第一部分：
C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\NT5.CAT t部分內容

B B D 0 2 2 2 1 A A 6 5 5 6 2 8 F 4 9 5 F 6 C D 3 0 3 9 0 8 B B E 0 0 F 9 5 9 5 ?

第二部分：
D:\>calchash.exe pidgen.dll
BB D0 22 21 AA 65 56 28 F4 95 F6 CD 30 39 08 BB E0 0F 95 95

第三部分：
D:\>chckhash.exe pidgen.dll
C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\NT5.CAT contains pidgen.dll
C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\SP3.CAT contains pidgen.dll

第四部分：main函數主要調用了一個CryptCATAdminCalcHashFromFileHandle函數

D:\srv03rtm\ds\security\cryptoapi\pkitrust\tools\calchash\calchash.cpp

?

extern "C" int __cdecl wmain(int argc, WCHAR **wargv)
{
int???????????????? cMember;
cWArgv_???????????? *pArgs;
BOOL??????????????? fFailed;
CRYPTCATCDF???????? *pCDF;
CRYPTCATMEMBER????? *pMember;
LPWSTR????????????? pwszMemberTag;
CRYPTCATATTRIBUTE?? *pAttr;
BOOL??????????????? fContinueOnError;
BYTE??????????????? pbHash[40];
DWORD?????????????? cbHash = sizeof(pbHash);
HANDLE?????????????? hFile;
LPSTR?????????????? psz;

??? pCDF = NULL;

??? if (!(pArgs = new cWArgv_((HINSTANCE)GetModuleHandle(NULL), &fFailed)))
{
goto MemoryError;
}

??? if (fFailed)
{
goto MemoryError;
}

??? pArgs->AddUsageText(IDS_USAGETEXT_USAGE, IDS_USAGETEXT_OPTIONS,
IDS_USAGETEXT_OPTPARAM, IDS_USAGETEXT_FILENAME, IDS_USAGETEXT_OPTPARAM);

??? pArgs->Add2List(IDS_PARAM_HELP,???????? IDS_PARAMTEXT_HELP,?????? WARGV_VALUETYPE_BOOL, (void *)FALSE);

??? pArgs->Fill(argc, wargv);

??? if (!(pArgs->Fill(argc, wargv)) ||
(pArgs->GetValue(IDS_PARAM_HELP)))
{
wprintf(L"%s", gszUsage);
goto NeededHelp;
}

??? if (!(pwszFile = pArgs->GetFileName()))
{
wprintf(L"%s",gszUsage);
goto ParamError;
}

??? pPrint = new PrintfU_;

??? SetLastError(0);

??? if ((hFile = CreateFileU(pwszFile,
GENERIC_READ,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL)) == INVALID_HANDLE_VALUE)
{

??????? wprintf(L"Cannot open file - GLE = %lx\n", GetLastError());
goto CATCloseError;
}

??? if (!CryptCATAdminCalcHashFromFileHandle(hFile,
&cbHash,
pbHash,
0))
{
goto CATCloseError;
}