since you cannot modify any code without blowing up the hash.

Given two actual exe files say 1.exe & 2.exe, you can put them into the
combined exe's resources, and the combined exe can choose to run
1.exe or 2.exe according to the bit difference between md5_1 & md5_2,
thus the combined exe runs as if 1.exe or 2.exe is running.