Quote:
Originally posted by volodya
Unless you know Microsoft's checksumming algorithm
Any ideas where I can find it? Do you mean a PE checksum or sth more sophisticated? Give me more info, please!
|
SfcValidateFileSignature() validates the protected files using the CryptoAPI. MS probably calls sfc_os.dll's exported functions to install the new files (which are signed by MS).