识别GDR和LDR SOS.dll和mscordacwks.dll

Question

For the first time I have noticed that one of the mscordacwks DLLs in my collection is different (SVN told me). As I did some research I figured out that there are LDR versions and GDR versions of those DLLs.

For the files in question I noticed that one of them is not digitally signed, but the other one is (by Microsoft luckily).

So now I have the following questions:

• If I have an LDR and a GDR version, how do I figure out which one is which?
• Are both, GDR and LDR version of the DLL, signed by Microsoft?
• Since one of them isn't signed, could someone inject malicious code into mscordacwks.dll which then gets executed on my machine with debugging privileges when I use it in WinDbg?

I'll try to find out where I got the unsigned DLL from. It is quite likely that I downloaded it from some some more or less dubious website when I needed that particular version.

FYI: the VirusTotal analysis did not reveal any viruses.

Answer 1

Thanks to the help in the comments I can summarize:

Digital signatures

According to Hans Passant, all Microsoft DLLs should be signed, so we have to be careful with unsigned ones.

Unfortunately this statement is not 100% true which I verified for the Mscordacwks.dll 2.0.50727.312 and SOS.dll 2.0.50727.312. Microsoft has shipped that version with Windows Vista. I tried that by installing Windows Vista from scratch.

This is the output of sigcheck -h on the DLL which come with Windows Vista:

 Verified:       Unsigned
 Link date:      09:05 19.10.2006
 Publisher:      Microsoft Corporation
 Description:    Microsoft .NET External Data Access Support
 Product:        Microsoft« .NET Framework
 Prod version:   2.0.50727.312
 File version:   2.0.50727.312 (rtmLHS.050727-3100)
 MachineType:    32-bit
 MD5:    9252D83D169E84A442BB154A79AC2189
 SHA1:   63464F337295D689384BAA514F260C54D06291C6
 PESHA1: 99D57B38C554FFD4BEC6E6C2FAD7F77B980CB47B
 PE256:  EF387EF84028497D5F7D231ED3A6F5FB05C02D96BD3B0E470C6BEBFAD6942AC8
 SHA256: 5ADB79D39FC8401CB9542B571EEEC82CAFCADAE2F26997C789E14EC8E9635C08

And also see the detailed information from VirusTotal which has the same hash codes. Please note the fact that the website is a bit misleading by listing "Authenticode signature block". In fact that is just the version information of the file. The most important line labelled "Signature verification: Signed file, verified signature" is missing for this DLL.

This is how it should look like if the file was really signed:

The output of sigcheck and Windows Explorer also show that that the file is not signed :

Verified:       Unsigned
Link date:      09:05 19.10.2006
Publisher:      Microsoft Corporation
Description:    Microsoft .NET External Data Access Support
Product:        Microsoft« .NET Framework
Prod version:   2.0.50727.312
File version:   2.0.50727.312 (rtmLHS.050727-3100)
MachineType:    32-bit

Screenshot of Windows Explorer where the file does not have a digital signatures tab:

At the end of the VirusTotal report, you find a statement by NIST (National Institute of Standards and Technology) which says that the file is delivered with Windows Vista Ultimate and that it seems to be safe. This is the website I am being led to after I uploaded an unsigned version.

Distinguishing GDR and LDR versions

The SysInternals sigcheck tool displays more information on the version number than Windows Explorer. If it includes "GDR", it is a GDR version. If it does not contain GDR, it is an LDR version.

To get a string for comparison in C#, you can use the following code:

var versionInfo = FileVersionInfo.GetVersionInfo(fullFileName);
var fileVersion = versionInfo.FileVersion;

Affected versions

I checked all my DLLs for signatures and found more unsigned DLLs than expected. However, most files have already been scanned on VirusTotal before. However, none of these versions has a NIST entry .

• x86 SOS 1.1.4322.2032 VirusTotal
• x86 SOS 2.0.50767.312 VirusTotal
• x86 Mscordacwks 2.0.50767.312 VirusTotal
• x86 Mscordacwks 2.0.50767.3603 VirusTotal
• x86 Mscordacwks 2.0.50727.3623 VirusTotal
• x64 SOS 2.0.50767.3074 VirusTotal
• x64 Mscordacwks 4.0.30319.1008 VirusTotal

Malicious code injection

As stated by Jeroen Mostert, the DLLMain entry point will be executed, therefore there is the possibility of malicious code injection.