Really understand the mysterious digital signature in SP2

Do you know? The SP2 with digital signature released by Microsoft is the official version (right click on the file properties window to view the digital signature information shown in Figure 1). What is the matter?


Figure 1
a, the Windows File Protection feature windows 2000

in previous versions of Windows, the software beyond the operating system is installed, you may overwrite some shared System files, such as dynamic link libraries (*.dll files), executable files (*.exe), may cause unstable programs and system failures, mainly due to so-called DLL traps.

In order to completely solve this problem, in Windows 2000 and Windows XP, Microsoft introduced the "Windows File Protection" mechanism to prevent replacement of protected system files, including *.sys, *.dll, * .ocx, *.ttf, *.fon, *.exe and other types of files, Windows file protection automatically runs in the background, can protect all files installed by the Windows installer.

Windows File Protection can detect other programs to replace or move intent protected system files, then on what basis it is to detect it? In fact, Windows file protection is by detecting the digital signature of the file to determine whether the version of the new file is the correct version of Microsoft. If the file version is incorrect, Windows File Protection will automatically call the dllcache folder or the backup file stored in Windows to replace the file. File, if Windows File Protection cannot locate the corresponding file, the user will be prompted to enter the location or insert the installation CD.

Second, recognize digital signatures

digital signature that allows the user to verify if the file does not have a valid digital signature, it will not ensure that the file is actually from the source it claims to be, or not Make sure it has not been tampered with after the release (may be tampered with by the virus). At this point, it is safer to open the file safely unless you determine the creator of the file and know its contents, otherwise it is not recommended to open the file easily. Any hardware or software that has been digitally signed by Microsoft will generally have the logo "Designed for Microsoft Windows XP" on its outer packaging.

When installing new software on your computer, system files and device driver files are sometimes overwritten by unsigned or incompatible versions, causing system instability. The system files and device driver files provided with Windows XP have Microsoft digital signatures, which indicate that these files are original unmodified system files, or they have been approved by Microsoft for Windows. The "File Signature Verification" tool is provided in Windows 2000/XP (see Figure 2), and Windows 9x provides the "System File Checker", which allows us to check the digital signature status of system files.


Figure 2

By default, Windows File Protection is always enabled, while allowing Windows digital signature files to replace existing files. Currently, signature files are distributed in the following ways: Windows Service Pack, Patch Distribution, Operating System Upgrade, Windows Update, Windows Device Manager/Category Installer.