Hi,

I am always of the belief that once a strong name assembly is built, you
cannot modify it without invoking the verification failure on loading.

But the other day, a colleague of mine in the midst of getting something
done with the managed Directx library, Microsoft.DirectX.dll version
9.12.589.0, accidentally tripped the time bomb as Microsoft no longer
supporting this.

He could not stop what he was doing and found with the help of Lutz
Reflector the function
Microsoft.DirectX.InternalHelper.CheckTimeBomb()

and he changed the year using a binary editor from 2006 to 2518.

He ran his application and did not receive any TimeBombException and
obviously his hacked code works. But it begs the question how a strong name
assembly could be hacked in this manner without tripping the verification
check?

I ran sn -vf on the command line for the Microsoft.DirectX.dll and it failed
the verification. Here is the disassembled code of the function to show the
change:
.method public hidebysig static void CheckTimeBomb() cil managed
{
  .maxstack 4
  .locals (
     [0] [mscorlib]System.DateTime time1)
  L_0000: ldloca.s time1
  L_0002: ldc.i4 2518
  L_0007: ldc.i4.s 10
  L_0009: ldc.i4.5
  L_000a: call instance void [mscorlib]System.DateTime::.ctor(int32, int32,
int32)
....
}

Is this a security slip up? On a small demo I developed, any tampering of a
strong name assembly would fail the verification.

Any one has any idea why this works?

Thanks.

Leon