public async Task DecodeAndCompareTest()
{
var tlshHash1 = TlshHash.FromTlshStr("301124198C869A5A4F0F9380A9AE92F2B9278F42089EA34272885F0FB2D34E6911444C");
var tlshHash2 = TlshHash.FromTlshStr("09F05A198CC69A5A4F0F9380A9EE93F2B927CF42089EA74276DC5F0BB2D34E68114448");
var diff = tlshHash1.TotalDiff(tlshHash2, true);
Assert.AreEqual(121, diff);
}
public void CalculateHash(byte[] data)
{
TlshBuilder hashBuilder = new TlshBuilder();
hashBuilder.Update(data);
hashTLSH = hashBuilder.IsValid(false) ? hashBuilder.GetHash(false) : null;
using (MD5 md5Builder = MD5.Create())
{
hashMD5 = md5Builder.ComputeHash(data);
}
}
public async Task EncodeToStringAndBackTest()
{
var tlsh = new TlshBuilder(BucketSize.Buckets128, ChecksumSize.Checksum1Byte);
await tlsh.LoadFromStringAsync(data);
var hash = tlsh.GetHash(false);
var encoded = hash.GetEncoded();
var hashFromEncoding = TlshHash.FromTlshStr(encoded);
var match = hash.TotalDiff(hashFromEncoding, true);
Assert.AreEqual(0, match);
}
public void LoadFromString(string descTLSH, string descBuffer)
{
if (!string.IsNullOrEmpty(descTLSH))
{
hashTLSH = TlshHash.FromTlshStr(descTLSH);
}
if (!string.IsNullOrEmpty(descBuffer))
{
hashMD5 = new byte[descBuffer.Length / 2];
for (int idx = 0; idx < descBuffer.Length; idx++)
{
hashMD5[idx / 2] = (byte)((GetHexVal(descBuffer[idx]) << 4) + GetHexVal(descBuffer[idx]));
}
}
}
/// <summary>
/// Calculate TLS hashes for all executables in the directory
/// </summary>
/// <param name="directory">Directory containing the executables</param>
/// <returns>A list containing a tuple containing the file name and hash</returns>
public static List <(string name, TlshHash hash)> GetExecutableTLSHashes(string directory)
{
List <(string, TlshHash)> result = new();
foreach (string fileName in GetExecutableNames(directory))
{
TlshBuilder tlshBuilder = new();
var buffer = new byte[1024 * 4];
using (FileStream stream = File.OpenRead(fileName))
{
long length = stream.Length;
while (stream.Position != length)
{
tlshBuilder.Update(buffer, 0, stream.Read(buffer, 0, buffer.Length));
}
}
TlshHash hash = tlshBuilder.GetHash(true);
result.Add((fileName, hash));
}
return(result);
}
public HashCollection(string complexHashStr, string simpleHashStr)
{
ComplexHash = string.IsNullOrEmpty(complexHashStr) ? null : TlshHash.FromTlshStr(complexHashStr);
SimpleHash = string.IsNullOrEmpty(simpleHashStr) ? null : ScanLineHash.FromString(simpleHashStr);
}
public HashCollection(TlshHash complexHash, ScanLineHash simpleHash)
{
ComplexHash = complexHash;
SimpleHash = simpleHash;
}
public static FastBitmapHash CalculateImageHash(FastBitmapHSV bitmap, Rectangle box, Rectangle contextBox, FastPixelMatch colorMatch, int hashWidth, int hashHeight, bool bNormalizeColors = false)
{
byte[] hashImage = new byte[hashWidth * hashHeight];
// scale to requested size
float scaleX = (float)hashWidth / box.Width;
float scaleY = (float)hashHeight / box.Height;
float endY = 0.0f;
for (int hashY = 0; hashY < hashHeight; hashY++)
{
float startY = endY;
endY = (hashY + 1) / scaleY;
if (endY >= box.Height)
{
endY = box.Height - 0.00001f;
}
float endX = 0.0f;
for (int hashX = 0; hashX < hashWidth; hashX++)
{
float startX = endX;
endX = (hashX + 1) / scaleX;
if (endX >= box.Width)
{
endX = box.Width - 0.00001f;
}
float sum = 0.0f;
int sumDivNum = 0;
for (int srcY = (int)startY; srcY <= (int)endY; srcY++)
{
float partY = 1.0f;
if (srcY == (int)startY)
{
partY -= startY - srcY;
}
if (srcY == (int)endY)
{
partY -= srcY + 1 - endY;
}
for (int srcX = (int)startX; srcX <= (int)endX; srcX++)
{
float partX = 1.0f;
if (srcX == (int)startX)
{
partX -= startX - srcX;
}
if (srcX == (int)endX)
{
partX -= srcX + 1 - endX;
}
FastPixelHSV valuePx = bitmap.GetPixel(box.Left + srcX, box.Top + srcY);
float srcValueNorm = colorMatch.IsMatching(valuePx) ? (bNormalizeColors ? 1.0f : (valuePx.Monochrome / 255.0f)) : 0.0f;
sum += srcValueNorm * partY * partX;
sumDivNum++;
}
}
float storeValueNorm = sum / sumDivNum;
hashImage[hashX + (hashY * hashWidth)] = (byte)Math.Min(15, 15 * storeValueNorm);
}
}
TlshBuilder hashBuilder = new TlshBuilder();
hashBuilder.Update(hashImage);
TlshHash complexHash = hashBuilder.IsValid(false) ? hashBuilder.GetHash(false) : null;
ScanLineHash simpleHash = ScanLineHash.CreateFromImage(hashImage, hashWidth, hashHeight);
HashCollection hashCollection = new HashCollection(complexHash, simpleHash);
return(new FastBitmapHash
{
Hash = hashCollection,
Height = hashHeight,
Width = hashWidth,
Pixels = hashImage,
SourceBounds = box,
ContextBounds = contextBox,
DrawPos = new Point(box.Right + 1, box.Top),
});
}
