Proj 7: Hashes and Signatures (15 pts.)

What You Need

A computer with Windows 7 or 8

Downloading and Installing FileAlyzer

Open a Web browser and go to

forums.spybot.info/downloads.php

Scroll down to "Analysis Tools". Click the "FileAlyzer" link. On the next page, in the Download column, click the latest version--it was "filealyz-2.0.5.57.exe" when I did it, as shown below on this page. Notice the MD5 and SHA-1 hash values on the right side of this page--you will use those later.

In the "Opening filealyz-2.0.5.57.exe" box, click "Save file". Save the file on your desktop. On your desktop, double-click filealyz-2.0.5.57.exe. Click through all the warning boxes and install the software with the default options.

Verifying the MD5 and SHA-1 Hashes

On your desktop, right-click filealyz-2.0.5.57.exe. In the context menu, click "Analyze file with FileAlyzer 2". If an "Open File -- Security Warning" box pops up, click Run.

FileAlyzer opens, showing the properties of the file, as shown below. Notice that this page shows the MD5 and SHA-1 hashes of the file, which match the values posted on the Web page.

Click through the other tabs and investigate the file--this is a very powerful tool. Notice all the different hashes on the Hashes tab. You can even see the machine language code inside this file with the Disassembler tab.

Close the FileAlyzer window.

Making a Copy of the File

On your desktop, point to the filealyz-2.0.5.57.exe icon. Press down the right mouse button and hold it down. Move the mouse an inch to the right and release the button. In the context menu, click "Copy Here".

A new file appears named "filealyz-2.0.5.57- Copy.exe". You now have two icons, each showing a computer, monitor, and CD, as shown below.

Right-click "filealyz-2.0.5.57- Copy.exe ". In the context menu, click "Analyze file with FileAlyzer 2". In the "Open File -- Security Warning" box, click Run.

Examine the MD5 hash value. It should still be the same, as shown below. Changing the file name does not alter the hash value.

Capturing a Screen Image

Make sure the MD5 hash visible, starting with D670 as shown above.

Press the PrntScrn key to capture the whole desktop. Open Paint and paste in the image.

Save the image as "Proj 7a from YOUR NAME".

YOU MUST SEND IN A WHOLE-DESKTOP IMAGE FOR FULL CREDIT

Downloading and Installing HxD

Open a Web browser and go to http://mh-nexus.de/en/hxd/

Scroll down and click the "Download page" link, as shown below.

On the next page, find an English version, as shown below. Click any of the links on the right side to download the program.

Download and install HxD. Accept all the default installation options.

Modifying the File

If HxD is not already open, click Start. In the Search box, type HxD and then press the Enter key.

In the HxD window, click File, Open. Navigate to your desktop and open the "filealyz-2.0.5.57- Copy.exe" file. HxD displays the file in hexadecimal form on the left side, and in ASCII text on the right side, as shown below.

On the right side of the HxD window, find the text saying "This program must be run under Win32". Click just to the left of the numeral 3 and type 64 right on top of the 32 -- don't touch the backspace or delete keys.

The black 32 changes to a red 64 as shown below on this page, but nothing else should change.

In the HxD window, click File, Save. Close HxD.

Examine the icons on your desktop. Both the original file and the copy should still show decorative icons, with showing a computer, monitor, and CD, like the top two icons in the picture below.

If the icon of your copied file has changed to a square generic icon, like the bottom file in the image below, you have changed the length of the file and the project won't work because the "Digital Signatures" tab will vanish. You will need to make a fresh copy of the original file and use HxD to edit it carefully without changing its length.

Examining the Modified File's MD5 Hash

On your desktop, right-click "filealyz-2.0.5.57 - Copy.exe". In the context menu, click "Analyze file with FileAlyzer 2". In the "Open File -- Security Warning" box, click Run.

Examine the MD5 hash value. It is completely different, as shown below. That's the whole point of hashing--any change in the file can be detected by examining the hash.

Capturing a Screen Image

Make sure the hash is visible, with a different value, no longer starting with D670, as shown above.

Press the PrntScrn key to capture the whole desktop. Open Paint and paste in the image.

Save the image as "Proj 7b from YOUR NAME".

YOU MUST SEND IN A WHOLE-DESKTOP IMAGE FOR FULL CREDIT

Examining a Digital Signature

The process you just went through was a lot of work--looking up the MD5 hash, calculating it, and comparing it to the original. With digital signatures, that's all done for you automatically.

On your desktop, right-click "filealyz-2.0.5.57 - Copy.exe". In the context menu, click "Properties".

In the "filealyz-2.0.5.57 - Copy.exe Properties" box, click the "Digital Signatures" tab.

In the "Signature list" section, click "Safer Networking". Click the Details button.

This box says "This digital signature is not valid". That's because the file has been modified.

Capturing a Screen Image

Make sure the "This digital signature is not valid" message is visible, as shown above.

Press the PrntScrn key to capture the whole desktop. Open Paint and paste in the image.

Save the image as "Proj 7c from YOUR NAME".

YOU MUST SEND IN A WHOLE-DESKTOP IMAGE FOR FULL CREDIT

Turning in Your Project

Send the images to cnit.120@gmail.com with a subject of "Proj 7 from YOUR NAME".


Last revised: 3-1-165