在运行应用程序C#/.NET之前检查DLL是否真实/正确 [英] Check if DLL is authentic/correct before running application i C# / .NET

问题描述

我试图弄清楚如何确保提供的DLL是正确的.原因是我们的分布式解决方案是由许多小的DLL构建而成的，每个DLL都包含应用程序的某些部分，有时我们会推出其中一些的新版本.

Hi I am trying to figure out how to make sure that a supplied DLL is the correct one. Reason is that our distributed solution is build of many small DLL's each containing certain portions of application and sometimes we roll out a new version of some of these.

这不是更新问题"，但是很友好-我们如何检查是否:

1. 使用正确的二进制文件/汇编文件

1. its the correct binary/assemble

客户/客户已篡改文件，并可能用具有相似功能的同名文件替换了该文件以返回错误值?

the customer/client had tampered with the file and perhaps replaced it with one of the same name with similar functions to return bad values?

多种原因

这可以用于复制保护/许可证测试或其他重要的验证问题，因此我试图确定MD5校验和+某种汇编信息是否足够?(如果是这样，如何获得对部件明细或类似部件的访问权限?)

This could be used for copyprotection/licens test or other important validation issues, so I'm trying to figure out if MD5 checksum + some sort of assemble info is enough? (if so, how to gain access to assembly details or similar?)

当您可以反编译.NET DLL时，没有什么是安全的，但是正因为如此，我们要确保没有人仅仅反编译我们的功能列表，然后在其中编写我们自己的太重要了"的DLL的替换DLL.

Ofcause nothing is failsafe, when you CAN decompile .NET DLL's, but exactly therefore we want to make sure that someone doesnt just decompile our functionlist and then writes there own replacement DLL of our "oooh so important" DLL's.

我们的原因是调试/支持所需的麻烦，当我们发现客户因错误或目的而破坏了这些错误(我们不在乎原因时，我们只是尝试防止大多数可能的错误).

Our reason is the amount of trouble debugging/supporting needed, when we get customers who have destoryed these by error or purpose (we dont care about the reason, we just try to prevent most of the possible errors).

推荐答案

我看到两个选择:

1. 数字签名.您需要购买数字证书，但是一旦启用它，您就会对文件的来源非常有信心.如果还具有这样的优势，在Windows Vista和更高版本中，您的程序将不会被标记为来自未知发行商".

1. Digital signing. You need to buy a digital certificate, but once you make it work you can feel very confident about the origin of the file. If also has the advantage that your programs won't be marked as being from "an unknown publisher" in Windows Vista and higher.

散列.您可以使用MD5(或更好的 SHA-1 )哈希.实施起来非常容易，但是可以解决该保护问题(尽管这样做并不容易).

Hashing. You could use a MD5 (or better a SHA-1) hash. Very easy to implement but is possible workaround the protection (although it's not trivial doing that).

这篇关于在运行应用程序C#/.NET之前检查DLL是否真实/正确的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！