How to check that a file is dual code signed

In Visual Installer 2015 we added a new function that makes it possible to dual code sign setup files. You can read about the new function in the following blog post:

> Visual Installer now supports SHA-2 and dual code signing

Before you distribute your installation package it can be a good idea to check that the dual sign process succeeded. You can do it easily by following the steps below:

1. Create your setup package from Visual Installer.
2. Locate the setup package file via Windows Explorer.
3. Right-click on the file.
4. Choose the Properties menu item in the local menu that is opened.
5. Open the Digital Signatures tab.

If the file has been successfully dual signed, there should be two rows in the signature list:

Windows Properties window

The digest algorithms should be sha1 and sha256, as shown in the picture above. If there is only one row in the signature list, the dual code sign process failed or you have not set Visual Installer to dual code sign setup packages. Read this tip to get more information about how to change code sign settings in Visual Installer.

See also
> What is SHA-1 and SHA-2 and what’s the difference between them?
> How to code sign a setup package (Visual Installer tip)

The %REG1 to %REG5 variables in Visual Installer

In this blog post we explained how to use variables in Visual Installer. Many variables get their values automatically from known locations in Windows Registry, but there are also some variables in Visual Installer that can obtain their values from locations in Windows Registry that you specify.

The %REG1 to %REG5 variables
There are five variables in Visual Installer that can obtain their values from keys and value names in the Windows Registry that you specify. They have the following names: %REG1, %REG2, %REG3, %REG4, and %REG5.

How to specify a location in Registry to read
To specify a key and value name in the Registry for any of these variables, you must first open the Variables dialog box in Visual Installer’s editor. You can do this by first opening the Registry or INI files tab in Visual Installer’s editor, and then click on the Variables button, that is located at the bottom right of the editor:

The Variables button

The following dialog box will be opened if you click on the button:

List with variables

If you scroll to the bottom of the list, you will find the User variables section:

List with variables - The User variables section

As default, these variables are empty but you can specify a key and value name for them by clicking on the Change values button (in the bottom left), and then specify the information in the Change contents for variables dialog box that is opened:

The 'Change contents for variables' dialog box

To specify a key and value for example for the %REG1 variable, you need to enter the information at the %REG1 text box in the User variables section. For example like this:

HKEY_LOCAL_MACHINE\SOFTWARE\SamLogic\Visual Installer\10.5 :: Path

HKEY_LOCAL_MACHINE\SOFTWARE\SamLogic\Visual Installer\10.5” is the key and “Path” is the value name. You can read more about this format in Visual Installer’s User Guide.

In the picture below we have specified keys and values for both the %REG1 variable and the %REG2 variable:

A key and value name has been specified for the REG1 and REG2 variables

You can click OK to save the keys and value names. In the Variables dialog box you will now see the information that you entered in the previous dialog box in the Contents column of the variable list. You can also see the current value for the variable (that is read from the Registry) by hovering the mouse pointer over the variable name, as shown in the picture below:

Shows the tip text function

During the installation, the %REG1 to %REG5 variables will read its contents from the end-users Registry. If no contents is available, the variables will be empty.

See also
> Your project’s bitness affects where the %REG1 to %REG5 variables get their values
> Variables in Visual Installer

Your project’s bitness affects where the %REG1 to %REG5 variables get their values

As explained in this blog post, the %REG1 to %REG5 variables in Visual Installer get their values from the Windows Registry. But you should be aware of that there are two Registry in Windows – a 32 bit Registry and a 64 bit Registry – and your project settings will decide which of these Registry to use.

If you start Visual Installer’s editor and open the Setup options dialog box and the 32/64 bit tab, and look in the Bitness (32 or 64 bit) frame, you will see that there are two options that decide if the installation project is a 32 bit project or a 64 bit project (see the picture below):

The Setup options dialog box

If you install 32 bit files you should select the first option (The program that will be installed is 32 bit) and if you install 64 bit files you should select the second option (The program that will be installed is 64 bit). The first option is always selected as default.

These options will also affect where the %REG1 to %REG5 variables get their values. If you have selected The program that will be installed is 32 bit, the variables will get their values from the 32 bit Registry and if you select The program that will be installed is 64 bit, the variables will get their values from 64 bit Registry.

There are two Registry editors in Windows
You should also be aware of that there exist two Registry editors in Windows. One of them handles the 32 bit Registry and one of them handles the 64 bit Registry. The filename of the Registry editor is always the same, regedt32.exe, but you can launch the different versions from different folders in Windows:

32 bit version: C:\Windows\SysWOW64
64 bit version: C:\Windows\System32

See also
> The %REG1 to %REG5 variables in Visual Installer
> The ‘Program Files (x86)’ and ‘SysWOW64’ folders explained

Which video formats does CD-Menu Creator support?

In CD-Menu Creator you can add a video clip or a movie to a menu interface. You can show the video directly in a menu window, or you can show the video in a separate window that is opened when the end-user clicks on a menu button.

Supported video formats
Using a video in a menu interface may improve the end-user´s first impression of your product, but when you select a video to a menu you should be aware of the following two things:

– Not all video formats are supported by CD-Menu Creator
– Not all CODECs are supported by default in Windows

We recommend you to choose a video that is saved in the MPEG or WMV format. Or an AVI video that you know uses a basic CODEC (coder-decoder) that all Windows support. Be aware of that many AVI videos has been created with a CODEC that not all end-user´s Windows support by default. The end-user must have same CODEC installed in the computer that was used when the video was created, otherwise the video can not be shown.

Avoid MPEG-4
Today many create videos in the MPEG-4 (MP4) format, but it is not recommended to select a MPEG-4 video to a menu created with CD-Menu Creator. Although many end-users will have a media player that can play the MPEG-4 video, the necessary CODEC is often not available for other software without a separate installation of the CODEC. So therefore, to reduce the risk for problem, we recommend you to avoid MPEG-4 files with CD-Menu Creator.

We recommend you to test the menu in an empty Window
To be sure that the video you added to a menu will be played without any problem, we recommend you to test the menu in a computer with an empty Windows (a computer where only Windows but no other software has been installed). It can be a virtual computer or physical computer.

By testing the menu and the video in a computer with an empty Windows, you will discover if the video is dependent of a CODEC that is not installed by default in Windows.

Summary – Supported video formats / filename extensions
When you select a video file to a CD-Menu Creator menu, you should select a file with one of the following filename extensions:

.MPG or .MPEG : (MPEG) Recommended format, works almost always.
.WMV : (WMV) Recommended format, works almost always.
.AVI : (AVI) Works if a proper CODEC has been chosen to the video.

If you have a video file with the .MP4 filename extension, we recommend you to convert it to one of the video formats above. There are many conversation programs that can be downloaded from the Internet that makes the conversion. Or even better, if it is possible, contact the source and try to get the same video in one of the video formats mentioned above.

Variables in Visual Installer

If you have used a programming language before you are probably very familiar with variables. If not, you can read this Wikipedia article to get a basic knowledge about variables.

Also Visual Installer can handle variables. Most variables are automatically set during the setup process and are used to handle for example drive letters, system folders, application folders, date, time, license keys, version information etc. Variables can also be used to retrieve values from the Registry in Windows.

Variables can be used in many places in Visual Installer, for example in all main tabs in the editor (e.g. File list, Registry, INI files, Components tabs etc.). Variables can also be used with the most setup dialog boxes in Visual Installer and with the scripting language.

The %DESTDIR variable
One of the most used variables in Visual Installer is the %DESTDIR variable. This variable contains the main destination folder for the setup project. The contents is read from the Main folder text box in the File list tab.

The 'Main folder' text box

In the main folder text box it is common to include the %PROGRAMFILES variable. The %PROGRAMFILES variable will be replaced with the current path to the Program Files folder in Windows during the installation. We explain more in this blog post:

> Visual Installer: How do I install files to the Program Files folder?

List with variables
You can open and view a list with all available variables in the Visual Installer editor. If you open for example the Registry tab in the editor and clicks on the Variables button, the following window is opened:

List with variables

In the Variables window you can see a list of all available variables in Visual Installer. To get a description of each variable, you can press the F1 key.

(If you double-click on a variable name in the Variables window, the variable will be inserted at the cursors position, if a text editor was active before you clicked the Variables button.)

Environment variables
Visual Installer can also handle Windows environment variables. You can read more about this in the following blog post:

> Using environment variables in Visual Installer

How to make a menu window always stay on the top

When a user opens a menu interface created with CD-Menu Creator, the menu interface will only stay on the top (above other windows) as long as the user does not click on another window or does not activate another program via Windows’ task bar.

However, there is an option in CD-Menu Creator that you can use to assure that the menu window is always on the top, also if the user clicks on another window or activates another program. This is done by selecting the Menu is always on the top option in the Window tab in CD-Menu Creator (see the red box in the picture below).

CD-Menu Creator editor - Window tab

When you use this option, you should not make the menu window too large in size, because the user can not access a program that is located below the menu window (hidden by the menu window); only a program that is located next to the menu window.

How to view source paths in the file list in Visual Installer

As default source paths for files in the file list are not shown in Visual Installer, but it is easy to turn on this setting, so source file paths will be shown in the editor. The short tip below shows how to do this:

1. Start Visual Installer.
2. Choose the Special – Editor options menu item.

Special - Editor options

3. Select the Show source file paths in the file list option in the dialog box that opens.

Editor Options

4. Press OK to close the dialog box.

Now you have enabled the show source file paths option in Visual Installer. The picture below shows how it may look like:

Visual Installer editor

The source paths are displayed in Source column in the file list.

See also
> How to add more files from a previously used folder

Visual Installer now supports SHA-2 and dual code signing

Since January 1, 2016, Windows 7 and newer Windows will no longer trust software that is signed with a SHA-1 code signing certificate, if the software is downloaded from the Internet and the software is time-stamped with a value greater than January 1, 2016. This means that if you code sign a binary file (for example an EXE file) this year and uses SHA-1 as a hash algorithm, it will not be trusted in newer Windows. Instead you must use a SHA-2 (SHA-256) code signing certificate; then the binary file will be trusted by Windows 7 and newer. You can read more about this in the following articles on Microsoft’s website:

> Windows Enforcement of Authenticode Code Signing and Timestamping
> Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate Program

Updated Visual Installer
We have updated our installation tool Visual Installer to support SHA-2 (SHA-256) when it code signs a setup package. We have also updated Visual Installer to support dual signing, so you can code sign a setup package with both SHA-1 and SHA-2. This is very useful if you have software that should be able to run also in older Windows (for example in Windows XP). By code signing a setup package twice, first with SHA-1 and then with SHA-2, your code sign certificate will be useful in both older Windows and newer Windows.

How to change hash algorithm from SHA-1 to SHA-2
In Visual Installer you can change the hash algorithm from SHA-1 to SHA-2, for an existing project, by following the steps below:

1. Start Visual Installer
2. Open your project
3. Choose the Special – Setup options menu item
4. Open the Code Signing tab in the Setup options dialog box
5. Open the Option sub tab
6. Select the Use SHA-2 option

Code Signing - Use SHA-2

7. Close the dialog box

If your minimum system requirements is Windows 7, you can use SHA-2 as a hash algorithm. But if you also want to support older Windows, follow the steps below:

How to dual sign a setup package (SHA-1 and SHA-2)
1. Start Visual Installer
2. Open your project
3. Choose the Special – Setup options menu item
4. Open the Code Signing tab in the Setup options dialog box
5. Open the Option sub tab
6. Select the Use SHA-1 and SHA-2 (recommended) option

Code Signing -Use SHA-1 and SHA-2

7. Close the dialog box

When you open your project file
If you have installed the latest version of Visual Installer 2015 (version 10.5.16 or later) and opens a project file, you may see this message box when you open your project:

Update SignTool.exe

It is recommended to answer yes, so the latest version of Microsoft’s code signing tool is used when a setup package is code signed. If you want to dual sign a setup package, you must have a quite new version of the code signing tool. You can read more in this blog post.

Available in Visual Installer 2015 version 10.5.16 and later
The functionality described above is available in Visual Installer 2015 version 10.5.16 and later; in both the Standard and Professional versions of Visual Installer. If you have an active 1 or 12 months maintenance plan for Visual Installer 2015, you can download this update for free from our download page.

See also
> What is SHA-1 and SHA-2 and what’s the difference between them?
> How to code sign a setup package (Visual Installer tip)

Where can I find the latest version of signtool.exe?

When Visual Installer signs a setup package, it runs an external signer tool. Before you could choose between signcode.exe or signtool.exe, but today it is strongly recommended to use signtool.exe because it is newer, and it is the only one that supports SHA-2.

The signtool.exe tool is installed with Visual Studio and with Windows SDK, and Visual Installer will normally find the newest installed version by itself. But if not, you can select the program file manually in Visual Installer’s editor. If you don’t know where it is located, you can search for “signtool.exe” in Windows Explorer.

Try to choose the newest version of signtool.exe that you can find on your hard drive. If you want to dual sign your setup package (with SHA-1 and SHA-2) you must use the signtool.exe tool version that is shipped with Windows 8.1 SDK or Windows 10 SDK. They are usually located in the following folders:

C:\Program Files (x86)\Windows Kits\8.1\bin\x86
C:\Program Files (x86)\Windows Kits\10\bin\x86

If you don’t have any of these folders on your hard disk, you may have not installed Windows 8.1 SDK or Windows 10 SDK. But these SDK:s can be downloaded for free from Microsoft’s website:

> Windows Software Development Kit (SDK) for Windows 8.1
> Windows Software Development Kit (SDK) for Windows 10