search

kolos450 / SsdeepNET

MIT License
5 stars 2 forks source link

Produce different results than SSDeep #1

Open Genbox opened 9 years ago

Genbox commented 9 years ago

I did a ssdeep on a 888 kb file and got different results from the original ssdeep and your port. Example:

I'm using "Ionic.Zip.xml" from DotNetZip. This particular release: http://dotnetzip.codeplex.com/downloads/get/258012

port: 12288:S5Vx3KDBJ8cL918V8urkf0EbNoULo4RhyNTlD41jFlCs4dCxp:7xfvqsBlCs42B original: 12288:S5Vx3KDBJ8cL918V8urkf0EbNoULo4RhyNTlD41jFlCs4dCxp:7xfvqsBlCs42p

As you can see, it is only the last character that is different. However, if I set the DoNotTruncate flag, I get the correct hash:

12288:S5Vx3KDBJ8cL918V8urkf0EbNoULo4RhyNTlD41jFlCs4dCxp:7xfvqsBlCs42p

jdell64 commented 8 years ago

I have been using the Python sddeep, and I notice different results.