Unsupported File ".exe"

[isagargit]

We are using GaraSign CLI to sign .NET packages that internally uses jsign. I have installed jsign 6.0 but when i try to sign a .exe file i get the error:

[2024-03-22T05:57:54Z] - INFO | == Begin jsign output ==
[2024-03-22T05:57:54Z] - INFO | jsign: Unsupported file: testapp.exe
[2024-03-22T05:57:54Z] - INFO | Try `jsign --help' for more information.

DLL signing works perfectly

[ebourg]

It looks like Jsign fails to parse the .exe file, are you sure the file is valid? If you can send the file to [email protected] I'll give it a look.

[isagargit]

The file is valid, but actually cant share it. can you still suggest what could be wrong. jsign should work right ?

[ebourg]

Could you share at least the header of the file? The first 1K will be enough to analyze the issue.

[isagargit]

I parsed the file using pefile module. Here's the file
pefile_output.txt

[ebourg]

How was the file generated?

[isagargit]

using this script:
import pefile

with open("C:\Users\<>\Downloads\pefile_output.txt", "w") as f:
pe = pefile.PE("C:\Users\<>\Downloads\testapp.exe")
f.write(pe.dump_info())

[ebourg]

Sorry, I meant how was the .exe generated.

[ebourg]

What are the bytes at the offsets 0xF2 and 0xF3? That's just after "PE" and should be 0.

[ebourg]

@isagargit If you are still around I'd like to figure out why Jsign fails with your file

[ebourg]

When Jsign parses an executable file it checks:

• if the file exists and is indeed a file
• if the file is less than 4GB
• if the first two bytes are MZ
• if the 4 bytes at the address specified at the offset 0x3C are "PE\0\0"

If any of these tests fail, the unsupported file error is displayed.

I wondered if the PE header verification was too strict, so I've modified a file and set non-zero values after the "PE" bytes. The file became invalid, Windows refused to run it and displayed a big warning message. So Jsign is right to check the two zeros.

I also tried to parse all the PE files under the C:\Windows directory and couldn't find any file triggering the same error.

At this point I fail to see what causes your file to be rejected.

Maybe this is related to something done by the GaraSign CLI? To verify that you could try signing directly with Jsign, using the recently added --storetype GARASIGN parameter.