inno Setup unsigned .tmp file

[Peter Sokolov]

Hello,

it looks like Microsoft Defender with activated Attack Surface Reduction (ASR) rule blocks execution of unsigned .tmp file that inno Setup creates in the Temp folder when starting the installation. This rule is being activated on more and more Windows systems. The installation .exe itself is signed with the EV certificate. But that does not prevent blocking of the unsigned .tmp file.

Does this mean that installation packages generated by inno will soon be unusable?

Is there any workaround to prevent unsigned .tmp (exe) file to be generated during the installation process? Could we generate and sign that file during the generation of install package?

[Martijn Laan - Inno Setup]

Hi,

Sounds like you did not set the SignTool directive? Otherwise the file would be signed.

https://jrsoftware.org/ishelp/index.php?topic=setup_signtool

Greetings,

Martijn

-------- Original Message --------

--
You received this message because you are subscribed to the Google Groups "innosetup" group.
To unsubscribe from this group and stop receiving emails from it, send an email to innosetup+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/innosetup/ccb58489-18ce-4863-b3f7-37f8f2129fbfn%40googlegroups.com.

[Peter Sokolov]

Hi,

I sign the installer mysetup.exe witn an EV certificate. That one is started normally when the user starts the installation. Without any warnings. The problem occurs a bit later.

The signed mysetup.exe writes a mysetup.tmp file to TEMP folder and wants to execute it. This mysetup.tmp file is not signed so its execution is blocked. Signing the .exe file does not help, because the extracted .tmp file remains unsigned even when the installer .exe file from whre the .tmp file is extracted is signed.

Defender log shows the following:

mysetup.exe launch of mysetup.tmp was blocked by the attack surface reduction (ASR) rule "Block executable files from running unless they meet a prevalence age, or trusted list criteria".

An EV signed .exe or .tmp file fulfills the "trusted list criteria" condition. As the .tmp file that the installer extracts and wants to execute is not signed and as far as I understand cannot be signed at the moment, it is blocked by default.

Peter

[Martijn Laan - Inno Setup]

Hi,

If you set SignTool the .tmp file is signed. 

If you cannot set SignTool like this you can still get a signed .tmp file by setting SignUninstallerDir to yes, and manually signing when prompted.

This is explained in the help topic I linked.

Greetings,

Martijn

-------- Original Message --------

To view this discussion visit https://groups.google.com/d/msgid/innosetup/2b039502-24e9-4a6b-a890-236ba314990an%40googlegroups.com.