Skip to content
This repository was archived by the owner on Jan 1, 2026. It is now read-only.

Conversation

@strictlymike
Copy link
Contributor

@strictlymike strictlymike commented Oct 4, 2017

As discussed, hash_Carbanak is actually the well-known PJW hash that is commonly used for hash tables (ref: Mastering Algorithms in C, ElfHash, etc.). This change renames the hash as such so it can be more easily recognized, but adds a comment to the pseudocode to retain the information that it has notably been used in Carbanak. I tested this by copying INTERESTING_DLLS from the system32 directory on a 64-bit system to a directory and creating a new sc_hashes.db which I have added to this branch. The updated sc_hashes.db is 22MB versus the previous one which was only 16MB.

During testing, I updated the documentary string srsvc.dll in the INTERESTING_DLLS string to srvsvc.dll which I believe is what was intended.

@strictlymike
Copy link
Contributor Author

Please hold off - I think that by not deleting the original sc_hashes.db, I added HashPJW in addition to hash_Carbanak. I'll look into this...

@strictlymike
Copy link
Contributor Author

Fixed sc_hashes.db and retested, ready for review.

@strictlymike
Copy link
Contributor Author

Based on learning that INTERESTING_DLLS is inaccurate or outdated, I have reverted my changes to sc_hashes.db and will leave those updates to the maintainer.

Be advised that in a scenario where we are just renaming an algorithm, running make_sc_hash_db.py against sc_hashes.db without first deleting the .db file will result in the hash algorithm and all associated data appearing twice in sc_hashes.db - once under the original name and again under the new name. This would also make the resulting sqlite file bigger than it was before (as I noticed previously).

@strictlymike strictlymike changed the title Ren carbanak pjw Rename hash_Carbanak as HashPJW Oct 5, 2017
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant