inno Setup unsigned .tmp file

[Peter Sokolov]

Hello,

it looks like Microsoft Defender with activated Attack Surface Reduction (ASR) rule blocks execution of unsigned .tmp file that inno Setup creates in the Temp folder when starting the installation. This rule is being activated on more and more Windows systems. The installation .exe itself is signed with the EV certificate. But that does not prevent blocking of the unsigned .tmp file.

Does this mean that installation packages generated by inno will soon be unusable?

Is there any workaround to prevent unsigned .tmp (exe) file to be generated during the installation process? Could we generate and sign that file during the generation of install package?

[Martijn Laan - Inno Setup]

Hi,

Sounds like you did not set the SignTool directive? Otherwise the file would be signed.

https://jrsoftware.org/ishelp/index.php?topic=setup_signtool

Greetings,

Martijn

-------- Original Message --------

--
You received this message because you are subscribed to the Google Groups "innosetup" group.
To unsubscribe from this group and stop receiving emails from it, send an email to innosetup+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/innosetup/ccb58489-18ce-4863-b3f7-37f8f2129fbfn%40googlegroups.com.

[Peter Sokolov]

Hi,

I sign the installer mysetup.exe witn an EV certificate. That one is started normally when the user starts the installation. Without any warnings. The problem occurs a bit later.

The signed mysetup.exe writes a mysetup.tmp file to TEMP folder and wants to execute it. This mysetup.tmp file is not signed so its execution is blocked. Signing the .exe file does not help, because the extracted .tmp file remains unsigned even when the installer .exe file from whre the .tmp file is extracted is signed.

Defender log shows the following:

mysetup.exe launch of mysetup.tmp was blocked by the attack surface reduction (ASR) rule "Block executable files from running unless they meet a prevalence age, or trusted list criteria".

An EV signed .exe or .tmp file fulfills the "trusted list criteria" condition. As the .tmp file that the installer extracts and wants to execute is not signed and as far as I understand cannot be signed at the moment, it is blocked by default.

Peter

[Martijn Laan - Inno Setup]

Hi,

If you set SignTool the .tmp file is signed. 

If you cannot set SignTool like this you can still get a signed .tmp file by setting SignUninstallerDir to yes, and manually signing when prompted.

This is explained in the help topic I linked.

Greetings,

Martijn

-------- Original Message --------

To view this discussion visit https://groups.google.com/d/msgid/innosetup/2b039502-24e9-4a6b-a890-236ba314990an%40googlegroups.com.

[Peter Sokolov]

Thank you Martin!

This really helps. When I set SignTool, the .tmp file is signed as well.

I have set it in the following way:

In the iss-file:

[Setup]

SignTool=mysign

When running the packager:

"c:\Program Files (x86)\Inno Setup 6\iscc.exe" /Smysign="y:\builder\sign.bat MyInstaller $f" /DMyAppVersion=%VER

I have also removed signing of the final distribution .exe that is generated by Inno, as it is now already signed by inno during packaging.

Before consulting here, I searched in the Internet and consulted various AI like Claude. Everywhere the conclusion was that setting SignTool will only cause the installer and uninstaller to be signed, but not the .tmp file that is extracted during the installation. Also the page that you linked above does not state anywhere that also .tmp will be signed and that setting SignTool should therefore be the preferred method instead of using a separate step for signing after inno finishes packaging. Maybe you can put some clarification about that on that page, so that other users and the AI will understand that also the tmp file is signed and that this will solve the problem where the installaition is rejected by Windows when the installer file is signed, but only the tmp file is not signed.

Thank you again and greetings,

Peter

[Martijn Laan - Inno Setup]

Hi,

Op 17-8-2026 om 17:56 schreef Peter Sokolov:

Thank you Martin!

This really helps. When I set SignTool, the .tmp file is signed as well.

Excellent 👍

You might want to start using the signonce flag on your [Files] entries as well, this makes the compiler sign your source files. Or if you have them signed already, you should at least add a signcheck flag to avoid accidentally shipping unsigned files.

Before consulting here, I searched in the Internet and consulted various AI like Claude. Everywhere the conclusion was that setting SignTool will only cause the installer and uninstaller to be signed, but not the .tmp file that is extracted during the installation.

Yes, I can understand: The documentation hides some technical facts. What you're calling 'the installer and uninstaller' and the .tmp file are actually the same .exe file: Setup.e32 (or .e64). What you were signing manually before was the 'setup loader' only. This is a second .exe file: SetupLdr.e32 (or .e64).

In other words: when the documentation talks about 'Setup' versus 'Uninstall' it's not talking about two different .exe files: it's just the same file running in a different mode, either named <random>.tmp or unins???.exe. This file runs in uninstaller mode by default, but is set to run in installer mode when launched by the 'setup loader' via the command line (it can't modify the file instead, because it's signed).

I don't know if this explanation makes a lot of sense. Even when running you barely notice this internal fact, and like I said, it's barely mentioned in the docs. So it's not a surprise the AI doesn't understand that this .tmp file is just (bit-for-bit) the actual installer, and is also the uninstaller, and is signed via SignTool or SignedUninstallerDir.

I will try to make this more clear in the docs, without including these internals.

Greetings,
Martijn