tlsh

README

TLSH

Trend Micro Locality Sensitive Hash lib in Golang

Based on https://github.com/trendmicro/tlsh

See paper here: https://github.com/trendmicro/tlsh/blob/master/TLSH_CTC_final.pdf

TLSH is a fuzzy matching library. Given a byte stream with a minimum length of 256 bytes, TLSH generates a hash value which can be used for similarity comparisons. Similar objects will have similar hash values which allows for the detection of similar objects by comparing their hash values. Note that the byte stream should have a sufficient amount of complexity. For example, a byte stream of identical bytes will not generate a hash value.

The computed hash is 35 bytes long (output as 70 hexidecimal charactes). The first 3 bytes are used to capture the information about the file as a whole (length, ...), while the last 32 bytes are used to capture information about incremental parts of the file.

Documentation

Index

• func DiffFilenames(filenameA, filenameB string) (int, error)
• type FuzzyReader
• type TLSH
  • func HashBytes(blob []byte) (*TLSH, error)
  • func HashFilename(filename string) (*TLSH, error)
  • func HashReader(r FuzzyReader) (*TLSH, error)
  • func New() *TLSH
  • func ParseStringToTlsh(hashString string) (*TLSH, error)
  • func (t *TLSH) Binary() []byte
  • func (t *TLSH) BlockSize() int
  • func (t *TLSH) Diff(t2 *TLSH) int
  • func (t *TLSH) Reset()
  • func (t *TLSH) Size() int
  • func (t *TLSH) String() string
  • func (t *TLSH) Sum(b []byte) []byte
  • func (t *TLSH) Write(p []byte) (int, error)

Functions

func DiffFilenames

func DiffFilenames(filenameA, filenameB string) (int, error)

DiffFilenames calculate distance between two files

Types

type FuzzyReader

type FuzzyReader interface {
	io.Reader
	io.ByteReader
}

FuzzyReader interface

type TLSH

type TLSH struct {
	// contains filtered or unexported fields
}

TLSH holds hash components

func HashBytes

func HashBytes(blob []byte) (*TLSH, error)

HashBytes calculates the TLSH for the input byte slice

func HashFilename

func HashFilename(filename string) (*TLSH, error)

HashFilename calculates the TLSH for the input file

func HashReader

func HashReader(r FuzzyReader) (*TLSH, error)

HashReader calculates the TLSH for the input reader

func New

func New() *TLSH

New represents type factory for Tlsh

func ParseStringToTlsh

func ParseStringToTlsh(hashString string) (*TLSH, error)

Parsing the hash of the string type

func (*TLSH) Binary

func (t *TLSH) Binary() []byte

Binary returns the binary representation of the hash

func (*TLSH) BlockSize

func (t *TLSH) BlockSize() int

func (*TLSH) Diff

func (t *TLSH) Diff(t2 *TLSH) int

Diff current hash with other hash

func (*TLSH) Reset

func (t *TLSH) Reset()

func (*TLSH) Size

func (t *TLSH) Size() int

func (*TLSH) String

func (t *TLSH) String() string

String returns the string representation of the hash`

func (*TLSH) Sum

func (t *TLSH) Sum(b []byte) []byte

func (*TLSH) Write

func (t *TLSH) Write(p []byte) (int, error)