So a couple of weeks ago I ran into a situation on a project I was working on where all projects in the solution were signed, we received a third party assembly from a vendor that was not. We asked them to sign it but it was going to take nearly 2 weeks before we received that delivery. In order for us to move forward I needed to have this assembly signed, but how do you sign an assembly without access to the source code?
Well a coworker of mine came up with a rather ingenious solution, and I am posting here so the knowledge can be shared. I googled for a solution and found none so hopefully this will help people with this same situation.
So here are the commands:
ildasm /tokens /out=unsignedAssembly.il
unsignedAssembly.dll
ilasm /dll /key=key.snk unsignedAssembly.il
/out=signedAssembly.dll
As you can see whats happening here is you use the dissassembler to generate the MSIL code into the unsignedAssembly.il file, at which point you essentially have the code, or a form of it. Next you use the assembler to reassemble the msil code into the binary assembly but this time you sign it using your key!
Its brilliant, it works great and I did not notice any drawbacks to doing it this way.