Why do I get a different SHA1 hash between Powershell and 32bit-Python on a system DLL?

Question

I'm trying to calculate SHA1 hash values in Python against binary files for later comparison. To make sure things are working, I used several methods to check the validity of my result. And, I'm glad I did. Powershell and Python return different values. 7zip's SHA1 function agrees with Powershell's results and Microsoft's FCIV agrees with Python's results.

Python:

import hashlib
with open("C:\\Windows\\system32\\wbem\\wmiutils.dll", "rb") as f:
     print(hashlib.sha1(f.read()).hexdigest())

Powershell:

PS C:\> Get-FileHash C:\Windows\System32\wbem\wmiutils.dll -Algorithm SHA1

Results:

Python: d25f5b57d3265843ed3a0e7b6681462e048b29a9
Powershell: B8C757BA70F6B145AD191A1B09C225FBA2BD55FB

EDIT: 32-bit Python and 64-bit Powershell against a system32 dll. That was the problem. I have some homework to do but basically, 32-bit and 64-bit applications receive a different file and thus, different hash results. I launched 64-bit python and ran the exact same code against the dll and as a 64-bit powershell process. Received consistent results when running both processes as 32-bit.

EDIT2: Found this resource that explains things a bit. At least it helped me understand what's going on: https://www.sepago.com/blog/2008/04/20/windows-x64-all-the-same-yet-very-different-part-7-file-system-and-registry

I don't remember exactly how Windows does this, but could it be that Python is 32bit process and you are getting the 32bit version of wmiutils.dll? Test it on another file which is not a dll and not in system32. — MK.
Nailed it! Launched a 32bit Powershell window and it returned: D25F5B57D3265843ED3A0E7B6681462E048B29A9 — mustbenewhere
This could also be due to a difference in how python/FCIV and 7zip/Powershell handle string to bit conversion: see Is SHA-1 Hash Always the Same — LinkBerest
Well, so now I have another question: Why do I get a different SHA1 hash between GNU/sha1sum and Python on binary files? — Casimir Crystal
Now I want to know if there is a way to determine the actual file being returned by the file system redirector. This feels like the beginning of a rabbit hole... — mustbenewhere

MK. MK. · Accepted Answer · 2015-09-30T03:15:52

This is happening because you are running a 32bit version of Python and accessing a system dll -- Windows magically redirects you to the 32bit version of the dll, while PowerShell is running as a 64bit process and sees the 64bit version of the DLLs.

I am not sure if I am glad I know this or saddened by it.

Why do I get a different SHA1 hash between Powershell and 32bit-Python on a system DLL?

1 Answers