A Python 3 utility for security testing of Authenticode handling in Windows Portable Executable (PE) files. SigThief can extract a certificate-table signature blob from a signed PE, append it to another PE, check whether a PE contains signature data, or remove that data. A copied signature is not cryptographically valid for the modified target; the presence check does not verify trust or validity.
Python 3
RESTRICTED_ACCESS_BLUR_MARKER