delcert - Sign strip tool

D

deepred

Member

Jan 19, 2006

7

16

• Aug 10, 2008

• #1

Hi,

here is a small tool that strips (removes) digital sign (Authenticode) from PE executable files like *.exe, *.dll, *.mui, etc. On error HRESULT is returned, i.e. 0x00000005 means that file is readonly.

Code:

C:\[snip]>delcert.exe OEM\OEMOpera\OperaWM.exe

Target file(s): OEM\OEMOpera\OperaWM.exe

Stripping file: C:\[snip]\OEM\OEMOpera\OperaWM.exe.
Succeeded.

C:\[snip]>delcert.exe OEM\OEM_Lang_0409\*.mui

Target file(s): OEM_Lang_0409\*.mui

Stripping file: C:\[snip]\OEM\OEM_Lang_0409\aboutprop.dll.0409.mui.
Succeeded.

Stripping file: C:\[snip]\OEM\OEM_Lang_0409\BKLBrightness.dll.0409.mui.
Succeeded.

Source is included. You may need to install Visual Studio 2008 C++ Runtime before running.

 

Attachments

• delcert.zip

  10.2 KB · Views: 23,253

• 

Reactions: mat23452345, dumbasPL, Deleted member 4989510 and 13 others

Da_G

Inactive Senior RD / Moderator Emeritus

Aug 20, 2007

3,332

1,563

Riverside, CA

Samsung Galaxy S22 Ultra

• Dec 6, 2008

• #2

I can't believe no one posted thanks for this I just used it recently and it worked a charm! So, thanks! Appreciate your work.

 

cmylxgo

Senior Member

Feb 13, 2007

1,680

2,033

• Jun 6, 2009

• #3

deepred said:

Hi,

here is a small tool that strips (removes) digital sign (Authenticode) from PE executable files like *.exe, *.dll, *.mui, etc. On error HRESULT is returned, i.e. 0x00000005 means that file is readonly.

Code:

C:\[snip]>delcert.exe OEM\OEMOpera\OperaWM.exe

Target file(s): OEM\OEMOpera\OperaWM.exe

Stripping file: C:\[snip]\OEM\OEMOpera\OperaWM.exe.
Succeeded.

C:\[snip]>delcert.exe OEM\OEM_Lang_0409\*.mui

Target file(s): OEM_Lang_0409\*.mui

Stripping file: C:\[snip]\OEM\OEM_Lang_0409\aboutprop.dll.0409.mui.
Succeeded.

Stripping file: C:\[snip]\OEM\OEM_Lang_0409\BKLBrightness.dll.0409.mui.
Succeeded.

Source is included. You may need to install Visual Studio 2008 C++ Runtime before running.

Click to expand...

Click to collapse

Thanks for this...it fixed and issue I had when trying to remove a cert with another tool.

 

C

chetstriker

Senior Member

Mar 9, 2008

561

86

Brattleboro, VT

www.unfairware.com

• Jun 6, 2009

• #4

This sounds really interesting, however I was wondering what it can be used for? the certificates usully just provide authentication. Can this be used to bypass protection methods, or what are some real world examples of usage?

 

D

deepred

Member

Jan 19, 2006

7

16

• Jun 7, 2009

• #5

You're right, authenticode provides input data for Windows Mobile (originally Windows CE) policy mechanism which decides then if it is allowed to run the file or not. I used it to strip authenticode from OEM files taken from HTC devices before signing them with my own certificate (I usually sign files in my cooked ROMs). I.e. if file is already signed you can't sign it with another certificate until old one is removed.
Due to the fact that certificates are asymmetric you can sign files only with private certificates. That's why I use my own certificates.
To bypass the protection you need to get some how the private part and sign you file with it. Or you can just disable the security policy that enforces file origin check.

 

U

ute_arbeit

New member

Oct 22, 2010

1

0

• Oct 22, 2010

• #6

Thanks a lot for your work! Your neat little tool is just what I was looking for to be able to sign a Flash projector with my own certificate.

 

R

researchermd

Member

Aug 22, 2006

34

0

• Oct 24, 2010

• #7

Thanks

Works beautifully when other tools didn't.

 

WarlockW

Senior Member

Dec 30, 2007

1,249

658

Minnesota

• Nov 26, 2010

• #8

Works beautifully when other tools didn't ! Is Right !

Works beautifully when other tools didn't ! Is Right !

Worked Great Thanks - Just What I was Looking For !!!!!

 

T

TheGeekyGuy101

New member

Jul 14, 2014

1

0

• Oct 7, 2014

• #9

Still working in Windows 8.1

Still working in Windows 8.1
It's great because I can remove the cert from bit torrent and any other group policy blocked programs on my school laptop

 

M

mrpostiga

Member

Jul 7, 2011

9

0

• Oct 10, 2014

• #10

Great and awsome tool, this can be an asset for very good "hacks" :good:

 

H

Hydranix

Member

Jun 27, 2013

9

9

• Jan 19, 2015

• #11

Do you have any license requirements on your source or is it safe to assume this is public domain?

 

Phurkus

Senior Member

Feb 18, 2015

288

28

• Mar 23, 2015

• #12

Thanks OP. Appriciste for your share

Sent from my DROID RAZR M using XDA Free mobile app

 

T

Tropple

New member

May 20, 2016

1

0

• May 20, 2016

• #13

Useful for software publishers

We're using the delcert tool to avoid warnings with expired certificates. Our sign tool doesn't like exe files that already have a valid, but expired signature.