Properly signed code identifies the author and has a signature that validates correctly, as shown below.
In a Web browser, go to
https://www.oracle.com/java/technologies/javase-jdk15-downloads.html
Download the Windows x64 Installer, as shown below.
Run the installer and install the software with the default options.
On my system, the path was
C:\Program Files\Java\jdk-15.0.2\binas shown below.
In the System window, on the left side, click "Advanced system settings".
In System Properties, on the Advanced tab, click the "Environment Variables..." button.
In the "Environment Variables" box, at the top, double-click Path.
In the "Edit environment variable" box, on the right side, click the New button.
Enter the path to the Java "bin" folder on the new line, as shown below.
Click OK.
Click OK.
Then execute these commands:
java -version
keytool
Both commands should run without
errors,
as shown below.
https://github.com/ebourg/jsign/releases/tag/3.1
Download jsign-3.1.jar and save it in your Downloads folder.
Save smiley.exe in your Downloads folder.
In the Command Prompt window, execute these commands:
cd
cd Downloads
keytool -genkey -v -keystore self-signed.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 365
A prompt asks for a "keystore password". Enter password twice.
Then a series of question asks for your name, etc. You can press Enter for each question except the last one, which you must answer yes to, as shown below.
keytool -list -v -keystore self-signed.keystore | more
When it asks for a password, enter password
The alias is alias_name, as shown below.
copy smiley.exe smiley_selfsigned.exe
java -jar jsign-3.1.jar --keystore self-signed.keystore --alias alias_name ^
--storepass password --tsaurl http://ts.ssl.com --tsmode RFC3161 smiley_selfsigned.exe
dir
The file is signed, and becomes
several kilobytes larger than the
unsigned version,
as shown below.
Flag M 412.1: Error (10 pts)
In Windows Explorer, open your Downloads folder. Right-click smiley_selfsigned.exe and click Properties.On the "Digital Signatures" tab, click the Unknown name.
Click the Details button.
The flag is the word covered by a green rectangle in the image below.
If you don't have it already, download and install HxD from:
In the Command Prompt window, execute this command.
copy smiley_selfsigned.exe smiley_altered.exe
Launch HxD and open
smiley_altered.exe.
Change the word DOS to DAS, as shown below, and then save the file.
Flag M 412.2: Status (5 pts)
In Windows Explorer, open your Downloads folder. Right-click smiley_altered.exe and click Properties.On the "Digital Signatures" tab, click the Unknown name.
Click the Details button.
The flag is the word covered by a green rectangle in the image below.
Microsoft Authenticode Code Signing in Linux with Jsign