Authenticode - Signtools /di - Sign the hash of a file with an external tool

Question

Hello,

I try to use signtool to sign the hash of an executable file with an external tool.

Unfortunately the option /di to inject the sign hash doesn't work.
There is no error message, but when I check the properties of the file there is the message "no signature was present in the subject", the cert is present but not the signature it seems.

I have followed vcsjones.dev on Custom Keys with Authenticode Signing

• Compute the hash and add the public cert:
  signtool sign /dg "C:\scratch\dir" /fd SHA256 /f public-cert.cer notepad.exe
• Decode the base64 hash (I have tried also without decoding)
• Sign the hash with an external tool (RSA 1.5 - 4096 - SHA256)
• Encode the signature in base64 (I have tried also without encoding)
• Inject the signature (add a .signed file)
  signtool sign /di "C:\scratch\dir" notepad.exe

I think the problem is from the signature returned by my external tool but there is no much documentation on how to use and what signature is expected.

I try different permutation since 3 weeks now, any help will be so much appreciated.

Answer 1

The solution is to add the SHA header to the digest before signing it. The digest provided by Signtools does not contain this header, even though it is necessary for the signature to be recognized by Signtools.

It should be documented ...