|
Steps:
1. Determine whether the file is 32-bit or 64-bit based on the magic number. (010B or 020B)
2. Locate the Security Directory in the PE HEADER using its RVA and size, and remove the corresponding signature content from the file. ( The signature content is at the end of the file. )
3. Clear the RVA and size fields of the Security Directory.
4. Recalculate the checksum and update it.
You could handle the sys file with tools, e.g. winhex +lordpe.
I have made the python file to do this.
Attachment is the python file and the sys file (already remove the sign)
Last edited by wx69wx2023; 11-24-2024 at 13:08.
|