3 ms·
Modifying the binary should change it's digital signature, making it invalid in the first place. Running unsigned code is running arbitrary code
by satanspastaroll 7y ago
Modifying the binary should change it's digital signature, making it invalid in the first place. Running unsigned code is running arbitrary code
- badrabbit 7y agoNo,what I meant was the header containing the signature does not get included in PE sig verification, since sig/certs are part of the header to begin with, or at least large parts of the header are not included. I vaguely remember bypass techniques that depended on this.