title: Verify Currently Running Executable
body: <p>I'm looking for the right approach to verify a currently running executable from within that executable.
  I've already found a way to compute a (SHA256) hash for the file that is currently running.</p>
  
  <p>The problem is: Where do I safely store this hash? If I store it in a config file, a malicious user can just calculate his own hash and replace it. If I store it in the executable itself, it can be overridden with a hex editor probably.</p>
  
  <p>A suggestion I read was to do an asymmetrical en- (or was it de-) cryption, but how would I go about this?</p>
  
  <p>A requirement is that the executable code hashes and en/decrypts exactly the same on different computers, otherwise I can't verify correctly. The computers will all be running the same OS which is Windows XP (Embedded).</p>
  
  <p>I'm already signing all of my assemblies, but I need some added security to successfully pass our Security Target.</p>
  
  <p>For those who know, it concerns <strong>FPT_TST.1.3</strong>: The TSF shall provide authorised users with the capability to verify the integrity of stored TSF executable code.</p>