CryptCATAdminCalcHashFromFileHandle, and thus able to run on UNIX platforms, including big-endian ones.
It is intended for the computation of the custom SHA-1, used by Microsoft and others, to verify the authenticity of Windows executable (or regular files), using the algorithm detailed at the end of the "Windows Authenticode Portable Executable Signature Format" specifications.
The utility was heavily validated against Windows system files (32 and 64 bit), MSVC generated files, MinGW/MinGW-w64 generated files and so on, so it is expected to be fully compliant with the MS SHA-1.
If compiled on Windows, and unless you comment the
VALIDATE_HASHdefine, the program will also validate its computation against the one from
CryptCATAdminCalcHashFromFileHandle, for extra safety.
By the way, if you are interested in producing your own implementation, you may want to note that the MS specs omit the fact that the optional extra PE data, starting at
SUM_OF_BYTES_HASHED, needs to be padded to the next 8 byte boundary for hashing.
Outside of its upcoming libwdi usage, this utility may come handy for UNIX users needing to validate the authenticity of Windows files.
The source, which comes along with a (signed) 32 bit Windows executable can either be downloaded here (direct link) or here (SourceForge).
You can also directly access
cathash.c, to compile it using any of Visual Studio, WDK, MinGW, cygwin or UNIX based gcc.
IMPORTANT NOTE: As reported by Abid Bhat, some Windows XP system files, such as
C:\Windows\Driver Cache\i386\driver.cab, are not getting the expected hash when computed by the current version of cathash. I'll look into it when I get a chance, but it may take a while...