0

I have a question on hashing in C#, is their a way to detect a hashed file what is running as a process or something along those lines.

I am looking into hashing a exe or any other file format and I want to know if there is a way to detect it running within C#.

Alexei Levenkov
  • 98,904
  • 14
  • 127
  • 179
Xynous
  • 13
  • 3
  • Please clarify what you actually trying to do (avoid adding unrelated text like "thank you", "new here", "searched a lot"). – Alexei Levenkov Jun 17 '16 at 22:55
  • Do you mean hashing, which reduces all files to a (generally) much smaller fixed size hash or do you mean encrypting a file? An encrypted file can be restored to its original state, since encrypting is a reversible process. A hash cannot be restored, since hashing is a one way process. – rossum Jun 17 '16 at 22:59
  • I want to hash a file what gives it a unique digital signature and then develop a simple algorithm/logic to detect if that file is running/been used. Think of it like a anti virus what will detect signatures of malware and do the specific instruction when detected. – Xynous Jun 17 '16 at 23:04

1 Answers1

0

For hashing use System.Security.Cryptography.MD5 or System.Security.Cryptography.SHA1.

SHA1 sha1 = SHA1.Create();
FileStream fs = new FileStream("myFile", FileMode.Open, FileAccess.Read);
byte[] hash = sha1.ComputeHash(fs);
fs.Close();

If you want to analyse all running processes, you can do the following (note that if your process is 32 Bits, you won't be able to access 64 Bits processes):

foreach (Process proc in Process.GetProcesses())
{
    try
    {
        string exePath = proc.MainModule.FileName;
        // calculate hash
    }
    catch
    { }
}

If you want to get the list of all files being used, you can look at this topic, but it will be a thought one.

Community
  • 1
  • 1
doomgg
  • 337
  • 2
  • 8
  • I do not understand the section, I been looking into a way to store binary exe files for me to then hash and write some logic to detect the stored hashed files. – Xynous Jun 22 '16 at 17:38
  • Ah never mind, now I understand whats it doing. Thanks for the info :) – Xynous Jun 22 '16 at 17:50