What hash type is used by DISM / SFC?

Question

What hash type is represented below?

Example 1: 0h+p0j3/Y9s1ly0mqtU741bzLjqz12mDQGKtVScMeKg=

Example 2: uNryI5MYSV5U5O1NuFPGYexSxm2nLFrRXVqga+nQjw4=

These hashes came from the CBS.log file after running Window's DISM utility. Here's the full line:

2017-03-11 20:46:08, Info                  CSI    00000005 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-c...appxmain.resources_31bf3856ad364e35_10.0.14393.206_sr-..-cs_8caf1c5c152c5f9f\resources.sr-Latn-CS.pri do not match actual file [l:24]'resources.sr-Latn-CS.pri' :
  Found: {l:32 0h+p0j3/Y9s1ly0mqtU741bzLjqz12mDQGKtVScMeKg=} Expected: {l:32 uNryI5MYSV5U5O1NuFPGYexSxm2nLFrRXVqga+nQjw4=}

It resembles Base64 but that can't be it, because the hash is always the same length with different size files. I also thought maybe it's not the hash itself, but the Base64 of something like MD5 or SHA, but Base64-decoding this string also doesn't help.

Thank you.

Answer 1

Windows uses SHA256 for hashing files in WinSxS:

<dsig:DigestMethod xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" />

Here is the content for the FlashUtil_ActiveX.dll:

<file name="FlashUtil_ActiveX.dll" destinationPath="$(runtime.system32)\Macromed\Flash\" sourceName="FlashUtil_ActiveX.dll" sourcePath=".\" importPath="$(build.nttree)\adobe\flash\">
    <securityDescriptor name="WRP_FILE_DEFAULT_SDDL" />
    <asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2">
      <dsig:Transforms xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
        <dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" />
      </dsig:Transforms>
      <dsig:DigestMethod xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" />
      <dsig:DigestValue xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">22R1ba1WE7oyGXwA0vGwywUOw/Hw/27MqRmwHJpL04g=</dsig:DigestValue>
    </asmv2:hash>
  </file>

Under dsig:DigestValue you see the expected hash. If Windows scans the files it creates the hash for the actual file and compares it to this hash in the manifest files in WinSxS.