.NET程序集签名：这是否真的可以保护我的程序集不受篡改？ [英] Signing .NET assemblies: Does this protect my assembly from tampering really?
问题描述
我正在我的应用程序中实现锁定系统，以防止我的应用程序被非法复制和使用。系统检查基于硬件的代码的签名，并期望使用只有我公司拥有的私钥对它进行签名。 （应用程序具有用于验证签名的公共密钥。）
I am implementing a "locking" system in my app which protects my app against being copied and used illegally. The system checks the signature of a hardware-based code and expects it to be signed with a Private Key that only my company owns. (The app has got the Public Key to validate the signature.)
我要确保没有人更改应用程序中的锁定机制，因此我想签名我的应用程序的程序集，我认为这是有道理的。
I want to make sure that no one changes my locking mechanism in the app, so I want to sign my app's assembly and I think it makes sense.
- 由于我还没有看到CLR谈论过程序集签名无效，所以我希望确保该系统确实有效。可以？我应该怎么做才能使其起作用？
- 攻击者可以将精力集中在CLR上，以使其不关心我的签名吗？也就是说，如果他因为我已经签名而无法篡改我的代码，他可以篡改CLR吗？
- 通常，我想了解一下您对此类安全防护的经验和保护技术。有人可以提出其他建议吗？
推荐答案
程序集签名旨在使应用程序/程序集能够引用程序集，并确保他们获得了最初引用的程序集。如果有人愿意，理论上他们可以反编译您的整个应用程序，并且无需签名即可重新编译。 （即：他们可以重新编译引用程序集，以便它引用引用程序集的未签名版本。）
Assembly signing is designed to allow applications/assemblies to reference an assembly and be sure that they get the assembly they originally referenced. If someone wanted to, they could in theory decompile your entire app and recompile with no signing. (ie: they could recompile the referencing assembly so that it referenced an unsigned version of the referenced assembly).
他们便能够根据需要修改代码，因为客户端（exe）现在将引用未签名（或重新签名）的dll。
They would then be able to modify the code as they wanted, because the client (exe) would now reference an unsigned (or 're-signed') dll.
为了使反编译和重新编译的过程更加困难，您可以尝试创建包含托管代码和本机代码的混合模式C ++ / CLI程序集。但是，是的。。。最终，人们将拥有您所有的二进制文件，并且经过足够的努力，您很可能可以解决您认为的任何许可系统。
To make the process of decompilation and recompilation more difficult, you could try creating a mixed-mode C++/CLI assembly containing both managed and native code. But yeah... ultimately people have all your binaries to hand and with enough effort can probably get round any licensing system you think up.
这篇关于.NET程序集签名：这是否真的可以保护我的程序集不受篡改？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
