Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rename hash_Carbanak as HashPJW #52

Open
wants to merge 6 commits into
base: master
Choose a base branch
from

Conversation

strictlymike
Copy link
Contributor

@strictlymike strictlymike commented Oct 4, 2017

As discussed, hash_Carbanak is actually the well-known PJW hash that is commonly used for hash tables (ref: Mastering Algorithms in C, ElfHash, etc.). This change renames the hash as such so it can be more easily recognized, but adds a comment to the pseudocode to retain the information that it has notably been used in Carbanak. I tested this by copying INTERESTING_DLLS from the system32 directory on a 64-bit system to a directory and creating a new sc_hashes.db which I have added to this branch. The updated sc_hashes.db is 22MB versus the previous one which was only 16MB.

During testing, I updated the documentary string srsvc.dll in the INTERESTING_DLLS string to srvsvc.dll which I believe is what was intended.

@strictlymike
Copy link
Contributor Author

Please hold off - I think that by not deleting the original sc_hashes.db, I added HashPJW in addition to hash_Carbanak. I'll look into this...

@strictlymike
Copy link
Contributor Author

Fixed sc_hashes.db and retested, ready for review.

@strictlymike
Copy link
Contributor Author

Based on learning that INTERESTING_DLLS is inaccurate or outdated, I have reverted my changes to sc_hashes.db and will leave those updates to the maintainer.

Be advised that in a scenario where we are just renaming an algorithm, running make_sc_hash_db.py against sc_hashes.db without first deleting the .db file will result in the hash algorithm and all associated data appearing twice in sc_hashes.db - once under the original name and again under the new name. This would also make the resulting sqlite file bigger than it was before (as I noticed previously).

@strictlymike strictlymike changed the title Ren carbanak pjw Rename hash_Carbanak as HashPJW Oct 5, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant