A signed program carries its signature in the attribute certificate table, which signing tools append to the end of the file. Data directory 4 locates it, but unlike every other data directory its address is a file offset, not an RVA: the table is not part of the image and is never loaded. The signature is Authenticode: a PKCS #7 signed message holding a hash of the file, the publisher’s certificate chain and usually a time stamp.
WIN_CERTIFICATE
The table is a list of entries, each padded with zeros to a multiple of 8 bytes, up to the size data directory 4 gives:
| Offset | Size | Type | Field | Meaning |
|---|---|---|---|---|
| 0 | 4 | u32 | dwLength | The length of the entry, these 8 bytes included, not counting the padding. |
| 4 | 2 | u16 | wRevision | The revision. |
| 6 | 2 | u16 | wCertificateType | The type of the certificate. |
| 8 | varies | bytes | bCertificate | The certificate: for Authenticode, a DER-encoded PKCS #7 SignedData. |
00012C00 18 1B 00 00 00 02 02 00 30 82 1B 05 06 09 2A 86
00012C10 48 86 F7 0D 01 07 02 A0 82 1A F6 30 82 1A F2 020x12C00: 6,936 bytes, revision 2.0, PKCS signed data. The DER starts with a SEQUENCE (30 82 1B 05) and the object identifier 1.2.840.113549.1.7.2, signedData.That entry ends exactly at the end of the file, as it usually does. The signature’s hash covers the whole file except three things: the CheckSum field, data directory 4 itself, and the certificate table. So adding the signature does not change the hash it signs.
Apple’s .efi files put something else at data directory 4; the explorer
reports an entry whose length runs past the table. About 160 of the PE files examined
for this site had a certificate table.
Revisions and types
| Field | Value | Name | Meaning |
|---|---|---|---|
| wRevision | 0x0100 | WIN_CERT_REVISION_1_0 | Version 1, the legacy form. |
| wRevision | 0x0200 | WIN_CERT_REVISION_2_0 | Version 2, the current form. |
| wCertificateType | 1 | WIN_CERT_TYPE_X509 | An X.509 certificate. Not supported by Windows. |
| wCertificateType | 2 | WIN_CERT_TYPE_PKCS_SIGNED_DATA | A PKCS #7 SignedData: Authenticode. |
| wCertificateType | 3 | WIN_CERT_TYPE_RESERVED_1 | Reserved. |
| wCertificateType | 4 | WIN_CERT_TYPE_TS_STACK_SIGNED | Terminal Server protocol stack signing. Not supported. |
The explorer shows each entry’s header, the DER bytes and the padding, and says in the Program tab that the file is signed. It does not check the signature.