The PE file was successfully signed, then modified, and signed again using jsign.

[shgchen]

Hi bro,
I encountered a problem today.
I had a PE file (exe) that was successfully signed, and I made some modifications.
Then, I signed it again using signtool and jsign.
I found that signtool signed it successfully, and the file attributes showed a 'signature';
however, jsign signed it successfully, but the file attributes did not show a 'signature'.

[ebourg]

Could you please send the 4 files (signed, modified, signed again by signtool and signed again by Jsign) to ebourg@apache.org? I'll investigate this.

[shgchen]

Sorry, I just saw this email. I sent you a separate one. Emmanuel Bourg ***@***.***> 于2025年11月7日周五 20:25写道：

…

Could you please send the 4 files (signed, modified, signed again by signtool and signed again by Jsign) to ***@***.***? I'll investigate this. — Reply to this email directly, view it on GitHub <#331 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AWQS6AUIRTP2WYL54SRTYET33SFSJAVCNFSM6AAAAACLNIIYZ6VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIOJQGIYDSOA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[shgchen]

I only have 3 files (the jsign version I'm using is from the repository dated March 23, 2023). 1）modified（It can be opened normally.）： mini_installer.renamed.exe <https://drive.google.com/file/d/1eD-cGBz5_36VucOwRnuX6--rHtMJT_83/view?usp=drive_web> （2）sign-by signtool（The file attributes include a "signature".）： mini_installer.重命名signtool-signed.exe <https://drive.google.com/file/d/1vDk14DYP2MO545LQ5XFNydoAI_wWbGuK/view?usp=drive_web> （3）sign-by jsign（The file attributes do not include a "signature".）： mini_installer.renamed。signed-jsign-signed.exe <https://drive.google.com/file/d/18yZDV7e2dVF0Z81-fZhZKUBvEd_9MSc3/view?usp=drive_web> However, my signature verification shows it's valid. Below is my simple CAPTCHA. This confuses me. <1>signed certificate verify SignerInformationVerifier verifier = new JcaSimpleSignerInfoVerifierBuilder ().build(cert); boolean verify = signer.verify(verifier);// verify is true <2>file digest hash verify(file hash) String content = signedData.getSignedContent().getContent().toString(); ContentInfo contentInfo = signable.createContentInfo(digestAlgorithm); DigestInfo digestInfo = DigestInfo.getInstance(contentInfo.getContent());byte[] digestValue = digestInfo.getDigest(); String fileHash = Hex.encodeHexString(digestValue).toUpperCase(); boolean verify = BooleanUtils.to(content.equal(fileHash));// verify is true// verify is true

[shgchen]

ok，I know where the problem lies.
I tried deleting the signature using code, and the certificates block was successfully deleted.
However, I didn't move the pointer to 'certificates' because I don't understand the specific specifications of PE files.
Today, I tried using other tools to delete the signature, and the logs showed the specific problem with the PE file.
The file was successfully signed.
Could you add a feature to automatically repair the PE header in the future?
Today's test results：

[ebourg]

I'll inspect your files and see if it's recoverable. If that helps note that Jsign has an option to remove a signature:

jsign remove application.exe

[shgchen]

I'll try.But it failed.This PE file is not standard.

[shgchen]

Faced with the corrupted file, I tried deleting it using jsign code signing, which succeeded and the signature was effective. However, the file still couldn't be opened normally. It seems I still need to use the delcert tool to repair the PE file. I'll give up for now and leave it at that. Thank you for your reply.

[ebourg]

I got a look at the files you sent. mini_installer.renamed.exe is corrupted, the header specifies a certificate table at offset 0x0A65FC00 but that's the location of the assembly manifest. signtool (version 10.0.22612.1778) refuses to sign it, and so does Jsign 7.4 and osslsigncode. I've tested all versions of Jsign, only Jsign 1.3 accepts to sign it.

I don't know how you modified the files, but you really shouldn't modify it once it's signed. And if you really have to, remove the signature first, modify and then sign. If you use a tool to modify the file, ensure that it is able to move the certificate table properly.