Windows 10 Creating your own file hashing "program"

Discussion in 'Programming and Scripting' started by Neemobeer, Jan 12, 2016.

  1. Neemobeer

    Neemobeer Windows Forum Team
    Staff Member

    Joined:
    Jul 4, 2015
    Messages:
    2,417
    Likes Received:
    366
    I personally need to generate file hashes quite a bit for verifying file integrity as well as analyzing malware samples. I really wanted to have code that I had complete control over so I wrote a short powershell script and some minor registry editing to set this up.

    Registry Change
    If you want the change to be computer wide then edit HKCR\*\shell or to create context menu entries you will edit HKCU\SOFTWARE\Classes\*\shell.
    • Under shell create a new key for each context menu item you wish to create. I've added Calculate MD5, Calculate SHA1, Calculate SHA256 and Calculate SHA512
    • Under each key create another key called command
    • Edit the (Default) property with powershell -WindowStyle Hidden -File <path_to_powershell_script> <algorithm> "%1" see the screenshot for examples
    • You can now verify the context menus exist, right click any file and you should see your context menus
    hash.

    Powershell
    If you don't have powershell setup to run scripts you can enable it from an elevated powershell prompt with Set-ExecutionPolicy -Scope LocalMachine

    Create a powershell script from the code below and copy the script to the location you specificed in your command registry key. I used C:\Windows\Get-Hash.ps1

    Now you should be able to test your context menus, you should get a MessageBox with the file name and hash.

    Code:
    Function Hash-File([String]$Algorithm, [String]$Path)
    {
        $file_hash = Get-FileHash -Algorithm $Algorithm -Path $Path
        $file_hash
    }
    
    Function Show-MessageBox()
    {
        [System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
        $algorithm = $myhash.Algorithm
        $file = $myhash.Path
        $hash = $myhash.Hash
        [System.Windows.Forms.MessageBox]::Show("File: $file `rHash $($algorithm): $hash","File Hash")
    }
    
    $myhash = Hash-File -Path $args[1] -Algorithm $args[0]
    $myhash.Hash | clip
    Show-MessageBox
     
    #1 Neemobeer, Jan 12, 2016
    Last edited: Jan 12, 2016
    Mike and ussnorway like this.
  2. ussnorway

    ussnorway Windows Forum Team
    Staff Member Premium Supporter

    Joined:
    May 22, 2012
    Messages:
    2,541
    Likes Received:
    318
    interresting idea... can it atuo save the reg first (just in case) or is that done by you i.e, how offen is "quite a bit"?
     
  3. Neemobeer

    Neemobeer Windows Forum Team
    Staff Member

    Joined:
    Jul 4, 2015
    Messages:
    2,417
    Likes Received:
    366
    It could auto create the registry keys, but that only needs to be done once. Sometimes I go through several dozen malware samples.
     

Share This Page

Loading...