Code Signing: Where is the "encrypted hash" of a signed blob?
Here is the basic test I made.

I have OS X 10.10 installed on a external disk under volume name "Steelhead3". I entered the following commands.

cd "/Volumes/Steelhead3/Applications/Utilities"
sudo codesign -fs - "Boot Camp Assistant.app"


I then made a copy of the folder "Boot Camp Assistant.app". Next, I edited the "/Volumes/Steelhead3/Applications/Utilities/Boot Camp Assistant.app/Contents/Info.plist" and made a small change regarding the model Macs that can make the Windows USB installer.

At this point I reran the following commands.

cd "/Volumes/Steelhead3/Applications/Utilities"
sudo codesign -fs - "Boot Camp Assistant.app"


From here I booted to Windows and used the Windiff.exe application to compare the files. I expected to see the change made to the "Info.plist" files, which I did. Also, the "/Volumes/Steelhead3/Applications/Utilities/Boot Camp Assistant.app/Contents/MacOs/Boot Camp Assistant" files appeared to have changed. Since this is a binary file, I first converted the before and after versions to hex characters, then Windiff.exe was used to find the differences. Below is the only differences.



It appears the only difference is a 20 byte change in the the executable binary file. I assume this is where the hash is stored. All other files were unchanged.