Modifying Digitally signed files on W10?

Thank you, ROB. I appreciate it.

Giant wall of text incoming!

This was originally going to be in its own thread, which is why it reads a bit like a first post. However, the information here should still be useful regardless.




Execution of Unsigned Files

If you’re using a newer version of Windows and you’ve tried to modify certain system files (such as shell32.dll), chances are you’ve run into some problems doing so. This is because starting with Windows 8, Microsoft has added authenticode signatures to many system files in Windows, which prevents them from being executed if any changes are made to them. Modifications can result in a severely crippled (or even unbootable in many cases) operating system. Obviously, this limits customization quite a bit.

This behavior is actually nothing new. In fact, all the way back in the days of Windows Vista, a signature was added to ntoskrnl.exe, making it much more difficult to use custom bootscreens the way people did in XP. And while it was more than likely used even before then, that was one of the first instances I remember seeing it.
The only difference now is that a far greater number of system files include signatures. And up until fairly recently, there wasn't really a very well-known way around this. But as you have probably guessed by now, I have found one.

After quite a bit of research, I discovered that it is actually possible to delete authenticode signatures from files, without preventing it from being executed. There are a couple of different tools that can do this, such as UnSigner, FileUnsigner, and delcert. All of these tools work pretty well, and they do exactly what they say they do.

While deleting authenticode signatures may sound great and all, it's really only one piece of the puzzle. Even though a file will continue to run normally if its signature is deleted using these methods, it will still fail if any modifications are made to it.
That's where Driver Signature Enforcement comes into play.

You may already know that the purpose of Driver Signature Enforcement is to prevent the use of unsigned drivers, as its name would imply. But what you may not know is that it actually has another purpose as well, which is to prevent files with broken authenticode signatures from being executed. If a file is modified without its authenticode signature being deleted first, it will fail to execute under just about any circumstances. If, however, the file’s signature is deleted before modification, it will actually run normally as long as Driver Signature Enforcement is disabled.

This can not only allow for customizations that were previously thought to be impossible (or extremely difficult at the very least) but it may also allow for us to fix things that break down the road. And I, for one, am quite excited to see what comes of this!

Hopefully this post isn't too long/difficult to understand, and that this information will be useful to those who might be interested. If you do have any questions, please feel free to ask, and I will try to answer them as best I can.

Thanks ROB, but I've ran into a bit of a snag: disabling Driver Enforcement has corrupted my system. I'm going to have to re-install everything.

At least now I have an excuse to install LTSB 2016 I guess.

Any directions on how to achieve this?

from now i don't know how to change shell32.dll and other signed files. when will this be possible?

Yeah exactly l, but can it be step by step?

Hi
3 years later and are there any updates to how solve digital signature problem ? or a way to disable driver signature enforcement properly?


i am around to find a way to modify ntoskrnl.exe for windows 10 actually for upgrade windows 10 arm32 build number from 15035 to something upper so ms-store apps wll install without any modifications

as you said unsiner do not help

the other way i found mean resign files do not help too

I got Driver Signature Enforcement Overrider: Driver Signature Enforcement Overrider Downloads and go to windows test mode then re-signed my modified ntoskrnl.exe with the test signature.
disabled Windows File Protection and copy it via winpe to sys32 but still after reboot it will replace to original one.