使用代码合约重写器时 ClickOnce 哈希失败

发布于 2024-11-14 09:29:18 字数 846 浏览 3 评论 0原文

我正在创建 ClickOnce 部署。

现在，我正在使用 CodeContracts 重写器，这意味着应用程序清单是在 CodeContracts 修改我的程序集之前生成的。

因此，我使用最新的哈希值和文件大小更新应用程序清单文件。这是计算哈希值的算法：

    public static string ComputeHash(FileInfo info)
    {
        SHA1CryptoServiceProvider sha1 = new SHA1CryptoServiceProvider();
        byte[] hashBytes = sha1.ComputeHash(info.OpenRead());
        return Convert.ToBase64String(hashBytes);
    }

然后我保存清单。然后，我使用相同的哈希计算例程更新 ClickOnce 部署清单 (.application)，该清单具有应用程序清单的哈希和大小。

之后，我运行一个测试程序，它告诉我所有哈希值和文件大小与磁盘上的真实文件匹配。

然而，当我运行 ClickOnce 部署时，它总是抱怨主 .exe 文件（这是应用程序清单中唯一需要更改的依赖程序集）的哈希验证失败。

请注意，如果我自己不更改哈希值和大小，ClickOnce 也会失败，因为信息更加明显错误（文件大小不同，而不仅仅是哈希值不同）。

无论如何，当我认为哈希验证有效时，我是否可以明白为什么哈希验证失败？

或者更好的是，有没有一种方法可以在代码合同重写器完成对我的可执行文件的攻击后生成清单？

谢谢

原文

I am creating a ClickOnce deployment.

Now, I am using CodeContracts rewriter, which means that the application manifest is generated before CodeContracts modifies my assembly.

Therefore, I update the application manifest file with an up-to-date hash and file size. Here's the algorithm to compute the hash:

    public static string ComputeHash(FileInfo info)
    {
        SHA1CryptoServiceProvider sha1 = new SHA1CryptoServiceProvider();
        byte[] hashBytes = sha1.ComputeHash(info.OpenRead());
        return Convert.ToBase64String(hashBytes);
    }

I then save the manifest. I then update the ClickOnce deployment manifest (.application) which has a hash and size for the application manifest using the same hash computation routine.

After this, I run a test program which tells me that all the hashes and file sizes match those of the real files on disk.

Yet when I run the ClickOnce deployment it always complains that the hash verification failed for the main .exe file (which is the only dependent assembly in the application manifest that needs changing).

Note that if I do not change the hashes and sizes myself, the ClickOnce also fails because the information is even more palpably wrong (the file size is different, not just the hash).

Is there anyway I can see why the hash validation is failing when I think it is valid?

Or better still, is there a way I can generate manifests after the code contracts rewriter has finished hacking my executables?

Thanks

分享到QQ

分享到微博