libyal / libevtx

Library and tools to access the Windows XML Event Log (EVTX) format
GNU Lesser General Public License v3.0
190 stars 49 forks source link

Updated documentation with information about hash function #19

Closed markzz closed 5 years ago

joachimmetz commented 6 years ago

@markzz thanks for the additional information. I'll make some additional changes to your PR and then merge it.

joachimmetz commented 6 years ago

I'll actually need to take a closer look at this first:

per [MS-EVEN6]

The low order 16 bits of the value that is generated by performing a hash of the binary representation of Name (in which NameNumChars * 2 is the hash input length). The hash function is implemented by initially setting the value of the hash to zero. For each character in Name, multiply the previous value of the hash by 65599 and add the binary representation of the character to the hash value. The following pseudocode shows how to implement this hash function.

hash(str)
{
hashVal = 0;
for(i=0; i < strLen; i++ )
hashVal = hashVal*65599 + str[i];
return hashVal;
}

However looking at the algorithm in detail this would mean:

uint32_t name_hash( uint16_t *utf16_string, size_t utf16_string_length )
{
  uint32_t hash_value = 0;
  size_t string_index = 0;

  for( string_index = 0;
       string_index < string_size;
       string_index++ )
  {
    hash_value = ( hash_value * 65599 ) + utf16_string[ string_index ];
  }
  return hash_value;
}

I'll double check first if this matches the data in the format and then will update the documentation. Instead of directly adopting the information from [MS-EVEN6].

Thx for pointing out the pseudo function in [MS-EVEN6].

markzz commented 5 years ago

cleaning up old ignored PRs on my account... closing

joachimmetz commented 5 years ago

@markzz unfortunately I'm not getting to this due to other time commitments, I'll make a note on my large to do list, thx again for the additional information