How does a .net/c# application guarantee that the called dll is not replaced by forgery?
https://www.itsvse.com/thread-4173-1-1.html (Source: Architect) Last time, we tested that the dll can be forged by others and executed, how to prevent it?
Signature Introduction:
An assembly signature (also known as a strong name signature) gives an application or component a unique identity that other software can use to explicitly identify and reference the application or component. A strong name consists of the assembly's simple text name, version number, regional information (if provided), and a public/private key pair.
For example, strong naming allows application authors and administrators to specify the exact version of one service that will be used by shared components. This allows different applications to specify different versions without affecting others. You can also use the strong name of the component as security evidence to generate a trust relationship between the two components.
To strongly sign an assembly, you don't need to sign a digital certificate with purchased code, you can generate an SNK file with the sn tool provided by .NET, and you can guarantee the signature of your assembly by saving this file.
However, a strong signature for an assembly is not the same as a digital signature for an executable file (even if the assembly is an exe file). And MSDN clearly says that exe files should not be strongly signed (although I did). A digital signature for a file is actually attaching a signature to any file at the file system level, telling the operating system who is the issuer of this file. In the file's properties dialog, you can see the "Digital Signatures" tab.
We strongly sign the dll, and then call it with a program, which can be executed normally, as follows:
What if, we replace the dll with a forged dll? Test it, and find that the execution is error, which can effectively prevent the calling dll from being forged (I tested it, modified the signed dll code, and then regenerated it, and the application can also be called normally, it should be as long as the program is signed correctly!!)
The error is as follows:
For more information about calling real-time (JIT) debugging instead of this dialog, See the end of this message.
Unusual Text **************
System.IO.FileLoadException: 未能加载文件或程序集“dllFrom, Version=1.0.0.0, Culture=neutral, PublicKeyToken=eb67821f2cf76b4e”或它的某一个依赖项。找到的程序集清单定义与程序集引用不匹配。 (异常来自 HRESULT:0x80131040) File Name: "dllFrom, Version=1.0.0.0, Culture=neutral, PublicKeyToken=eb67821f2cf76b4e" In TestDll.Form1.button1_Click_1 (Object sender, EventArgs e) In System.Windows.Forms.Control.OnClick(EventArgs e) In System.Windows.Forms.Button.OnClick(EventArgs e) In System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent) At System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks) In System.Windows.Forms.Control.WndProc(Message& m) In System.Windows.Forms.ButtonBase.WndProc(Message& m) In System.Windows.Forms.Button.WndProc(Message& m) In System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m) In System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m) In System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)
Warning: Assembly binding logging is turned off. To enable assembly binding failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!" EnableLog (DWORD) is set to 1. Note: There will be some performance penalties associated with assembly binding failure logging. To turn off this feature, remove the registry value [HKLM\Software\Microsoft\Fusion!] EnableLog]。
Loaded Assemblies ************** mscorlib Assembly version: 4.0.0.0 Win32 version: 4.7.2098.0 built by: NET47REL1LAST Base code: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll ---------------------------------------- TestDll Assembly version: 1.0.0.0 Win32 version: 1.0.0.0 Base code: file:///C:/Users/itsvse_pc/Desktop/dllForm/TestDll/bin/Debug/TestDll.exe ---------------------------------------- System.Windows.Forms Assembly version: 4.0.0.0 Win32 version: 4.7.2094.0 built by: NET47REL1LAST Base code: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll ---------------------------------------- System Assembly version: 4.0.0.0 Win32 version: 4.7.2093.0 built by: NET47REL1LAST Base code: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll ---------------------------------------- System.Drawing Assembly version: 4.0.0.0 Win32 version: 4.7.2046.0 built by: NET47REL1 Base code: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll ---------------------------------------- System.Configuration Assembly version: 4.0.0.0 Win32 version: 4.7.2046.0 built by: NET47REL1 Base code: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll ---------------------------------------- System.Core Assembly version: 4.0.0.0 Win32 version: 4.7.2098.0 built by: NET47REL1LAST Base code: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll ---------------------------------------- System.Xml Assembly version: 4.0.0.0 Win32 version: 4.7.2046.0 built by: NET47REL1 Base code: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll ---------------------------------------- System.Windows.Forms.resources Assembly version: 4.0.0.0 Win32 version: 4.7.2046.0 built by: NET47REL1 Base code: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms.resources/v4.0_4.0.0.0_zh-Hans_b77a5c561934e089/System.Windows.Forms.resources.dll ---------------------------------------- mscorlib.resources Assembly version: 4.0.0.0 Win32 version: 4.7.2046.0 built by: NET47REL1 Base code: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/mscorlib.resources/v4.0_4.0.0.0_zh-Hans_b77a5c561934e089/mscorlib.resources.dll ----------------------------------------
JIT Debugging ************** To enable real-time (JIT) debugging, It must be set in the system.windows.forms section of the .config file (machine.config) of the application or computer jitDebugging value. It must also be enabled when compiling the application Debugging.
For example:
<configuration> <system.windows.forms jitDebugging="true" /> </configuration>
Any unhandled exceptions after JIT debugging is enabled will be sent to the JIT debugger registered on this machine, Instead of being handled by this dialog.
|