Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I have c# program , and one file from where it read-write some info. I need that user can not change that file’s content, I need some way to chek is that file correct(not changed by user). Please if you have any ideas write, will discuss together.
Many Thanks
There is no completely reliable method to accomplish what you are wanting. If you hash the file, the user can modify the file and regenerate the hash, and then your program will think the file is unmodified. If you try to hide the hash in the registry, the user can easily use SysInternals tools to detect the location you are saving it to.
You could instead digital sign the file, which is similar to hashing it, except it involves a secret key. Again however, you have the issue that the key must be kept secret, and storing it in the application or somewhere on the computer leaves the potential for the user to locate the key and then again they are able to modify the file and resign it such that the modification is undetectable by your program.
You could have your application submit the file, or perhaps just a hash of the file for efficiency, to a web service you create. The web service can digital sign the file or hash, and return the signature or store it on the server. Later when the application reads the file, it can use the signature and server’s public key(you must get this from the server to ensure that the file was signed by the server) to verify the file has not been changed. Or you could resubmit the file or hash to the server, if the server stored the signature, and it can verify the file and return a result to the application. Again, this is not fullproof. There would be ways for a user to spoof the webservice, even if using SSL there are ways to circumvent that. The user could altogether crack your application and remove the verification code.
Judging from your other questions, this is some component of a software activation system. Just take a look at Adobe and Microsoft, and their failed attempts to create such a system. If you think you can do better, good luck. There are better ways to ensure your software is used legally without activation systems that lead only to frustrating your loyal users.