Download · GHOSTSHELL 0.2.0 · Windows 10 and 11, x64

133.6 MB. Not code-signed. Here is the hash.

One self-extracting NSIS installer for Windows 10 and 11, x64. This build is not code-signed, so Microsoft Defender SmartScreen will stop it with “Windows protected your PC” and list the publisher as unknown. That warning is about the file's reputation, not about what it does. So check the file itself first.

Download for Windows ghostshell-0.2.0-setup-x64.exe · 133.6 MB Check it before you run it ↓

0000  4D 5A 90 00 03 00 00 00  04 00 00 00 FF FF 00 00  MZ..............
0010  B8 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00  ........@.......
0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
0030  00 00 00 00 00 00 00 00  00 00 00 00 D8 00 00 00  ................
0040  0E 1F BA 0E 00 B4 09 CD  21 B8 01 4C CD 21 54 68  ........!..L.!Th
0050  69 73 20 70 72 6F 67 72  61 6D 20 63 61 6E 6E 6F  is program canno
0060  74 20 62 65 20 72 75 6E  20 69 6E 20 44 4F 53 20  t be run in DOS 
0070  6D 6F 64 65 2E 0D 0D 0A  24 00 00 00 00 00 00 00  mode....$.......
0080  AD 31 08 81 E9 50 66 D2  E9 50 66 D2 E9 50 66 D2  .1...Pf..Pf..Pf.
0090  2A 5F 39 D2 EB 50 66 D2  E9 50 67 D2 4C 50 66 D2  *_9..Pf..Pg.LPf.
00A0  2A 5F 3B D2 E6 50 66 D2  BD 73 56 D2 E3 50 66 D2  *_;..Pf..sV..Pf.
00B0  2E 56 60 D2 E8 50 66 D2  52 69 63 68 E9 50 66 D2  .V`..Pf.Rich.Pf.
00C0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
00D0  00 00 00 00 00 00 00 00  50 45 00 00 4C 01 05 00  ........PE..L...
00E0  86 7F 15 5C 00 00 00 00  00 00 00 00 E0 00 0F 01  ...\............
00F0  0B 01 06 00 00 68 00 00  00 38 07 00 00 40 00 00  .....h...8...@..

Fig. 0 ghostshell-0.2.0-setup-x64.exe as a hex dump, its first 256 KiB read 64 bytes at a time as SHA-256 reads the whole file, toward the hash this page publishes. Round the hash stand the release key's halves, drawn from their public keys: ML-DSA-44 (1,312 bytes) and Ed25519 (32). Both stand open: no release signature is published for 0.2.0.The first 256 bytes of ghostshell-0.2.0-setup-x64.exe, as hexdump prints them.

01 The file

ghostshell-0.2.0-setup-x64.exe

File: ghostshell-0.2.0-setup-x64.exe
Size: 133,560,801 bytes
SHA-256: 5cef5b521d278dd35418e3fda0b75ecc1cb78d2dbc46c4f711d261dc4fdf083e
SHA-256, base64: XO9bUh0njdNUGOP9oLdezBy3jS28RsT3EdJh3E/fCD4=
Platform: Windows 10 and 11, x64. No Arm64, macOS or Linux build of 0.2.0.
New in 0.2.0: SSH connections offer hybrid post-quantum key exchange by default. Read the technical paper.
Installer: NSIS, self-extracting; you choose the install folder
Code signing: None yet
License: MIT · built on Tabby 1.0.238

02 Check it

The SHA-256, three ways.

Run one of these where you saved the file and compare the result with the hash above, or drop the file on this page.

PowerShell(Get-FileHash .\ghostshell-0.2.0-setup-x64.exe -Algorithm SHA256).Hash

cmdcertutil -hashfile ghostshell-0.2.0-setup-x64.exe SHA256

Or drop the file here. It is hashed in your browser and never uploaded.

+---[0.2.0 x64]---+
|              ==*|
|            .oo@o|
|          .. oB+X|
|       . . .E.+*O|
|        S   oooo*|
|           . +.B*|
|            o.*.B|
|             =.+ |
|            ..o  |
+----[SHA256]-----+

The same SHA-256 as OpenSSH-style randomart, for comparing at a glance. Verify with the full hash. The hash proves the file matches what this site publishes, not who built it.

03 Release signature

Who signed it: the release key.

From 0.2.0, every GHOSTSHELL installer and portable zip is signed with one post-quantum hybrid key, ML-DSA-44 (FIPS 204) together with Ed25519, in OpenSSH's signature format. Both halves sign, and a signature counts only when both verify. When the version offered here has a signature, this page checks it in your browser as you drop the file above, against the key below; the file is never uploaded.

No release signature for 0.2.0. None is published for this version, so only the SHA-256 vouches for the file.

Key type: ML-DSA-44 + Ed25519 · ssh-mldsa44-ed25519@openssh.com
Fingerprint: SHA256:wcsMR20+ZSY6dRrHBgco/FFH9pOnyjqRh8A5u2s+C0M
Principal: releases@ghostshell.app
Namespace: ghostshell-release: a signature this key made for anything else never counts as a release
allowed_signers: releases@ghostshell.app namespaces="ghostshell-release" ssh-mldsa44-ed25519@openssh.com AAAAH3NzaC1tbGRzYTQ0LWVkMjU1MTlAb3BlbnNzaC5jb20AAAVAn7yVMqVbnm2AskrUcAFKsp5w7TmQ4mxzJz8muzS7h/O80yY3sxXhcWiiCMI74X/FUP8g9HDIqukxDAlZubyuXqqVkSxLzQO+wCQVwQAfE3RSnfoqJyZwkFxs5d1rbUpGblVjhwNnTeMinKNhtHAStzqYBFVk/ptiVC1JWG6DaN2cGUnAKrYgWTEE9p9CJX5ay701NEZSGs3VbOw6xwcsK6sqCrhEqCzrXGbb5VQZezn5Ncx0C37LB42w+dB7de4uAIcfBGCC3u+60eEkHeyOA7mEMOgHtOfmQLeqHGxQDT6juPQX4Xw7MsCs4gZibJHUNReCie3zgdnKO8n9NIKhPUpT9a30yd/QMMUBrTFLTm13bP/be8m2311TZSz98maESeJk1F4DXODCQ+9cSeWAQz4312HD+mrlZcUgUP8vlWAFTjPvglGkgSNkuqhxoa95wyHufU9sSJbMp4xK9zeJLBrUZzOyVMHGyZmTF6A68+WSskjM3xKBfm/iSCVfJTUqLfGmOfjzJE/m+H+UFfvFIyQHRtOtPUNVR1bja7XHcDoKPjhDo7HPSeiNl3a+tG1awI4VmZg/TSbRNQoL8zEhL677gzhXhqIJTNTOtxJvZzACilwfk5whoOzP0qaYiSlqFYV6p5uYXBKg0OwVyYLNvVRqbiV55qHb8XvhKM6WFBMGpB7Uk+NnEoBLJeS52kZQZmAdS5sWzmQIzatHjYOekboyVhEKj4XgN/JaAQXQMCbUUmlJEAwhMfClNiauJfENC6uW0eEXRS0AI7mPPwyn4DgWrLaw/FIw18CVsp2AU2zQ6wr7T3I3YXOafvBAWMYgqDxptDZX98sQrKE+JamDs3nfhVhkJqxslzY+oipkMth+9s5UyfjF8E8Ky7TD0D6hGY8I5NB/sPhdcn7HZqUyV8FWxpwJ1yC4ST0/i4oUspxmS4ikLWlpPM7twBpsO/aNj2kNJl1bqx17dMjSKlpFcr5QjCDW3ggHQI0gA1OOI+wrVNwMpbQjyF96dFAlVL5CNzyeUt2qCoYMz8+fYAEqEOPDybiHA5AT/QS4gvoS2BsAYNER9L3XlS+rum0UqE+t43rVv0KhmQoFXMPyZ15JfvPgnpxo3EvqNIItrv8ptg7CfMvU+fHGjH57Tw5LxqeFEyvm/EI5467cZoo4wmU4pEZnvDK64tqvzURUKwMFM/MQePLfmOmjDXG5/CGKoqz/di6W2QC8H1FbLnwfkppqXKrHrrDMywgo5Xo6FWQy+c6hHZHPe1M6t+x68uYtSODiGdI4168X0jkqoraZS72IhpyJS5VRGiYPxJEvuHKsD+jvjrquZcei3ebdKrIW4PHstbbsqJymVhKZDifCAMZo79uDi2yh3PU9SSO8RKJ/+iKDCifIbpDwhl8yPGhQYW4wN9lWN3vU922NGnLIf1tkqa2TPsBpiCo/v9IyGAuQlQ8LmcoHPMq0fU08ooNPOEwEK+zJKzZg2FUyaiGhD0yJRaqadqbA0RcSX7q33kRJK6rbKT8qmZoGfT1l3XJHAuuAZPsAgyg0gD9dCQOz3WunFfHm8pfYcNRe6oOG+w3kClFtJFClsexCV9j5RCXh1xxx1wC4U83dNmtWb1ZbrrEDbft0S6Qk2ioqf1lx/tjA5jtGRkcxi+PBWCVUGsCBEgGWBcuH5e/VhCMOc9K8BbA4XBxobrFinGfi5wxvzlcsjCT2VEToAd5be9QK3EkDIoVZXeOnFDVwlUby5YKN1zVc31hW/Y+M+p3A3keIT8gX6LKgibyPAFzNr3jD0jOyoNh8
ssh-keygen: OpenSSH 10.4 and 10.5 check this key type; 10.6 renamed it and will not, so this page's own checker implements the scheme, and a new release key will follow once a 10.6 build can sign
Not covered: The installer is not Authenticode-signed, and GHOSTSHELL's updater checks no signature. This page, the key it checks against and the signature all come from this site, so a check here cannot detect a compromise of the site itself

+[MLDSA44-ED25519-+
|     .  .++==    |
|      ooo *+O. . |
|      .++B @  + .|
|       =Oo+    + |
|      E S= +  .  |
|     .  . +...   |
|      o  . oo    |
|       o+ ..     |
|       o++..     |
+----[SHA256]-----+

The release key's fingerprint as ssh-keygen -lv draws it.

04 First bytes

What the first 256 bytes say.

The header of the installer, field by field, read from the file this page offers.

0x00: 4D 5A “MZ”, the DOS header every Windows executable starts with
0x3C: D8 00 00 00 e_lfanew: the PE header is at 0xD8
0x4E: “This program cannot be run in DOS mode.”
0xB8: 52 69 63 68 “Rich”, the linker's build stamp
0xD8: 50 45 00 00 “PE\0\0” · machine 0x014C (i386): NSIS installers are 32-bit stubs that install the 64-bit app
0xF0: 0B 01 PE32 optional-header magic

05 Install

Past SmartScreen, in three steps.

Check the SHA-256. Edge or Chrome may mark the download as uncommon. Keep it (in Edge: … → Keep → Show more → Keep anyway), then verify.
Run the installer. In “Windows protected your PC”, choose More info.
Check the app name and “Unknown publisher”, then choose Run anyway. With Smart App Control on (Windows 11), unsigned apps are blocked and there is no Run anyway; on a managed PC, ask your administrator.
Run the installer. If SmartScreen still shows “Windows protected your PC”, choose More info, check the app name and publisher, then choose Run anyway.

GHOSTSHELL settings, Application page: the version, built on Tabby, MIT license. — **Fig. 1** Settings → Application: the version, built on Tabby (MIT license).