Hi ,
Please use below script to monitor MD5 checksum value changes for any file.
Edit parameters
- originalmd5=‘1DE85AAB28B9DF08B3F604CD6F2B0B4D’ - Provide your monitoring file’s orginal checksum MD5
- File = “C:\Users\Jasmine\Downloads\rcsetup153.exe” ## Provide the file path to be monitored for checksum changes
For more information, please refer ITarian Forum - ITarian Forum
This sample script generate alert if any changes happens to monitor file
originalmd5='1DE85AAB28B9DF08B3F604CD6F2B0B4D'
File = "C:\\Users\\Jasmine\\Downloads\\rcsetup153.exe" ## you can change your path here...
import hashlib
import sys
def alert(arg):
sys.stderr.write("%d%d%d" % (arg,arg,arg))
# Please use "alert(1)" to turn on the monitor(trigger an alert)
# Please use "alert(0)" to turn off the monitor(disable an alert)
# Please do not change above block and write your script below
def findmd5(File):
BLOCKSIZE = 65536
hasher = hashlib.md5()
with open(File, 'rb') as afile:
buf = afile.read(BLOCKSIZE)
while len(buf) > 0:
hasher.update(buf)
buf = afile.read(BLOCKSIZE)
return(hasher.hexdigest())
if findmd5(File)!=originalmd5.lower():
alert(1)
print 'MD5 Checksum value of file " {} " has been changed'.format(File)
else:
alert(0)
print 'MD5 Checksum value of file " {} " is same as orignal checksum'.format(File)
Sample output:
