当我更改 exe 文件时，代码签名没有抱怨吗？
我购买了代码签名证书，一切看起来都很好。当在干净的 Virtual PC 操作系统中进行测试时，我不再收到“无法验证发布者”消息。
因此，只是为了笑一下，我使用十六进制编辑器更改了在表单上看到的 VB6 exe 中的一些常量。 VB 6 exe 仍然运行，没有任何错误消息。
我认为代码签名证书会告诉您文件是否已以任何方式更改？
I purchased a code signing certificate and all looks well. When tested inside a clean Virtual PC OS I no longer get the "The Publisher could not be verified" message.
So just for grins, using a hex editor, I change a few constants in the VB6 exe which I see on a form. And the VB 6 exe still runs wihout any error message.
I thought the code signing certificate would tell you if the file had been changed in any way?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是的，如果文件被修改，Authenticode 会指示签名无效。
但是，从本地磁盘运行程序通常不会检查签名；而是会检查签名。右键单击 EXE，选择“属性”，然后选择“数字签名”以查看签名错误消息。
Yes, Authenticode will indicate that the signature is invalid if the file is modified.
However, running a program from your local disk won't typically check the signature; right-click on the EXE, choose Properties and choose Digital Signatures to see a signature error message.
如果作恶者能够获得对您的计算机的足够访问权限来更改文件中的字节，那么您就已经被俘虏了。签名主要用于在安装文件之前验证文件。您当然可以编写自己的程序来扫描您的文件并重新检查其签名以确保信任，但作恶者也只会更改扫描仪中的字节。
If an evil-doer can gain enough access to your machine to change bytes in a file then you are already pwnded. The Signature is there mainly to verify files before you install them. You could of course write your own program to scan your files and recheck their signatures for trust, but the evildoer would just change the bytes in your scanner as well.