[ZT] Three ways to tell if a. Net assembly is stronugly named (or has strong name)

ArticleDirectory

• Strong names and digital signatures are orthogonal concerns-almost
• Strong names are not for security!

Here are several convenient ways to tell whether a. Net assembly is strongrong named.(English language NOTE: I assume the form "stronugly named" is preferred over "strong named" since that's the form used in the output of the sn.exe tool shown immediately below .)

Towards the end, this post discusses useStrong names with Silverlight.

Then in the final section of this postThe often confusing-though very important-differences between stronugly named assemblies and digitally signed assemblies are clarified.

But first, here are three approaches for telling whether a. Net assembly is strongly named...

Approach #1: Testing for strong name on command line or in a script

You tell whether an assembly/dll has been successfully strong-named using the strong name tool (Sn.exe) (Which can be found somewhere like here: C: \ Program Files \ microsoft sdks \ windows \ v7.0a \ bin \ sn.exe) by running the following at the command line:

 
Sn-VF system. Data. dll
 

Here are the results when running against a strongly named assembly, then one that is not strongly named.

 
C: \> Sn-v c: \ WINDOWS \ Microsoft. NET \ framework \ v2.0.50727 \ System. Data. dll
 

Microsoft (R). Net Framework strong name utility version 4.0.30128.1
Copyright (c) Microsoft Corporation. All rights reserved.
Assembly 'C: \... \ system. Data. dll'Is valid
 

 
C: \> Sn-v c: \ WINDOWS \ ismif32.dll
 

 
Microsoft (R). Net Framework strong name utility version 4.0.30128.1
Copyright (c) Microsoft Corporation. All rights reserved.
C: \ windows \ ismif32.dllDoes not represent a strongly named assembly
 

Since the return value from sn.exe is 0 (zero) when the strong name is in place, and 1 (one) if not correctly strong named, you can test for this in a script by examining errorlevel, as in the following (put it into a text file called "sn-test.bat" for example and run as "Sn-test Foo. DLL "):

 
@ Echo off
 

 
If "% 1" = "" Goto end Sn-Q-VF % 1> NUL if errorlevel 1 goto not_strong
 

 
: Strong
ECHO has strong name: % 1
Goto end
 

 
: Not_strong
ECHO not strong named: % 1
Goto end
 

 
: End
 

Note that this will tell you whether it has some strong name, but does not tell you which one. so this technique is not appropriate for all uses, but might help in, say, an automatic script that checks your about-to-be-released assemblies to make sure you remembered to add the Strong names to them. (see note below-"Strong names not for security ".)

If you need finer-grain control and wish to write low-level code to ascertain the strong-naming status of an assembly, you can do that too.

Approach #2: viewing strong name details with IL dasm

Visual Studio ships with a handy utility-the Microsoft intermediate language disassembler (ildasm. EXE (Tutorial)-which can be used for disconfiguring. net binaries to peruse the contents, perhaps for viewing the method signatures or viewing. net assembly manifest. it is helpful to load an assembly using IL dasm and examine the manifest to see whether there is a strong name key available. your first step is to load the desired assembly using the ildasm.exe utility. on my Windows 7 machine, il dasm is found

 
C: \ Program Files \ microsoft sdks \ windows \ v7.0a \ bin \ ildasm.exe
 

And you can load upSystem. Drawing. dll. Net assembly as in the following example:

 
C: \>Ildasm c: \ windows \ Microsoft. NET \ framework \ v2.0.50727 \ System. Drawing. dll
 

Once loaded, you will see a screen like the one below.

Note the manifest Section highlighted. Double-click on manifest which load the following screen of manifest-specific data:

Find the Section for the Assembly you 've ve loaded-in this case,System. DrawingAnd following the section (which is marked with the ". assembly system. drawing "Directive highlighted above, and the content begins with the Opening brace (" {") shown above, and ends with itsMatchingBrace later in the manifest, and shown below.

The highlighted part of the manifest is the public key for this Assembly. This Public Key can also be seen using the sn.exe tool, as follows:

 
C: \> Sn-TP c: \ windows \ Microsoft. NET \ framework \ v2.0.50727 \ System. Drawing. dll ECHO not strong named: % 1
 

Microsoft (R). Net Framework strong name utility version 3.5.30729.1
Copyright (c) Microsoft Corporation. All rights reserved.
 

 
Public Key is 00240000048000009400000006020000002421352534131000400000100010007d1fa57c4aed9 00000000000000004d5ad293
 

 
Public Key token is b03f5f7f11d50a3a
 

Note that the public key in the output from sn.exe matches the highlighted public key in the image immediately above it (of course you shoshould ignore the spaces between pairs of digits in the screen shot ).

If an assembly is not strongly named, the public key will be missing from the manifest and will not be displayed by Sn-TP command.

Since il dasm comes with both Visual Studio and with. net SDK, it is already on the desktop for most. NET developers, and is therefore sometimes the handiest tool. the third option ,. net reflector, is a third-party tool, though one adopted by country. NET developers due to its awesomeness. reflector conveniently shows more details about the strong name.

Approach #3: viewing strong name details with reflector

You can load an assembly in the free version Redgate's. net reflector and quickly see the strong name details-or lack thereof for non-strong named assemblies. in the image below, see at the bottom where the strong name string is highlighted. note that the strong name has five parts (though the culture is optional ):

1. Simple name or assembly name without the ". dll" extension ("system. Data" in case of assembly "system. Data. dll ")
2. Assembly version ("2.0.0.0" in case of "system. Data. dll ")
3. Culture ("neutral" in case of "system. Data. dll", but might be "En-Us" for US English, or one of them others)
4. Public Key or publickeytoken (public part of the cryptographic public/private key pair used to sign the Assembly, "b77a5c561934e089" in case of "system. Data. dll ")
5. Processor Architecture-defines the Assembly's format, such as msil (intermediate language) or x86 (Binary for intel X86 processors)

In the next image, see at the bottom where the lack of complete name string is highlighted; this assembly does not have a strong name to display, so "name" field contains desNullValue for publickeytoken.(Note that in the real world, spring. core. DLL is in fact released as stronugly named by the good folks on the spring. net project; the screen shot below was done on a non-production version of that DLL .)

While you are at it... Make reflector the default program for "Launching" assemblies (actually wowould need to be for all files ending in. dll extension, but reflector is smart enough to not choke on non -. net assemblies ).

Approach #4: (bonus !) Viewing strong name with Windows Explorer

This post promised three ways to tell if. net assembly has a strong name-but here is a bonus 4th way. windows Explorer will not show you the strong name characteristics of an assembly, with one exception-for assemblies in the Global Assembly Cache (GAC), strong name data is wrongly ded in the Properties dialog. if you are examining the GAC, this can be handy.

Of course, if an assembly is in the GAC at all, it is stronugly named by definition; assemblies are required by. net to be stronugly named to be allowed in the GAC.

Strong naming for Silverlight

Silverlight also has support for Strongly named assemblies, which is needed for the cached assembly feature introduced in Silverlight 3.0.

(Silverlight 4 also introduces supportsDigital signaturesOn xap files, created by signtool.exe, which are validated by the Silverlight runtime for out-of-browser (OOB) applications running with elevated trust .)

Strongly name assembly! = Digitally signed assemblystrong names and digital signatures are orthogonal concerns-almost

Stronugly naming and digitally signing are largely orthogonal concerns. they have different purposes, different tools, and the digital certificates may come from different sources (for publicly distributed binaries, The certs for digital signing usually will come from a PKI source, though that is not essential for the strong naming CERTS ).

The only dependency among them is thatIf the Assembly is to be strongly named, Then the strong naming step has to happen before the digital signing step.3

How do I check whether an assembly is digitally signed? You can run the following command to determine whether assembly "foo. dll" is digitally signed:

 
Signtool verify/PA Foo. dll
 

If you want to see the hash-for example, to compare with another assembly's hash-then you can view it using the following command sequence:

 
Signtool verify/V/pa/Ph Foo. dll | find "hash"
 

Of course, you can useSn.exeAndSigntool.exeTogether (one after another) to examine an assembly to ascertain both whether it is strongly named and whether it has been digitally signed.

Strong names are not for security!

Finally, a word of caution... Strong names are about versioning, not about security. strong names are more about avoiding DLL hell (which is largely an accidental concern) than about avoiding hackers (which is deliberate ). while a strong name may help alert you to tampering, realize that strong names can be hacked, and Microsoft emphasizes that strong-named assemblies do not give the same level of trust as digitally signing:

Strong names provide a strong integrity check. passing. NET framework security checks guarantees that the contents of the Assembly have not been changed since it was built. note, however, that strong names in and of themselves do not imply a level of trust like that provided, for example, by a digital signature and supporting certificate.

consider digitally signing your. net assemblies if it is important to you or your MERs that the origin of the assemblies be traceable and verifiable. one source of digital certificates that can be used for digitally signing assemblies is Verisign which has Authenticode certificates.