dilettante
MIS
Does anyone here know how to calculate the SHA-1 hash that is used in a Windows SxS application or assembly manifest's <file/> element? As in:
The hash value shown above was created by the MT.exe tool installed with:
Microsoft Visual Studio 2005
Version 8.0.50727.42 (RTM.050727-4200)
Microsoft .NET Framework
Version 2.0.50727
I belabor the versions above because I hear a change was made at some point. The comment I've seen was: "Manifest tool fixed to correctly support salt enabled hashes" but without further explanation.
Basically I need to update these hash values myself, which I thought to be a trivial prospect. I coded up something quickly using the Windows Crypto stuff and got... not what I was expecting:
[tt]54607bf4ab4900a048dad1f34b7a80d0cfb94ed2[/tt]
Ok, thinking "anybody can screw up something like this" I sought independent validation. Somebody was wrong here, either my code or MT.exe - or my assumptions were off.
I fired up Microsoft's File Checksum Integrity Verifier (fciv.exe), and sure enough:
[tt]54607bf4ab4900a048dad1f34b7a80d0cfb94ed2[/tt]
Since this matches my own program's results and both contradict what MT.exe updated the manifest with I have to assume something else is afoot here.
Does MT.exe salt the data? If so, with what? Clearly this has to be a repeatable process or the hash is useless. What am I missing here?
Code:
:
<file name="Trantor.dll" hashalg="SHA1"
hash="9103bf37326e85cfe1f0acafda9f75d610a0f9c6">
:
</file>
:Microsoft Visual Studio 2005
Version 8.0.50727.42 (RTM.050727-4200)
Microsoft .NET Framework
Version 2.0.50727
I belabor the versions above because I hear a change was made at some point. The comment I've seen was: "Manifest tool fixed to correctly support salt enabled hashes" but without further explanation.
Basically I need to update these hash values myself, which I thought to be a trivial prospect. I coded up something quickly using the Windows Crypto stuff and got... not what I was expecting:
[tt]54607bf4ab4900a048dad1f34b7a80d0cfb94ed2[/tt]
Ok, thinking "anybody can screw up something like this" I sought independent validation. Somebody was wrong here, either my code or MT.exe - or my assumptions were off.
I fired up Microsoft's File Checksum Integrity Verifier (fciv.exe), and sure enough:
[tt]54607bf4ab4900a048dad1f34b7a80d0cfb94ed2[/tt]
Since this matches my own program's results and both contradict what MT.exe updated the manifest with I have to assume something else is afoot here.
Does MT.exe salt the data? If so, with what? Clearly this has to be a repeatable process or the hash is useless. What am I missing here?
