Search code examples
cryptographyinno-setupshapascalscript

Inno Setup SHA256 function results do not match any other implementation

The built in functions provided by Inno Setup GetSHA256OfUnicodeString and GetSHA256OfString do not seem to generate the same results as any other implementation I could find.

I need to generate the SHA256 of a String that is provided during installation and check against it later from a piece of Java code.

However, the SHA256 values generated by the Inno Setup functions do not match anything I can create with other implementations or online calculators.

E.g., the Inno Setup manual provides this example:

var SHA256: String;
begin
  SHA256 := GetSHA256OfUnicodeString('Test');
  // SHA256 = 'fe520676b1a1d93dabab2319eea03674f3632eaeeb163d1e88244f5eb1de10eb'
end;

However, using for example this online calculator, the result for 'Test' is:

532eaabd9574880dbf76b9b8cc00832c20a6ec113d682299550d7a6e0f345e25

I found the implementation of the Inno Setup SHA256 functions here, however, the buck stops there for me as I cannot find the source for the THashSHA2 class used there.

Is there some length byte(s) included in the SHA256 or why is the result different? Any hint is highly appreciated.

Solution

  • Putting together what others posted in the comments:

    1. The example is wrong, as it shows a hash of test, not Test.
      I have submitted a correction.

    2. The Pascal Script UnicodeString uses UTF-16LE, not the UTF-8 (ASCII) that your online calculator uses by default.

    So this gives you the hash shown in the example:
    https://dencode.com/hash/sha256?v=test&oe=UTF-16LE&nl=crlf