ctph

Documentation

Index

• Constants
• func Compare(s1, s2 string) (int, error)
• type FuzzyHash
  • func NewFuzzyHash(InputLen int) *FuzzyHash
  • func (fh *FuzzyHash) PrintSSDeep() string
  • func (fh *FuzzyHash) Step(d byte)
• type RollingHash
  • func NewRollingHash() *RollingHash
• type Sum32
  • func NewFNV() *Sum32
  • func (s *Sum32) BlockSize() int
  • func (s *Sum32) Reset()
  • func (s *Sum32) Size() int
  • func (s *Sum32) Sum(in []byte) []byte
  • func (s *Sum32) Sum32() uint32
  • func (s *Sum32) Write(data []byte) (int, error)

Constants

const (
	B64_CHARS      string = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
	SS_LEN         uint32 = 64
	SS_SIG_PATTERN string = "^\\d+:[0-9a-zA-Z+\\/]+:[0-9a-zA-Z+\\/]+$"
	WINDOW_SIZE    uint32 = 7
)

Functions

func Compare

func Compare(s1, s2 string) (int, error)

* Compares 2 CTPH Signatures (s1 and s2) of the form: * 24:O7XC9FZ2LBfaW3h+XdcDljuQJtNMMqF5DjQuwM0OHC:O7S9FZ2LwWEdcM6tNMjDEuwwHC * <blocksize>:<sigpart1>:<sigpart2> * * The 2006 paper recommends using levenshtein distance to compare * * This function will return the distance as a positive integer

Types

type FuzzyHash

type FuzzyHash struct {
	Bs         uint32      `json:"block_size"`
	Hash1      Sum32       `json:"-"`
	Hash2      Sum32       `json:"-"`
	Index      int         `json:"index"`
	InputLen   int         `json:"input_length"`
	IsTrigger1 bool        `json:"is_trigger1"`
	IsTrigger2 bool        `json:"is_trigger2"`
	Retry      bool        `json:"-"`
	Rh         RollingHash `json:"rolling_hash"`
	Sig1       string      `json:"sig1"`
	Sig2       string      `json:"sig2"`
}

* State of the fuzzy hash that can be manipulated by the * APIs attached to it

func NewFuzzyHash

func NewFuzzyHash(InputLen int) *FuzzyHash

func (*FuzzyHash) PrintSSDeep

func (fh *FuzzyHash) PrintSSDeep() string

func (*FuzzyHash) Step

func (fh *FuzzyHash) Step(d byte)

type RollingHash

type RollingHash struct {
	X      uint32   `json:"x"`
	Y      uint32   `json:"y"`
	Z      uint32   `json:"z"`
	C      uint32   `json:"c"`
	Size   uint32   `json:"size"`
	Window []uint32 `json:"window"`
}

func NewRollingHash

func NewRollingHash() *RollingHash

type Sum32

type Sum32 uint32

func NewFNV

func NewFNV() *Sum32

Generate a new FNV32 with the custom SSDEEP offset.

func (*Sum32) BlockSize

func (s *Sum32) BlockSize() int

func (*Sum32) Reset

func (s *Sum32) Reset()

Reset the hash to the custom SSDEEP offset.

func (*Sum32) Size

func (s *Sum32) Size() int

func (*Sum32) Sum

func (s *Sum32) Sum(in []byte) []byte

func (*Sum32) Sum32

func (s *Sum32) Sum32() uint32

func (*Sum32) Write

func (s *Sum32) Write(data []byte) (int, error)

//////////////////////////////////////////////////////////////////////////// Everything from this point on is identical to stdlib FNV32 implementations. ////////////////////////////////////////////////////////////////////////////