med0x2e/SigFlip

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1290 stars · 208 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

SigFlip is a red-team tool for patching Authenticode-signed PE files (exe, dll, sys) without invalidating their existing signatures, by embedding data such as encrypted shellcode. It ships as .NET assemblies and BOF scripts, with a companion SigLoader to extract and decrypt the embedded payload.

Use cases

• change the hash of a signed PE file like msbuild.exe without breaking its signature
• bypass application whitelisting based on signed binary hashes
• embed encrypted shellcode in a signed PE for later execution via a stager
• load signed drivers with a modified hash to evade hash-list based detection
• test whether endpoint security relies solely on WinVerifyTrust signature validation
• evaluate EDR detections that trust LOLBIN hashes

When to choose

• you need to modify signed PE files while keeping Authenticode signatures valid
• you are doing red-team persistence, lateral movement, or whitelisting bypass research
• you want BOF or .NET tooling for signature-preserving PE patching

When to avoid

• you need general-purpose PE editing or binary patching unrelated to signature evasion
• you require a fully supported production security product rather than an offensive research tool
• your target environment is not Windows

Facets

cli-tool · maturity maintenance

security penetration-testing reverse-engineering security penetration-testing windows windows cli authenticode signature-bypass pe-patching shellcode-injection red-team edr-bypass bof csharp offensive-security

Member repositories

For agents

markdown · JSON · MCP: product_card(name="med0x2e/SigFlip")