SigCheck crash using -i

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

   Testing Sigcheck.exe v1.80, I discovered an issue with -i parameter.

Testing on a corrupted .exe, using -i causes:

        Verified:       The digital signature of the object did not verify.
        Signing date:   2:21 PM 9/18/2012
        Counter Signer:
           ?????▀??

and a crash of Sigcheck.exe occurs.

For my test, I simply copied sigcheck.exe to corrupt.exe (so that I could easily identify it).

Using a hex editor, I changed corrupt.exe, byte offset 0x270 from 00h to FFh. This 1-byte change 'should' invalidate the signature as the file hash, etc. are no longer valid.

run the commands:
sigcheck.exe -accepteula -a -h -i -q corrupt.exe              crash occurs.
sigcheck.exe -accepteula -a -h -q corrupt.exe                 No crash.
sigcheck.exe -accepteula -a -h -i -q sigcheck.exe            No crash.

Using -i with Sigcheck.exe v1.71 does not cause this crash on corrupted .exe files.

Thanks,
Ron Metzger