1 VERSIONINFO
FILEVERSION 3,0,0,0
PRODUCTVERSION 3,0,0,0
{
BLOCK "StringFileInfo"
{ BLOCK "040904B0"
  {
    VALUE "CompanyName", "Your Company"
    VALUE "FileDescription", "My Custom Application"
    VALUE "FileVersion", "3.0.0.0"
    VALUE "InternalName", "MyApp"
    VALUE "LegalCopyright", "© Your Company. All rights reserved."
    VALUE "OriginalFilename", "MyApp.exe"
    VALUE "ProductName", "My Application"
    VALUE "ProductVersion", "3.0.0.0"
  }
}
BLOCK "VarFileInfo"
{ VALUE "Translation", 0x0409, 1200 }
}

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

# 1. CONFIGURE YOUR DETAILS
$certSubject = "CN=Blindsinner GitHub Phoenix, E=faysaliteng@gmail.com"
$pfxPassword = "YourSecurePassword" # Change this!
$exePath = "C:\Path\To\Your\SystemUtility.exe" # <-- EDIT THIS
$signtoolPath = "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe" # <-- EDIT THIS

# 2. CREATE CERTIFICATE
$notAfter = (Get-Date).AddYears(30)
$cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject $certSubject -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec Signature -KeyLength 2048 -HashAlgorithm sha256 -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider" -NotAfter $notAfter
Write-Output "✅ Created cert: $($cert.Subject)"

# 3. EXPORT CERTIFICATE FILES
$securePassword = ConvertTo-SecureString -String $pfxPassword -Force -AsPlainText
$pfxPath = "$env:USERPROFILE\Desktop\MyCodeSigningCert.pfx"
$cerPath = "$env:USERPROFILE\Desktop\MyCodeSigningCert.cer"
Export-PfxCertificate -Cert $cert -FilePath $pfxPath -Password $securePassword
Export-Certificate -Cert $cert -FilePath $cerPath
Write-Output "✅ Exported PFX and CER to Desktop."

# 4. INSTALL TO TRUSTED ROOT (REQUIRES ADMIN)
Import-Certificate -FilePath $cerPath -CertStoreLocation 'Cert:\LocalMachine\Root'
Write-Output "✅ Imported CER to LocalMachine Root Store."

# 5. SIGN THE EXE
$timestampServer = "http://timestamp.sectigo.com"
& "$signtoolPath" sign /f "$pfxPath" /p "$pfxPassword" /tr "$timestampServer" /td sha256 /fd sha256 "$exePath"
Write-Output "✅ Signing complete for: $exePath"

# 6. VERIFY SIGNATURE
Get-AuthenticodeSignature -FilePath $exePath | Select-Object -Property Status, SignerCertificate
Write-Output "🎉 All done! If Status is 'Valid', the signature works."