Can't sign resource-edited files with ResHacker

[nora-h-papercut]

Using ResHacker to delete a resource in a file naturally invalidates any existing signatures.

After this, jsign doesn't seem to be able to re-sign them:

It's entirely possible this is a skill issue, and I should be more explicitly clearing the existing signature, but i'm not immediately sure.

I used corretto 25 JRE for windows java.exe with ./ResourceHacker.exe -delete java.exe, rebranded.exe, versioninfo,1,.

Any insights into the meaning of the error?

[ebourg]

ResHacker corrupts the structure of the file, it doesn't adjust the offset of the signature table after deleting the resources. Try modifying the file before signing it. The issue should be reported to ResHacker's developper.

[ebourg]

I've played a bit with ResHacker, it looks like it updates the location of the certificate table in the PE header only when the size of the file is reduced by the modification.

1. With the wineyes.exe files from the Jsign tests, I added a JPEG image in the resources, signed and then removed the image. The offset of the certificate table in the PE header is properly updated. Windows still sees the signature, which is invalid of course, but it can be replaced with jsign, signtool or osslsigncode
2. If I first sign the file, and then add an image with ResHacker, the offset of the certificate table is not updated. Windows no longer sees the file as signed, osslsigncode reports the file as corrupted, signtool returns a "No signature found" error, and Jsign throws an exception "Invalid certificate table size"

[nora-h-papercut]

Thanks for the insights! I've passed on an email to the developer with a link to this thread.