Windows 10 Creating your own file hashing "program"

[Neemobeer]

I personally need to generate file hashes quite a bit for verifying file integrity as well as analyzing malware samples. I really wanted to have code that I had complete control over so I wrote a short powershell script and some minor registry editing to set this up.

Registry Change
If you want the change to be computer wide then edit HKCR\*\shell or to create context menu entries you will edit HKCU\SOFTWARE\Classes\*\shell.

• Under shell create a new key for each context menu item you wish to create. I've added Calculate MD5, Calculate SHA1, Calculate SHA256 and Calculate SHA512
• Under each key create another key called command
• Edit the (Default) property with powershell -WindowStyle Hidden -File <path_to_powershell_script> <algorithm> "%1" see the screenshot for examples
• You can now verify the context menus exist, right click any file and you should see your context menus

Powershell
If you don't have powershell setup to run scripts you can enable it from an elevated powershell prompt with Set-ExecutionPolicy -Scope LocalMachine

Create a powershell script from the code below and copy the script to the location you specificed in your command registry key. I used C:\Windows\Get-Hash.ps1

Now you should be able to test your context menus, you should get a MessageBox with the file name and hash.

Function Hash-File([String]$Algorithm, [String]$Path)
{
    $file_hash = Get-FileHash -Algorithm $Algorithm -Path $Path
    $file_hash
}

Function Show-MessageBox()
{
    [System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
    $algorithm = $myhash.Algorithm
    $file = $myhash.Path
    $hash = $myhash.Hash
    [System.Windows.Forms.MessageBox]::Show("File: $file `rHash $($algorithm): $hash","File Hash")
}

$myhash = Hash-File -Path $args[1] -Algorithm $args[0]
$myhash.Hash | clip
Show-MessageBox

 

[ussnorway]

interresting idea... can it atuo save the reg first (just in case) or is that done by you i.e, how offen is "quite a bit"?

 

[Neemobeer]

It could auto create the registry keys, but that only needs to be done once. Sometimes I go through several dozen malware samples.