Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Add initial MileRAT hashing algo #48

Closed
wants to merge 2 commits into from

Conversation

Still34
Copy link
Contributor

@Still34 Still34 commented Nov 17, 2023

No description provided.

Signed-off-by: Still Hsu <dev@stillu.cc>
Signed-off-by: Still Hsu <dev@stillu.cc>
@Still34
Copy link
Contributor Author

Still34 commented Nov 17, 2023

Not entirely sure what's causing the failure here - help appreciated

@herrcore
Copy link
Member

Not entirely sure what's causing the failure here - help appreciated

This algorithm already exists

TEST_1 = 150583839

You can hunt for hashes using the hunt endpoint https://hashdb.openanalysis.net/#tag/hunt if the hashes used by this algo do not show up please log a bug.

For future reference there is a test that will automatically check for hash algorithm collisions that you can run locally (step 6)

https://github.com/OALabs/hashdb#how-to-add-new-hashes

@herrcore herrcore closed this Nov 17, 2023
@Still34
Copy link
Contributor Author

Still34 commented Nov 17, 2023

Huh, yeah, the main reason why I created this PR in the first place is that it did not show up on the hunted results. Strange.

@Still34
Copy link
Contributor Author

Still34 commented Nov 17, 2023

For reference, GetProcAddress == 0x1AB9B854 in the actual code.

@Still34
Copy link
Contributor Author

Still34 commented Nov 17, 2023

Yeah, I could not get any hits with existing algos - might be caused by the extra & 0x7FFFFFFF?
image
image

Edit: Some of the hashes would hit the aforementioned MUL 0x83, but some won't.

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants