3 ms·
how does this get through the MS smartscreen and authenticode checks?
by blibble 5y ago
how does this get through the MS smartscreen and authenticode checks?
- laurent123456 5y agoAs long as the executable is signed (and it must be), and the company well known, Windows should be fine with it.
- dataflow 5y agoIn fact this is how you get past SmartScreen checks. Windows freaks out a lot more when it sees the same file being downloaded by lots of people, but if you make them all different, then it calms down.
- eps 5y agoThere is a way to add random data to signed executables without invalidating the sig. Data, not code. Smartscreen is bypassed by using EV sig, which gives the exe an instant reputation boost.
- blex 5y agoWould you have documentation about this? Where can random bytes be added to a signed exe without invalidating the sig?
- blex 5y agoYes, how does the .exe keep its valid digital signature if the hash of the .exe is modified for each person? Would someone have documentation about which bytes we can modify in a code-signed .exe without making the digital signature invalid? In the case it's not possible, does this mean Mozilla generates a new .exe on the fly + codesigns the .exe on the fly for each new download?