Exetools  

Go Back   Exetools > General > Source Code

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #35  
Old 11-24-2024, 12:27
wx69wx2023 wx69wx2023 is offline
Family
 
Join Date: Sep 2023
Posts: 316
Rept. Given: 48
Rept. Rcvd 59 Times in 34 Posts
Thanks Given: 586
Thanks Rcvd at 877 Times in 230 Posts
wx69wx2023 Reputation: 59
Steps:

1. Determine whether the file is 32-bit or 64-bit based on the magic number. (010B or 020B)

2. Locate the Security Directory in the PE HEADER using its RVA and size, and remove the corresponding signature content from the file. ( The signature content is at the end of the file. )

3. Clear the RVA and size fields of the Security Directory.

4. Recalculate the checksum and update it.

You could handle the sys file with tools, e.g. winhex +lordpe.

I have made the python file to do this.

Attachment is the python file and the sys file (already remove the sign)
Attached Files
File Type: 7z remove_signature.7z (1.18 MB, 12 views)

Last edited by wx69wx2023; 11-24-2024 at 13:08.
Reply With Quote
The Following User Gave Reputation+1 to wx69wx2023 For This Useful Post:
niculaita (11-24-2024)
The Following 3 Users Say Thank You to wx69wx2023 For This Useful Post:
besoeso (11-24-2024), niculaita (11-24-2024), uranus64 (11-24-2024)
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On


Similar Threads
Thread Thread Starter Forum Replies Last Post
VMProtect Source Code Potentially Leaked atom0s General Discussion 12 11-23-2022 04:21
Leaked Alder Lake BIOS Source Code DavidXanatos General Discussion 5 11-02-2022 19:35
Microsoft 37GB source code leaked? WhoCares General Discussion 14 05-30-2022 18:56


All times are GMT +8. The time now is 20:08.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )