It's not so difficult to produce two md5-collided exe files

[Git]

B&W - I don't know Wangs stuff yet, but I did some collaborative work on this a few years ago, and it most definitely was not easy to match the CRC's of two exes, where one is an arbitrarily hacked version of the other. It is possible under some fairly simple circumstances but far from easy. We did produce a tool, but it's use was so limited it was not worth doing anything with it. My dim memory reminds me it involved adding a resource to the hacked exe and then altering specific bytes in that resource to match the good exes CRC. I'll see if I still have any source or notes.

Git