Comments on: Disitool

By: Didier Stevens

Didier Stevens — Fri, 16 Dec 2011 10:08:15 +0000

@Andrew That means that your test.exe is not a valid executable, pefile can’t read the header. You’ll need to obtain a valid copy.

By: Andrew Eustance

Andrew Eustance — Fri, 16 Dec 2011 10:05:15 +0000

Hi,
I ran the command and it came back with the following error

pefile.PEFormatError: ‘Unable to read the DOS Header, possibly a truncated file.

Can you advise

Andy

By: Didier Stevens

Didier Stevens — Fri, 16 Dec 2011 09:58:57 +0000

@Andrew OK, so the program executes correctly. Say you want to remove the digital signature from c:\test.exe. Then you issue this command: disitool.py delete test.exe test2.exe
File test.exe will remain untouched, and test2.exe is a new file without the signature.

By: Andrew Eustance

Andrew Eustance — Fri, 16 Dec 2011 09:54:58 +0000

Hi,
I have placed the disitool.py file on C:, ran the command disitool.py form the command prompt with the disitool.py usage command options and a list of commands that can be ran follows.

Andy

By: Didier Stevens

Didier Stevens — Fri, 16 Dec 2011 09:50:25 +0000

@Andrew Did you run that from cmd.exe? Start cmd.exe from the start menu, CD to the directory where you downloaded disitool.py, and type disitool.py.

By: Andrew Eustance

Andrew Eustance — Fri, 16 Dec 2011 09:47:15 +0000

Hi,
the response I got back was
Traceback (most recent call last):
File “”, line 1, in
disitool.py
NameError: name ‘disitool’ is not defined
I am running the software on a Windows 7 32 bit laptop, Python v2.7.2 has been installed and the ‘pefile’ module was loaded in the gui from the file menu. Then the Disitool module was loaded and ran in the same manner. All the files have been added to the C:\Python27\Lib folder.
Andy

By: Didier Stevens

Didier Stevens — Fri, 16 Dec 2011 09:37:22 +0000

@Andrew Did you get to run the program? Go to the command line and type disitool.py. What output do you get?

By: Andrew Eustance

Andrew Eustance — Fri, 16 Dec 2011 09:23:37 +0000

Hi, I am new to Python and am unsure as to where to place the exe file I am working on and the syntax used to recreate the exe without the digital signature. Could you advise?

Many Thanks

Andy

By: Didier Stevens

Didier Stevens — Mon, 07 Feb 2011 15:29:01 +0000

@Ricardo No, my tool is for AuthentiCode signed PE files only.

By: Ricardo Schmidt

Ricardo Schmidt — Mon, 07 Feb 2011 14:50:34 +0000

Hello Didier,

Does your tool can be used to make a java .jar file be digested with other RSA-SHA1 output? I mean, I have no access to original .jar, but I have .jad that comes with MIDlet-Certificate-1-1 and MIDlet-Jar-RSA-SHA1, and I have my own .jar that needs to have the same MIDlet-Jar-RSA-SHA1 to be authenticated with that certificate.
The problem is that I am in an secured envoirment that need signed applications only, but I cannot sign them.