A signed program carries its signature in the attribute certificate table, which signing tools append to the end of the file. Data directory 4 locates it, but unlike every other data directory its address is a file offset, not an RVA: the table is not part of the image and is never loaded. The signature is Authenticode: a PKCS #7 signed message holding a hash of the file, the publisher’s certificate chain and usually a time stamp.
WIN_CERTIFICATE
The table is a list of entries, each padded with zeros to a multiple of 8 bytes, up to the size data directory 4 gives:
| Offset | Size | Type | Field | Meaning |
|---|---|---|---|---|
| 0 | 4 | u32 | dwLength | The length of the entry, these 8 bytes included, not counting the padding. |
| 4 | 2 | u16 | wRevision | The revision. |
| 6 | 2 | u16 | wCertificateType | The type of the certificate. |
| 8 | varies | bytes | bCertificate | The certificate: for Authenticode, a DER-encoded PKCS #7 SignedData. |
An Authenticode entry is usually revision 0x0200 and type 2, and its
bCertificate starts 30 82, a DER SEQUENCE with a two-byte length, followed
by the object identifier 1.2.840.113549.1.7.2, signedData
(06 09 2A 86 48 86 F7 0D 01 07 02). The table usually ends exactly at the
end of the file. The signature’s
hash covers the whole file except three things: the CheckSum field, data directory 4
itself, and the certificate table. So adding the signature does not change the hash
it signs.
Apple’s .efi files put something else at data directory 4; the explorer
reports an entry whose length runs past the table. About 160 of the PE files examined
for this site had a certificate table.
Revisions and types
| Field | Value | Name | Meaning |
|---|---|---|---|
| wRevision | 0x0100 | WIN_CERT_REVISION_1_0 | Version 1, the legacy form. |
| wRevision | 0x0200 | WIN_CERT_REVISION_2_0 | Version 2, the current form. |
| wCertificateType | 1 | WIN_CERT_TYPE_X509 | An X.509 certificate. Not supported by Windows. |
| wCertificateType | 2 | WIN_CERT_TYPE_PKCS_SIGNED_DATA | A PKCS #7 SignedData: Authenticode. |
| wCertificateType | 3 | WIN_CERT_TYPE_RESERVED_1 | Reserved. |
| wCertificateType | 4 | WIN_CERT_TYPE_TS_STACK_SIGNED | Terminal Server protocol stack signing. Not supported. |
The explorer shows each entry’s header, the DER bytes and the padding, and says in the Program tab that the file is signed. It does not check the signature.