XML Manifests and Code Signing and Vista... Oh, My!

I want to make my app reasonably compatible with
Vista, at least to get rid of the scary install
messages. I've ordered a code-signing certificate
from Comodo and the SDK from MS needed to use it.
I've found step-by-step instructions on extracting
the code signing stuff from the SDK and signing
files.

What I'm having trouble with is the whole XML
manifest business. When I go to MSDN it's like I
fell down a rabbit hole: Every page introduces a
bunch of new terms, like "Assembly manifests",
"Application Manifests", "Side-by-side
assemblies", etc, etc, and when I follow those
links they seem to spread out in all directions.
(But I quickly realized that "assembly" isn't the
kind we normally talk about here!)

Added to the complication is that my app is
written in pure MASM32, but every example I've
seen assumes an HLL. In fact, even the stated
reasons for why the manifest is needed don't seem
to apply: I'm not using any APIs that didn't come
with Win95. No tricky DLL dependencies, etc.

So, has anyone been down this road yet with a pure
assembly app? I'd be very grateful for any
pointers or examples.

Thanks, and best regards,


Bob Masta

DAQARTA v4.00
Data AcQuisition And Real-Time Analysis
www.daqarta.com
Scope, Spectrum, Spectrogram, Sound Level Meter
FREE Signal Generator
Science with your sound card!

(Bob Masta) wrote:
> So, has anyone been down this road yet with a pure
> assembly app? I'd be very grateful for any
> pointers or examples.

Cannot help you with the code signing part, but as far as putting a
manifest in a pure assembly app, I've been down that route. This was
just for enabling visual styles but may serve as a starting point.

-------------- Example manifest ----------------
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
name="YourCorp.YourProduct.YourExe"
processorArchitecture="x86"
version="5.1.0.0"
type="win32"/>
<description>Windows Shell</description>
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="x86"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>
</assembly>
-------------- Example manifest ----------------

For a x64 application, change processorArchitecture to "amd64"
_but_do_not_change_the_win32_bit_ !

Now, how to put this into your application? This is done in the resource
script:

------------- Example .rc excerpt ---------------
#define RT_MANIFEST 24
#define CREATEPROCESS_MANIFEST_RESOURCE_ID 1
#define ISOLATIONAWARE_MANIFEST_RESOURCE_ID 2
#define ISOLATIONAWARE_NOSTATICIMPORT_MANIFEST_RESOURCE_ID 3
#define MINIMUM_RESERVED_MANIFEST_RESOURCE_ID 1 /* inclusive */
#define MAXIMUM_RESERVED_MANIFEST_RESOURCE_ID 16 /* inclusive */

CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "YourXml.mft"
------------- Example .rc excerpt ---------------

That's it.

(Bob Masta) <spamtrap@crayne.org> wrote:
>
>I want to make my app reasonably compatible with
>Vista, at least to get rid of the scary install
>messages.

What scary install messages?
--
Tim Roberts, timr@probo.com
Providenza & Boekelheide, Inc.

On Tue, 09 Sep 2008 05:04:05 GMT, Tim Roberts
<spamtrap@crayne.org> wrote:

>(Bob Masta) <spamtrap@crayne.org> wrote:
>>
>>I want to make my app reasonably compatible with
>>Vista, at least to get rid of the scary install
>>messages.
>
>What scary install messages?
>--

----- quoted message ----
User Account Control:
An unidentified program wants access to your
computer.
Don't run this program unless you know where it's
from or you've used it before.

--> Cancel: I don't know where this program is
from or what it's for.

--> Accept: I trust this program. I Know where

it's from or I've used it before>

-> Details:

---------- End quoted message -----

If you click on Details you see the name of the
install file and "Unidentified publisher".

Best regards,



Bob Masta

DAQARTA v4.00
Data AcQuisition And Real-Time Analysis
www.daqarta.com
Scope, Spectrum, Spectrogram, Sound Level Meter
FREE Signal Generator
Science with your sound card!

On Tue, 09 Sep 2008 00:44:50 +0200, Michael
Tippach <spamtrap@crayne.org> wrote:

>(Bob Masta) wrote:
>> So, has anyone been down this road yet with a pure
>> assembly app? I'd be very grateful for any
>> pointers or examples.
>
>Cannot help you with the code signing part, but as far as putting a
>manifest in a pure assembly app, I've been down that route. This was
>just for enabling visual styles but may serve as a starting point.
>
>-------------- Example manifest ----------------
><?xml version="1.0" encoding="UTF-8" standalone="yes"?>
><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
><assemblyIdentity
> name="YourCorp.YourProduct.YourExe"
> processorArchitecture="x86"
> version="5.1.0.0"
> type="win32"/>
><description>Windows Shell</description>
><dependency>
> <dependentAssembly>
> <assemblyIdentity
> type="win32"
> name="Microsoft.Windows.Common-Controls"
> version="6.0.0.0"
> processorArchitecture="x86"
> publicKeyToken="6595b64144ccf1df"
> language="*"
> />
> </dependentAssembly>
></dependency>
></assembly>
>-------------- Example manifest ----------------
>
>For a x64 application, change processorArchitecture to "amd64"
>_but_do_not_change_the_win32_bit_ !
>
>Now, how to put this into your application? This is done in the resource
>script:
>
>------------- Example .rc excerpt ---------------
>#define RT_MANIFEST 24
>#define CREATEPROCESS_MANIFEST_RESOURCE_ID 1
>#define ISOLATIONAWARE_MANIFEST_RESOURCE_ID 2
>#define ISOLATIONAWARE_NOSTATICIMPORT_MANIFEST_RESOURCE_ID 3
>#define MINIMUM_RESERVED_MANIFEST_RESOURCE_ID 1 /* inclusive */
>#define MAXIMUM_RESERVED_MANIFEST_RESOURCE_ID 16 /* inclusive */
>
>CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "YourXml.mft"
>------------- Example .rc excerpt ---------------
>
>That's it.

Michael, thank you very much! That's just the
sort of info I was looking for. Is a special
(new) version of RC.EXE needed to compile the RC
file, or is my old MASM32 v8 version likely to
work?

Thanks again, and best regards,



Bob Masta

DAQARTA v4.00
Data AcQuisition And Real-Time Analysis
www.daqarta.com
Scope, Spectrum, Spectrogram, Sound Level Meter
FREE Signal Generator
Science with your sound card!

(Bob Masta) wrote:

> Is a special
> (new) version of RC.EXE needed to compile the RC
> file, or is my old MASM32 v8 version likely to
> work?

I would think the latter to be true. Initially I even started
using a Borland tool chain from the Dark Ages and I still prefer
the Borland resource compiler over the MS one which seems too
dump to perform things as simple as integer multiplication.

Basically, all you write in the .rc is :

1 24 "MyMft.mft"

And any rc should be able to deal with that.

On Wed, 10 Sep 2008 00:32:00 +0200, Michael
Tippach <spamtrap@crayne.org> wrote:

>(Bob Masta) wrote:
>
>> Is a special
>> (new) version of RC.EXE needed to compile the RC
>> file, or is my old MASM32 v8 version likely to
>> work?
>
>I would think the latter to be true. Initially I even started
>using a Borland tool chain from the Dark Ages and I still prefer
>the Borland resource compiler over the MS one which seems too
>dump to perform things as simple as integer multiplication.
>
>Basically, all you write in the .rc is :
>
>1 24 "MyMft.mft"
>
>And any rc should be able to deal with that.
>

Thanks again. After I posted, I realized that I
could at least test your manifest with my RC.EXE
even without the code signing stuff... and it
works just fine. As it turns out the visual
styles or themes or whatever look pretty bad on my
app (hard to read button text, hard to tell if
button state is up or down, etc), so I removed
those lines and still works OK. Just heard from
Comodo that my certificate has been approved.
Now if Microsoft would just send my SDK (for which
I paid extra to get Priority mail... nearly 2
weeks ago!) I'd be ready to try some code signing!

Best regards,


Bob Masta

DAQARTA v4.00
Data AcQuisition And Real-Time Analysis
www.daqarta.com
Scope, Spectrum, Spectrogram, Sound Level Meter
FREE Signal Generator
Science with your sound card!

Bob Masta wrote:

[about M$ code-signing...]

> Now if Microsoft would just send my SDK (for which
> I paid extra to get Priority mail... nearly 2
> weeks ago!) I'd be ready to try some code signing!

Please let us know if this gives you the right to sign your
own crated code as M$-compliant.
(sorry for I heavy daubt this yet)

__
wolfgang

"Wolfgang Kern" <spamtrap@crayne.org> wrote:
>
>Bob Masta wrote:
>
>[about M$ code-signing...]
>
>> Now if Microsoft would just send my SDK (for which
>> I paid extra to get Priority mail... nearly 2
>> weeks ago!) I'd be ready to try some code signing!
>
>Please let us know if this gives you the right to sign your
>own crated code as M$-compliant.
>(sorry for I heavy daubt this yet)

What do you mean by "M$-compliant"? Code signing certainly works. I've
done it. As a driver developer, I'm required to sign any drivers that will
run on Vista 64.
--
Tim Roberts, timr@probo.com
Providenza & Boekelheide, Inc.

Tim Roberts replied:
> "Wolfgang Kern" <spamtrap@crayne.org> wrote:

[about M$ code-signing...]
>>> Now if Microsoft would just send my SDK ...
>> Please let us know if this gives you the right to sign your
>> own crated code as M$-compliant.
>> (sorry for I heavy daubt this yet)

> What do you mean by "M$-compliant"?

I mean this magic numbers which XP seem to compare against a
prebuilt list (somewhere deep hidden).

> Code signing certainly works. I've done it.
> As a driver developer, I'm required to sign any drivers that will
> run on Vista 64.

If I understand this right, the sign-tools come with the SDK
and grant an MS-tool created driver one of these numbers,
perhaps modified by checksum or else ?

I once wrote a few win3.11 and 98se drivers for my own hardware,
but I couldn't make it work on XP without 'sign check disabled'.
Probably just because I used other than M$ tools

It's not an big issue anymore, because the few hardware built
recently will be used with my own OS only anyway.
__
wolfgang