Microsoft Defender Application Control (MSDAC) bypass about sigflip HOT 2 CLOSED

Hi,

It only changes the standard PE file checksum/hash (md5/sha1 ..etc).

Changing the AuthentiHash would result in breaking the Authenticode signature validity, WinVerifyTrust would fail, as the calculated authentihash will be different from what was initially calculated and set in the ACT (Digest field of the SpcIndirectDataContent structure), same thing goes for Imphash, Rich PE header hash, the only fields that can be modified without affecting the signature are the checksum, certificate table RVA, certificate table size and the Attribute Certificate Table (ACT).

And ofc you can always extract the PKCS#7 byte array (SignedData Structure), then extract ContentInfo (SpcIndirectDataContent structure) and modify the Digest field in case if you want to play around with it.

from sigflip.

Thanks.

from sigflip.