[SOLVED] how to calculate hash of system protected file,for example dll files?

[rickyzhang2008]

In cbs.log,many file description like :

2023-06-06 16:48:54, Info CSI 0000128b [SR] Could not reproject corrupted file [ml:48{24},l:46{23}]"\??\C:\windows\SysWOW64"\[l:22{11}]"browcli.dll"; source file in store is also corrupted
2023-06-06 16:48:54, Info CSI 0000128c Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_6.1.7601.18332_none_f7067e745cc31dd7\RMActivate_ssp_isv.exe do not match actual file [l:44{22}]"RMActivate_ssp_isv.exe" :
Found: {l:32 b:ZseX65gUhiIBl4AdyBtlmePux/aU15SYaLRV7Wijghg=} Expected: {l:32 b:j9dDHrp+HyynJ4wzY5B0kJY5ZyxKww0/7SIL8a7Nfi4=}
2023-06-06 16:48:54, Info CSI 0000128d [SR] Cannot repair member file [l:44{22}]"RMActivate_ssp_isv.exe" of Microsoft-Windows-Security-Processor-Native-ServerBox-ISV, Version = 6.1.7601.18332, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

I need to calculate the hash, looking at the bold text above , but I don't know which algorithm, MD2,M4,MD5,SHA1 etc? or how to calculate the the bold code above.
please help me, thanks.

 

[x BlueRobot]

You can use HashTab and the hash is SHA256 Base64.

 

[rickyzhang2008]

You can use HashTab and the hash is SHA256 Base64.

Thanks so much, solve my big problem, thanks again.

 

[x BlueRobot]

No problem

 

[rickyzhang2008]

No problem

Thanks for reply again,and another question occur:
SHA-256 BASE64 is first SHA-256, then BASE64 the result of SHA-256?
I just did like that, but the result is not same as what Hash Tab shows in file property.I don't know what the problem is?

 

[x BlueRobot]

Have you enabled the SHA256 Base 64 option in HashTab? It is the Base64 encoding of the SHA256 hash.

 

[x BlueRobot]

The hash of the file should match the expected hash shown in the CBS log. The found hash indicates the hash of the file in that WinSxS subdirectory.

 

[rickyzhang2008]

The hash of the file should match the expected hash shown in the CBS log. The found hash indicates the hash of the file in that WinSxS subdirectory.

Thanks,I have solved the problem.
The key is that when using BASE64 the result of SHA256, I should select "hex", not "string".

 

[x BlueRobot]

Good to hear!