[SOLVED] how to calculate hash of system protected file,for example dll files?

R

rickyzhang2008

Member
Joined
Apr 16, 2018
Posts
10
In cbs.log,many file description like :

2023-06-06 16:48:54, Info CSI 0000128b [SR] Could not reproject corrupted file [ml:48{24},l:46{23}]"\??\C:\windows\SysWOW64"\[l:22{11}]"browcli.dll"; source file in store is also corrupted
2023-06-06 16:48:54, Info CSI 0000128c Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_6.1.7601.18332_none_f7067e745cc31dd7\RMActivate_ssp_isv.exe do not match actual file [l:44{22}]"RMActivate_ssp_isv.exe" :
Found: {l:32 b:ZseX65gUhiIBl4AdyBtlmePux/aU15SYaLRV7Wijghg=} Expected: {l:32 b:j9dDHrp+HyynJ4wzY5B0kJY5ZyxKww0/7SIL8a7Nfi4=}
2023-06-06 16:48:54, Info CSI 0000128d [SR] Cannot repair member file [l:44{22}]"RMActivate_ssp_isv.exe" of Microsoft-Windows-Security-Processor-Native-ServerBox-ISV, Version = 6.1.7601.18332, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

I need to calculate the hash, looking at the bold text above , but I don't know which algorithm, MD2,M4,MD5,SHA1 etc? or how to calculate the the bold code above.
please help me, thanks.
 
Have you enabled the SHA256 Base 64 option in HashTab? It is the Base64 encoding of the SHA256 hash.
 
The hash of the file should match the expected hash shown in the CBS log. The found hash indicates the hash of the file in that WinSxS subdirectory.
 
x BlueRobot said:
The hash of the file should match the expected hash shown in the CBS log. The found hash indicates the hash of the file in that WinSxS subdirectory.
Click to expand...
Thanks,I have solved the problem.
The key is that when using BASE64 the result of SHA256, I should select "hex", not "string".
 
Back
Top