CODEWITHSUNDEEP
.netpowershellhashpowershell-coreauthenticode
SpyNet
SpyNet

Reputation: 679

Does anyone know how to calculate Authenticode File hash in PowerShell?

I'm looking for a way to calculate the Authenticode SHA1,SHA256 hashes of a file inside PowerShell. The file is unsigned.

Get-Filehash outputs the flat hash which is not what I'm looking for.

ConfigCI built-in module can calculate both Authenticode and Page hashes of a file but I don't want to use them since they provide a lot more details and are time consuming to run.

Module's dll is located here: "C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C99be4d25#\0d6b77335b3aaf092de7496ce37c34bc\Microsoft.ConfigCI.Commands.ni.dll"

.NET or C# code is also okay, I can use either and run them in PowerShell

Upvotes: 3

Views: 874

Answers (2)

SpyNet
SpyNet

Reputation: 679

Finally found a way to do this and implemented it in my app, here is the GUI that calculates the hashes i was looking for:

https://github.com/HotCakeX/Harden-Windows-Security/wiki/Get-Code-Integrity-Hashes

Source code available here:

https://github.com/HotCakeX/Harden-Windows-Security/tree/main/AppControl%20Manager

It uses Wintrust.dll and it calculates correct Authenticode and first page hashes of files.

Upvotes: 0

Tony
Tony

Reputation: 36

Powershell get-applockerfileinformation shows the authenticode hash

Upvotes: 2

Related Questions