search

mandiant / flare-ida

IDA Pro utilities from FLARE team
Apache License 2.0
2.24k stars 464 forks source link

Rename hash_Carbanak as HashPJW #52

Open strictlymike opened 7 years ago

strictlymike commented 7 years ago

As discussed, hash_Carbanak is actually the well-known PJW hash that is commonly used for hash tables (ref: Mastering Algorithms in C, ElfHash, etc.). This change renames the hash as such so it can be more easily recognized, but adds a comment to the pseudocode to retain the information that it has notably been used in Carbanak. I tested this by copying INTERESTING_DLLS from the system32 directory on a 64-bit system to a directory and creating a new sc_hashes.db which I have added to this branch. The updated sc_hashes.db is 22MB versus the previous one which was only 16MB.

During testing, I updated the documentary string srsvc.dll in the INTERESTING_DLLS string to srvsvc.dll which I believe is what was intended.

strictlymike commented 7 years ago

Please hold off - I think that by not deleting the original sc_hashes.db, I added HashPJW in addition to hash_Carbanak. I'll look into this...

strictlymike commented 7 years ago

Fixed sc_hashes.db and retested, ready for review.

strictlymike commented 7 years ago

Based on learning that INTERESTING_DLLS is inaccurate or outdated, I have reverted my changes to sc_hashes.db and will leave those updates to the maintainer.

Be advised that in a scenario where we are just renaming an algorithm, running make_sc_hash_db.py against sc_hashes.db without first deleting the .db file will result in the hash algorithm and all associated data appearing twice in sc_hashes.db - once under the original name and again under the new name. This would also make the resulting sqlite file bigger than it was before (as I noticed previously).