27

I have a website that uses AjaxControlToolkit.dll and Log4Net.dll.

When I try to run the performance profiling tool in VS 2010 on it it gives me the following warning:

AjaxControlToolkit.dll is signed and instrumenting it will invalidate its signature. If you proceed without a post-instrument event to re-sign the binary it may not load correctly.

Now, if I choose the option to continue without re-signing, the profiling starts but the assembly doesn't load and gives an ASP.NET exception.

1
  • Note that the [PathofDLL] (per Vince & ghusse answers) will be located in the obj project folder, not the bin folder.
    – Mark
    Commented Oct 7, 2010 at 8:54

6 Answers 6

21

If you're doing this on a development machine, you can disable strong name verification altogether with sn -Vr *. If you do this, you don't have to resign anything. This approach can be a security risk, but if you are comfortable with it, it's easier than resigning.

Specifically, from MSDN, it says:

Registers assembly for verification skipping. Optionally, you can specify a comma-separated list of user names. If you specify infile, verification remains enabled, but the public key in infile is used in verification operations. Assembly can be specified in the form *, strongname to register all assemblies with the specified strong name. Strongname should be specified as the string of hexadecimal digits representing the tokenized form of the public key. See the -t and -T options to display the public key token.

And the security risk:

Caution: Use this option only during development. Adding an assembly to the skip verification list creates a security vulnerability. A malicious assembly could use the fully specified assembly name (assembly name, version, culture, and public key token) of the assembly added to the skip verification list to fake its identity. This would allow the malicious assembly to also skip verification.

8
  • 7
    .. and one must not forget the opposite: sn -Vu * (This is to re-enable verification with this method) Commented Nov 17, 2011 at 21:10
  • 2
    sn -Vx also re-enables verification of all assemblies. To quote the docs: "Removes all verification-skipping entries.".
    – user456814
    Commented Mar 9, 2012 at 21:39
  • 1
    For profiling into 3rd party assemblies, where I do not have the signing key, this proved to be the only solution I could get working Commented May 8, 2014 at 23:46
  • 1
    So ... sn -Vu * or sn -Vx?? :) Commented Nov 24, 2014 at 16:00
  • 1
    Much faster than adding post-instrumentation events, you don't have to remember to add/remove entries, and it can be easily undone using the Vx command.
    – jbeanky
    Commented Aug 31, 2015 at 16:19
17

ghusse linked to a blog post giving the answer. The answer is described there. As he points out, you have to use a post-instrument event on each signed assembly.

It's easiest to call sn.exe directly:

"C:\Program Files\Microsoft SDKs\Windows\v7.0A\bin\sn.exe" -R [pathOfDll] [pathOfSNK]

Note that [pathOfDll] is located in the directory obj\Debug associated to the project.

4
  • what is this answer? where should it be called?
    – serhio
    Commented Jun 9, 2011 at 15:19
  • The answer is the link given by ghusse: blogs.msdn.com/b/ianhu/archive/2005/07/25/443021.aspx.
    – Vince
    Commented Jun 21, 2011 at 8:43
  • 1
    This seems to have gotten me past the initial problems, unfortunately I'm running into issues getting the web server to launch after that. I will note too though that implementing this event for each assembly is a pain when you have 30+ assemblies like we do in our project.
    – jpierson
    Commented Sep 21, 2012 at 14:40
  • sn.exe may be located on different location. For example in my case, it was located at "C:\Program Files (x86)\Microsoft SDKs\Windows\v8.1A\bin\NETFX 4.5.1 Tools\sn.exe". So search for sn.exe in Windows drive if you don't find it
    – Abdul Rauf
    Commented Dec 8, 2015 at 10:47
7

The answer is described here. You have to use a post-instrument event on each signed assembly.

I could not manage to make it work "as is" with my installation of VS 2010. I had to call this command line as a post-build event on each dll :

"C:\Program Files\Microsoft Visual Studio 10.0\VC\vcvarsall.bat"   & sn -Ra [pathOfDll] [pathOfSNK]

Note that [pathOfDll] is located in the directory obj\Debug associated to the project.

5

The easiest way to get instrumentation work on signed binaries, which have not been re-signed, is to disable signature checks altogether. This is a machine wide setting that you can activate by registering an exception for the * pattern:

sn.exe -Vr *

This command must be executed from an elevated command prompt. You will find sn.exe in the SDK (in my case, I found it in C:\Program Files (x86)\Microsoft SDKs\Windows\v7.0A\Bin).

When you are finished with testing, you should unregister the exception:

sn.exe -Vu *

or else your machine could be vulnerable to malicious code, since assemblies will be trusted even if they have been tampered with.

See also Access denied running sn.exe on Windows 7.

1

The profiler probably changes the assembly and because it was previously signed. Apparently you need to add a post-instrument action that re-signs the assembly.

This could be a problem because you do not have the sn file that was used to sign the 3rd party assemblies.

0

Might have taken the lazy learning-new-things-free way out here, but I ended up solving this by writing a powershell script to unsign all the projects in my solution -- worked just fine. As part of the script, I save the original csproj files so I can revert them after. (you could also just undo changes in source control).

http://pastebin.com/UbABvz7d

should be able to revert by calling it passing the -revert switch.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.