Please don’t reply to comments when you’re talking out your ass, that doesn’t help anyone. You don’t know wtf you’re on about, at all.
Comment on Microsoft Defender Flags Tor Browser as a Trojan and Removes it from the System - Deform
DeathsEmbrace@lemmy.world 8 months agoBecause it makes it the easiest thing to spoof an .exe which enables attacks of which you will never get out of. A legit.exe vs a spoofed legit.exe will be the exact same in every way except the coding in spoofed fucks you.
xantoxis@lemmy.world 8 months ago
starchturrets@feddit.de 8 months ago
Not really, WDAC doesn’t usually just look at the filename. It can look at the certificate it was signed by, or fallback to using hashes.
CheezyWeezle@lemmy.world 8 months ago
Lmao your edit 2 is completely silly. SHA-256 is what would be used for checksum verification, and SHA-256 is pretty much collision resistant, and even then if two files computed the same hash they would have such different contents/properties that it would be obvious they are not the same file. MD5 and SHA-1 have been phased out for any serious usage for a while now.
Seriously tho, if you don’t know what you are talking about you should probably stop making a fool of yourself
CheezyWeezle@lemmy.world 8 months ago
I’m not sure that these things work the way you think they do… an antivirus wouldn’t just look for the name of an executable to be “legit.exe” but rather would look at what the program calls itself in it’s manifest, compute the hash for the executable binary file, and compare that hash against a database of known good hashes. If the contents of the executable compute a hash identical to the known good hash, then you know the contents of the executable are clean.
gronjo45@lemm.ee 8 months ago
Still getting into programming and having a bit of trouble understanding what a “manifest” is. What does this technically entail? Are “manifests” implemented differently by PL or OS?
CheezyWeezle@lemmy.world 8 months ago
The manifest (at least how I am using the term) is whatever metadata a file has, and the format and location of this metadata can differ between operating systems. Usually the manifest is generated by the operating system based off of header data from the file itself, and details about the file that the operating system can deduce, such as file size, origin, location, file type, etc. In Windows you can view this info by right clicking/opening the context menu on any file and selecting “Properties”, on macOS by opening the context menu and selecting “Get Info”, and on other OSes such as linux/freeBSD it will be something similar.
There are other usages for “manifest” depending on the context, for example a manifest.xml would be something a developer would include with an android app that has configuration settings and properties for the app.
Gabu@lemmy.world 8 months ago
Manifests are like an abstract for an executable.