Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

To demonstrate the usefulness of signatures and digital fingerprints I loaded mspaint into a hex editor and altered one character from P to X (the character was located in a string). When I later on launched mspaint I was expecting Windows (xp) to pop up a dialog to warn me and say that the file had been tampered. But no such dialog popped up! Why?

share|improve this question

migrated from stackoverflow.com Nov 5 '09 at 15:20

This question came from our site for professional and enthusiast programmers.

1  
(1) mspaint.exe is not digitally signed under XP. (2) By default you are assumed to know what you're doing and are allowed to execute any program regardless of whether Authenticode is present-and-correct or not. I believe this can be changed by policy, if you really want. (You don't.) All that would happen with a hacked exe would be that the ‘Digital Signatures’ tab in Properties wouldn't appear. –  bobince Nov 5 '09 at 14:00
    
too bad it was closed... When I launch a program that I have written myself I get a warning, but when I launch a tampered program there is no warning. As a programmer I find it confusing. –  ragnarius Nov 5 '09 at 14:54
    
ragnarius, .NET? –  Tarnay Kálmán Nov 5 '09 at 15:28
    
Could/should have been rewritten a tiny bit, and then stayed on SO. –  Arjan Nov 5 '09 at 15:30

2 Answers 2

The check probably isn't done for performance reasons. You might have a multi-megabyte executable, and checking it might take a long time.

However, if you load up Process Explorer and tell it to verify digital signatures, it will probably tell you that the digital signature on your tampered version of Paint is invalid.

share|improve this answer

Windows XP by itself does not offer very effective anti-tampering solutions. It's probably up to the developer to write verification code for his app if he wants to protect it from tampering. As for the non-kernel parts of the OS, such as the bundled programs (paint, for instance), they weren't considered critical enough to be protected in such a manner.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.