Rahash2
The rahash2 tool can be used to compute checksums of files, disk devices or strings. By block or entirely using many different hash algorithms.
This tool is also capable of doing some encoding/decoding operations like base64 and xor encryption.
This is an example usage:
Note that rahash2 also permits to read from stdin in a stream, so you don't need 4GB of ram to compute the hash of a 4GB file.
Hashing by blocks
When doing forensics, it is useful to compute partial checksums. The reason for that is because you may want to split a huge file into small portions that are easier to identify by contents or regions in the disk.
This will spot the same hash for blocks containing the same contents. For example, if is filled with zeros.
It can also be used to find which blocks have changed between more than one sample dump.
This can be useful when analyzing ram dumps from a virtual machine for example. Use this command for this:
Hashing with rabin2
The rabin2 tool parses the binary headers of the files, but it also have the ability to use the rhash plugins to compute checksum of sections in the binary.
Obtaining hashes within radare2 session
To calculate a checksum of current block when running radare2, use the ph command. Pass an algorithm name to it as a parameter. An example session:
You can use all hashing algorithms supported by rahash2:
The ph command accepts an optional numeric argument to specify length of byte range to be hashed, instead of default block size. For example:
最后更新于
这有帮助吗？