1

Is there anywhere I can download a list of checksums for microsoft-published OS executable files, preferably grouped by release name?

I could do the same by decompressing files on a windows setup CD, and checksumming them, and then doing the same thing to all installed updates via WSUS and some scripting, but this seems like a lot of work. There must be an easier way!

Do Microsoft release such a list?

As an additional, related, question - why do MS sign so few of their executables? Obviously the PE loader only verifies signatures when things are loaded in to kernel mode, but is there any reason why MS don't simply sign all executables? It'd sure make verification a lot easier.

| improve this question | |
  • What evidence do you have that they don't sign executables? – Steve May 22 '14 at 16:24
  • Checksums would become stale once they were patched. Different patch levels would result in different checksums. – schroeder♦ May 22 '14 at 22:48
  • @Steve - I mean the windows PE signatures that the kernel uses to load modules. I know they aren't present in that format because I can't verify them. – randomdude May 23 '14 at 4:06
  • @schroeder - Yes, checksums would need to be supplied for updates also. – randomdude May 23 '14 at 4:36
  • You don't understand. Updates don't always simply replace the original files. Sometimes they modify them. You can't predict what the checksums would look like with different patch levels. That's why 'running checksums' isn't used. There can be no such stable list of checksums. – schroeder♦ May 23 '14 at 17:44
1

Some software on MSDN has hashes published but I can't find a way to get a decent list.

They don't appear to publish hashes in the download centre either.

As I understood it though, any software issued through Windows Update should be signed and certainly all 64bit Windows software should be signed.

Can't really think of a reason they don't sign everything other than the overheads of maintaining signing keys for such a large set of software. You certainly would have expected their build process to automatically sign any release software.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.