A simple way around this problem is to append the MD5 signature to the end of the EXE and exclude that appended portion from the MD5 calculation.
I also would suggest that you wrap the MD5 signature in some easily recognized characters so your self-detection code can first check to see if the tail of the file even contains the MD5 signature at all. Glenn Lawler -----Original Message----- From: Roger C. Morgan II [SMTP:[EMAIL PROTECTED] Sent: Friday, January 20, 2006 9:21 AM To: [email protected] Subject: [delphi-en] Re: Including a file integrity check using md5 The traditional way of using md5 would be to have the hash in a separate file with the extension .md5. This way it is transfered independently for the download corruption issue. If file modification is concerned downloading the checksum from a separate (often more trusted) server affords additional protection because it's harder for the hacker to gain access to multiple servers. Off the top of my head, if I was going to build this into my own application, I'd have the application download the checksum from my server, even if the application was downloadable from anywhere accross the net to distribute bandwidth requirements. Just some thoughts, Roger C. Morgan II [EMAIL PROTECTED] --- In [email protected], "petesouthwest" <[EMAIL PROTECTED]> wrote: > > > It's always a bad thing to think, as a programmer, you can outsmart > > a hacker and even you're right to make things as hard as possible for > > such a person, an approach like this is easy to circumvent: a hacker > > could easily wipe out the entire check (using NOP's or by always > > returning true at the comparison) or by "updating" the hash after > > patching (cracking) the application. > > I know it would only delay them for a while! It would be just one more > thing they would have to do. I also like the fact that it ensures the > app hasnt got corrupted during download. > > > > But to return to the issue at hand: you can overcome this MD5- hash > > "chicken & egg-problem" by NOT including that part of the file where > > it's stored, while doing the hashing. > > > > Can you tell me how I would do that? A the moment I'm using a > thirdparty md5 code from > http://www.cityinthesky.co.uk/cryptography.html, I load the exe into a > TMemoryStream, and then assign that to the hashing component and set > it going by: > Hash:= TDCP_md5.Create(Self); > Hash.Init; > Hash.UpdateStream(Source,Source.Size); > Hash.Final(Digest); > Source.Free; > > How would I go about only giving part of my file, and how would I know > which bit to give? > > Thanks > Pete > ----------------------------------------------------- Home page: http://groups.yahoo.com/group/delphi-en/ To unsubscribe: [EMAIL PROTECTED] Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/delphi-en/ <*> To unsubscribe from this group, send an email to: [EMAIL PROTECTED] <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/
