One file with two different SHA256 value, WHY?

Question

related File: C:\Windows\system32\browser.dll

calculating way 1 (C# code)
get the sha256 string: 40011138869f5496a3e78d38c9900b466b6f3877526ac22952dcd528173f4645

using (SHA256 sha256 = SHA256.Create())
            {
                try
                {
                    
                    string fileFullPath = @"C:\Windows\System32\browser.dll";//@"E:\xiufu\browser.dll";
                    string combineHsh = "nMJfH5P6ym9s4j9461hZDDmi48ijrN9ADoqd4HV+ra4=||QAEROIafVJaj5404yZALRmtvOHdSasIpUtzVKBc/RkU=";
                    using (FileStream fileStream = File.Open(fileFullPath, FileMode.Open, FileAccess.Read, FileShare.Read))
                    {
                        string[] hssArr = combineHsh.Split(new string[] { "||" }, 2, StringSplitOptions.None);

                            try
                            {
                                
                                // Create a fileStream for the file.
                                // Be sure it's positioned to the beginning of the stream.
                                fileStream.Position = 0;
                                // Compute the hash of the fileStream.
                                byte[] hashValue = sha256.ComputeHash(fileStream);
              
                                string sha256Base64Str = Convert.ToBase64String(hashValue);

                                if (sha256Base64Str.CompareTo(hssArr[1]) == 0)
                                {
                                    bEqual = true;
                                }
                                else
                                {
                                    bEqual = false;
                                }

                            }
                            catch (IndexOutOfRangeException e)
                            {
                                Console.WriteLine("Hash compare:" + e.Message);
                            }
                    }
                }
                catch (IOException e)
                {
                    Console.WriteLine("Open file for hash:" + e.Message);
                }
                catch (UnauthorizedAccessException e)
                {
                    Console.WriteLine("Open file for hash:" + e.Message);
                }

            }

calculating way 2 (C++ code)

get the sha256 string: 40011138869f5496a3e78d38c9900b466b6f3877526ac22952dcd528173f4645
hash-library
Crypto++

calculating way 3 (hash tab)

get the sha256 string: 9cc25f1f93faca6f6ce23f78eb58590c39a2e3c8a3acdf400e8a9de0757eadae

Who could tell me why? oddly enough. Thanks.

Answer 1

In case of 32-bit programs, the "C:\Windows\System32\browser.dll" path is interpreted as "C:\Windows\SysWOW64\browser.dll" due to File System Redirector:

• https://learn.microsoft.com/en-us/windows/win32/winprog64/file-system-redirector

The “C:\Windows\System32” folder is for 64-bit modules used by new 64-bit programs; the “C:\Windows\SysWOW64” is for 32-bit modules, used by 32-bit programs.

Your program calculated the SHA256 of “C:\Windows\SysWOW64\browser.dll”. Now it works with “C:\Windows\System32\browser.dll”.