How to create precofigured installer (MSI or EXE) with valid signature?
digital-signature, installation, windows-installer
Solution
Meanwhile I found a way to add data to a signed EXE without invalidating signature. Yes, I also thought it is impossible. It is terrible hack, which works by modifying certificate section, which is not part of signature and it is at the end of file. So you can append to the end of EXE and just do some fixing of section size. I checked it works, signatures are valid, program runs, AntiVirus doesn't complain as well.
Description of the approach:
- http://blog.barthe.ph/2009/02/22/change-signed-executable/
- http://reboot.pro/topic/15889-modify-a-signed-executable-without-invalidating-its-digital-signature/
Working program to add payload:
- http://reboot.pro/files/file/85-digitalsignaturetweaker/
Obviously, as being hack it may stop working any time.
Problem
We want our users to download preconfigured installers of our software for Windows. Pre-configured data consists of settings based on user account data. The customization is to be done in a Java server running on Linux. We need to have those installers digitally signed. Unfortunately we cannot have private signing key on those servers, due to security policy. Can you think of ways to put some metadata into either MSI or EXE while preserving digital signature or other approaches to fulfill the use case? EDIT: The requirement is to have a single file download, so unfortunately parallel ini file doesn't fulfill it. It is mostly about providing a set of connection points (specific to a user) - we are not to bother a user as we already know them.