Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsFree MagazinesWhite PapersSubmit Content
Discussion GroupsASP.NETWindows FormsLanguages.NET FrameworkVisual Studio.NET
Articles.NET FrameworkASP.NETToolsWindows Forms
.NET DirectoryOpen Source ProjectsUser GroupsWeb Resources
Related Topics
Visual Basic 6SQL ServerMS AccessOther DB ProductsMS Server ProductsMore Topics ...

.NET Forum / .NET Framework / CLR / August 2004

Tip: Looking for answers? Try searching our database.

Desperate help

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
WertmanTheMad - 19 Aug 2004 02:03 GMT
Here is the situation.

I have a dll (.Net 1.1 C# to be exact)

It has a path harcoded into it inside an include that is used as a
resource.

I hav lost the source to the app, it hasnt needed changed in some time
EXCEPT a server path (refrenced inside that resource a js file to be
exact) is now broken and cannot be changed server side.

I have changed the path in a Hex Editor (I am proficient with a hex
editor and have no doubt it will run and do what I need)

HOWEVER because of the way .Net Strong Name etc is when I try to run
the app I get  The check of the signature failed for assembly
'Foo.dll'

No suprise there since its not quite kosher anymore as far as the CLR
is concerned.

I do NOT care about security on this Dll, or that whole server for
that matter as it is only used internally (not exposed to the web) and
I am in control of everything else that gets installed there.

I absolutley need to be able to have it run.

I tried adding it to the GAC (knew it would fail) here is the error

gacutil -if Foo.dll

Failure adding assembly to the cache: Strong name signature could not
be verified.  Was the assembly built delay-signed?

Ok no suprise there right ? WELL I have read about all the reasons in
the world NOT to use DEVPATH , I dont see it being an issue here, I
NEED to try this option.

Where exactly do I set the DEVPATH and How ? Ok, its an enviromtnal
variable ? I set it EXACTLY where and when ?

OR Is there another way to let a bonked (but functional) previously
stron assembely to run ?

I am in desperate need of a solution, and I dont care what breaks with
devpath as LONG as this app run until I can recreate the source (with
a few new bells and whistles of course :)

I just really really need to know how to make this run again

Please help me oh god of the .Net CLR

Chris
Niall - 19 Aug 2004 02:16 GMT
Can you get around the problem by decompiling the dll, fixing the reference
and recompiling it?

Niall

> Here is the situation.
>
[quoted text clipped - 49 lines]
>
> Chris
WertmanTheMad - 19 Aug 2004 12:37 GMT
I dont know is this a valid option ? I obfusticated the code, will
that be a hinderance ? Can this be use in the case of a stong named
assembely ? and how would the recompiling affect this ?

Any pointers to tools, or procedures to accomplish this IF its a good
option would be greatly appreciated.

Chris

> Can you get around the problem by decompiling the dll, fixing the reference
> and recompiling it?
[quoted text clipped - 54 lines]
> >
> > Chris
WertmanTheMad - 19 Aug 2004 18:02 GMT
Nevermind, the decompile hint was just what I needed, I am VERY
suprised however I can modify a assembly with a stong name assigned,
by firs decompiling it as such
ildasm Foo.dd /output:Foo.il
Then editing the associated JS Resource file, hey since I was in there
I REALLY modified it :)

Then recompiling as such ilasm /dll /debug /resource=Foo.res Fool.il
/output=Foo.dll

Note I ommited the Key

Then if I do a sn -T Foo.dll I get the PREVIOUS and ORIGINAL PKT ?!?!

I mean its really nice that I dont have to hunt around all my config
files and change that Token, but dodent doing this defeat MOST of the
purpose of the Strong Name to ensure against say a trojaned version of
a .Net assembely ?

OR is this only occuring because I am editing a resource and not the
code itself ?

I am very curious about this although in my enviroment I am not
concerned.

Thanks for the point in the right direction

Chris

> Can you get around the problem by decompiling the dll, fixing the reference
> and recompiling it?
[quoted text clipped - 54 lines]
> >
> > Chris
Christian Heide Damm - 23 Aug 2004 13:48 GMT
You should definitely not be able to defeat strong name verification.

Try to run "sn -Vl" on your system - is your Foo assembly (or its public key
token) listed there?

Christian

---

> Nevermind, the decompile hint was just what I needed, I am VERY
> suprised however I can modify a assembly with a stong name assigned,
[quoted text clipped - 84 lines]
>> >
>> > Chris
WertmanTheMad - 23 Aug 2004 21:13 GMT
Yes it is listed there and its public key is the same

Chris

> You should definitely not be able to defeat strong name verification.
>
[quoted text clipped - 93 lines]
> >> >
> >> > Chris
Christian Heide Damm - 25 Aug 2004 07:53 GMT
If "sn.exe -Vl" contains your assembly, then we have the answer. You have
registered your assembly for verification skipping, i.e., explicitly told
the CLR to not verify its strong name.

Registering an assembly for verification skipping is a security hole, but
it's often used in development when assemblies are only delay-signed.

Christian

---

> Yes it is listed there and its public key is the same
>
[quoted text clipped - 105 lines]
>> >> >
>> >> > Chris
Christian Heide Damm - 19 Aug 2004 12:02 GMT
You could skip verification of the assembly:

 sn.exe -Vr YourAssembly.dll

Using "devpath" won't help you wrt. verification.

Christian

---

> Here is the situation.
>
[quoted text clipped - 49 lines]
>
> Chris

Rate this thread:







Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.