Another security question for whomever can help.

As I understand it (please correct me if I am wrong), the digital
signature applied with something like signtool.exe incorporates a
checksum but otherwise does not alter the file structure (such as
the code and data sections). Is it feasable for a cracker to
infect an exe with a patch while still causing the checksum to be
calculated with the same result (maybe by adding or removing bogus
instructions), thus forging the signed exe?

More importantly, what recommendations do any of you have for
protecting PE files that you want to sell (from reverse
engineering)? It looks like a common way of doing this is to use
some sort of "packer" that either compresses, encrypts, or both,
the code section of the PE file, which is then
uncompressed/decrypted and somehow loaded by the entry point
function at runtime. Is it very difficult to write your own
program to do something like this, or is there a decent commercial
product to start with that is known to work well? When I search
for stuff like this I seem to find some whitepapers but otherwise
endless dead links . . .

Thanks,
Erik

On 4/6/2012 7:33 AM, Erik Weber wrote:
> Another security question for whomever can help.
>
> As I understand it (please correct me if I am wrong), the digital
> signature applied with something like signtool.exe incorporates a
> checksum but otherwise does not alter the file structure (such as
> the code and data sections). Is it feasable for a cracker to
> infect an exe with a patch while still causing the checksum to be
> calculated with the same result (maybe by adding or removing bogus
> instructions), thus forging the signed exe?

Yes.


> More importantly, what recommendations do any of you have for
> protecting PE files that you want to sell (from reverse
> engineering)? It looks like a common way of doing this is to use
> some sort of "packer" that either compresses, encrypts, or both,
> the code section of the PE file, which is then
> uncompressed/decrypted and somehow loaded by the entry point
> function at runtime. Is it very difficult to write your own
> program to do something like this, or is there a decent commercial
> product to start with that is known to work well? When I search
> for stuff like this I seem to find some whitepapers but otherwise
> endless dead links . . .

It's a lost cause to try and prevent people from disassembling your PE file.

Thanks.