public async Task DecodeAndCompareTest() { var tlshHash1 = TlshHash.FromTlshStr("301124198C869A5A4F0F9380A9AE92F2B9278F42089EA34272885F0FB2D34E6911444C"); var tlshHash2 = TlshHash.FromTlshStr("09F05A198CC69A5A4F0F9380A9EE93F2B927CF42089EA74276DC5F0BB2D34E68114448"); var diff = tlshHash1.TotalDiff(tlshHash2, true); Assert.AreEqual(121, diff); }
public void CalculateHash(byte[] data) { TlshBuilder hashBuilder = new TlshBuilder(); hashBuilder.Update(data); hashTLSH = hashBuilder.IsValid(false) ? hashBuilder.GetHash(false) : null; using (MD5 md5Builder = MD5.Create()) { hashMD5 = md5Builder.ComputeHash(data); } }
public async Task EncodeToStringAndBackTest() { var tlsh = new TlshBuilder(BucketSize.Buckets128, ChecksumSize.Checksum1Byte); await tlsh.LoadFromStringAsync(data); var hash = tlsh.GetHash(false); var encoded = hash.GetEncoded(); var hashFromEncoding = TlshHash.FromTlshStr(encoded); var match = hash.TotalDiff(hashFromEncoding, true); Assert.AreEqual(0, match); }
public void LoadFromString(string descTLSH, string descBuffer) { if (!string.IsNullOrEmpty(descTLSH)) { hashTLSH = TlshHash.FromTlshStr(descTLSH); } if (!string.IsNullOrEmpty(descBuffer)) { hashMD5 = new byte[descBuffer.Length / 2]; for (int idx = 0; idx < descBuffer.Length; idx++) { hashMD5[idx / 2] = (byte)((GetHexVal(descBuffer[idx]) << 4) + GetHexVal(descBuffer[idx])); } } }
/// <summary> /// Calculate TLS hashes for all executables in the directory /// </summary> /// <param name="directory">Directory containing the executables</param> /// <returns>A list containing a tuple containing the file name and hash</returns> public static List <(string name, TlshHash hash)> GetExecutableTLSHashes(string directory) { List <(string, TlshHash)> result = new(); foreach (string fileName in GetExecutableNames(directory)) { TlshBuilder tlshBuilder = new(); var buffer = new byte[1024 * 4]; using (FileStream stream = File.OpenRead(fileName)) { long length = stream.Length; while (stream.Position != length) { tlshBuilder.Update(buffer, 0, stream.Read(buffer, 0, buffer.Length)); } } TlshHash hash = tlshBuilder.GetHash(true); result.Add((fileName, hash)); } return(result); }
public HashCollection(string complexHashStr, string simpleHashStr) { ComplexHash = string.IsNullOrEmpty(complexHashStr) ? null : TlshHash.FromTlshStr(complexHashStr); SimpleHash = string.IsNullOrEmpty(simpleHashStr) ? null : ScanLineHash.FromString(simpleHashStr); }
public HashCollection(TlshHash complexHash, ScanLineHash simpleHash) { ComplexHash = complexHash; SimpleHash = simpleHash; }
public static FastBitmapHash CalculateImageHash(FastBitmapHSV bitmap, Rectangle box, Rectangle contextBox, FastPixelMatch colorMatch, int hashWidth, int hashHeight, bool bNormalizeColors = false) { byte[] hashImage = new byte[hashWidth * hashHeight]; // scale to requested size float scaleX = (float)hashWidth / box.Width; float scaleY = (float)hashHeight / box.Height; float endY = 0.0f; for (int hashY = 0; hashY < hashHeight; hashY++) { float startY = endY; endY = (hashY + 1) / scaleY; if (endY >= box.Height) { endY = box.Height - 0.00001f; } float endX = 0.0f; for (int hashX = 0; hashX < hashWidth; hashX++) { float startX = endX; endX = (hashX + 1) / scaleX; if (endX >= box.Width) { endX = box.Width - 0.00001f; } float sum = 0.0f; int sumDivNum = 0; for (int srcY = (int)startY; srcY <= (int)endY; srcY++) { float partY = 1.0f; if (srcY == (int)startY) { partY -= startY - srcY; } if (srcY == (int)endY) { partY -= srcY + 1 - endY; } for (int srcX = (int)startX; srcX <= (int)endX; srcX++) { float partX = 1.0f; if (srcX == (int)startX) { partX -= startX - srcX; } if (srcX == (int)endX) { partX -= srcX + 1 - endX; } FastPixelHSV valuePx = bitmap.GetPixel(box.Left + srcX, box.Top + srcY); float srcValueNorm = colorMatch.IsMatching(valuePx) ? (bNormalizeColors ? 1.0f : (valuePx.Monochrome / 255.0f)) : 0.0f; sum += srcValueNorm * partY * partX; sumDivNum++; } } float storeValueNorm = sum / sumDivNum; hashImage[hashX + (hashY * hashWidth)] = (byte)Math.Min(15, 15 * storeValueNorm); } } TlshBuilder hashBuilder = new TlshBuilder(); hashBuilder.Update(hashImage); TlshHash complexHash = hashBuilder.IsValid(false) ? hashBuilder.GetHash(false) : null; ScanLineHash simpleHash = ScanLineHash.CreateFromImage(hashImage, hashWidth, hashHeight); HashCollection hashCollection = new HashCollection(complexHash, simpleHash); return(new FastBitmapHash { Hash = hashCollection, Height = hashHeight, Width = hashWidth, Pixels = hashImage, SourceBounds = box, ContextBounds = contextBox, DrawPos = new Point(box.Right + 1, box.Top), }); }