glaslos / ssdeep

SSDEEP hash lib in Golang
Other
101 stars 35 forks source link

Unclear error 'Apples != Grapes' for HashDistance() for file length of 1344 bytes and file length in range from 193 to 384 bytes #4

Closed oneumyvakin closed 7 years ago

oneumyvakin commented 7 years ago

STEPS

  1. Create file length of 1344 bytes
  2. Create file length of from 193 to 384 bytes.
  3. Try to calculate HashDistance() of this files:
    package main
    import (
    "github.com/glaslos/ssdeep"
    "fmt"
    )
    func main() {
    deepMaingo := ssdeep.NewSSDEEP()
    deepMaingoStr := deepMaingo .Fuzzy("1344text.txt")
    fmt.Printf("'%s'\n", deepMaingoStr)
    deep192 := ssdeep.NewSSDEEP()
    deep192Str := deep192.Fuzzy("193.txt")
    fmt.Printf("'%s'\n", deep192Str )
    distance, err := ssdeep.HashDistance(deepMaingoStr, deep192Str )
    fmt.Printf("Distance: '%d' Error: '%s'\n", distance, err)
    }

ACTUAL RESULT

block size: 24, file size: 1344, n/bs: 56
'24:tT0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T0T04:tT0T0T0T0T0T0T0T0T0T0T0T0T0T0T0Y,"1344text.txt"'
block size: 6, file size: 193, n/bs: 32
'6:OWGukOWGukOWGukOWGukOWGukOWGukOWGukOWGukOWGukOWGukOWGukOWGukOWGP:MMMMMMMMMMMMULrOvwOvwOO,"193.txt"'
Distance: '0' Error: 'Apples != Grapes'
glaslos commented 7 years ago

See https://github.com/kolos450/SsdeepNET/blob/master/Source/SsdeepNET/Comparer.cs#L39-L43 You can only compare hashes with the same block size.