I'm attempting to validate an Authenticode signature (generated by
signtool /fd SHA256 /f <code signing PFX> /p <PFX password> test.exe), and I've run into an issue that I've narrowed down to a single point of confusion.
For the command above, if I hash test.exe before running the signing operation, for example using
Get-FileHash test.exe in Powershell, I get a SHA256 hash of the file. But after signing the file, inspecting the signature in windows (Properties -> Digital Signatures -> Details -> Advanced) shows a "Message Digest" value which is entirely different from the hash of test.exe as calculated before signing.
Windows reports this signature as valid, so there is clearly a consistent understanding of "Message Digest" that isn't the one I have in my head (hash of the raw file contents, excluding signature). Can somebody please explain to me what Message Digest means in this context, and how it differs from a regular hashing operation?