Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 09-06-2020, 21:34
jonwil jonwil is offline
VIP
 
Join Date: Feb 2004
Posts: 387
Rept. Given: 2
Rept. Rcvd 21 Times in 9 Posts
Thanks Given: 2
Thanks Rcvd at 65 Times in 34 Posts
jonwil Reputation: 21
Remove signature from windows DLL?

I have a 64-bit windows DLL with a digital signature. I want to remove the signature so I can modify the DLL (I know the program that uses the DLL doesn't care about the signature). Is there a tool that can remove the signature without affecting anything else in the DLL?
Reply With Quote
  #2  
Old 09-06-2020, 22:34
bolo2002 bolo2002 is offline
VIP
 
Join Date: Apr 2002
Posts: 614
Rept. Given: 111
Rept. Rcvd 14 Times in 13 Posts
Thanks Given: 217
Thanks Rcvd at 238 Times in 152 Posts
bolo2002 Reputation: 14
unsigntool or delcert.exe inside,dunno if it can help.
Attached Files
File Type: zip unsign.zip (9.2 KB, 14 views)
__________________
I like this forum!
Reply With Quote
  #3  
Old 09-07-2020, 03:03
LaDidi LaDidi is offline
VIP
 
Join Date: Aug 2004
Posts: 210
Rept. Given: 2
Rept. Rcvd 11 Times in 10 Posts
Thanks Given: 46
Thanks Rcvd at 41 Times in 24 Posts
LaDidi Reputation: 11
@jonwill :
You may use CFF Explorer and reset table for signature :
* Security Table RVA
* Security Table Size
Reply With Quote
  #4  
Old 09-08-2020, 03:27
Archer's Avatar
Archer Archer is offline
retired
 
Join Date: Aug 2005
Posts: 239
Rept. Given: 1
Rept. Rcvd 46 Times in 19 Posts
Thanks Given: 3
Thanks Rcvd at 387 Times in 57 Posts
Archer Reputation: 46
Quote:
Originally Posted by LaDidi View Post
@jonwill :
You may use CFF Explorer and reset table for signature :
* Security Table RVA
* Security Table Size
You may also need to clear IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY flag in DLL Characteristics. And probably you'll want to remove overlay where signature is located.
Reply With Quote
The Following 2 Users Say Thank You to Archer For This Useful Post:
Abaddon (09-08-2020), tonyweb (09-13-2020)
  #5  
Old 09-08-2020, 14:04
LaDidi LaDidi is offline
VIP
 
Join Date: Aug 2004
Posts: 210
Rept. Given: 2
Rept. Rcvd 11 Times in 10 Posts
Thanks Given: 46
Thanks Rcvd at 41 Times in 24 Posts
LaDidi Reputation: 11
@ARCHER :
Never saw this flag.
I will check it
Reply With Quote
  #6  
Old 09-09-2020, 14:58
LaDidi LaDidi is offline
VIP
 
Join Date: Aug 2004
Posts: 210
Rept. Given: 2
Rept. Rcvd 11 Times in 10 Posts
Thanks Given: 46
Thanks Rcvd at 41 Times in 24 Posts
LaDidi Reputation: 11
@Archer :
Effectively, it exists and it's used by Windows.
Happy to learn something "new"...
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
ARK for WINDOWS x64: WIN64AST(with digital signature) exeu x64 OS 1 05-01-2013 07:12


All times are GMT +8. The time now is 17:16.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )