Skip to content

Missing popular hashing/checksum algorithms in rz-hash #5846

@notxvilka

Description

@notxvilka

Priority 1

  • SHA-3 family (Add sha3 support #5886)
    • SHA3-224
    • SHA3-256
    • SHA3-384
    • SHA3-512
  • MurmurHash3 - Extremely common in malware for API hashing and string obfuscation. Critical for shellcode analysis
  • FNV-1a - Very frequently used in malware for import hashing and string lookups. Essential for malware RE.
  • djb2 - Daniel Bernstein's hash - extremely prevalent in malware for API/string hashing due to simplicity
  • ROR13 - The classic Windows shellcode API hashing algorithm. Fundamental for shellcode RE

Priority 2

  • RIPEMD-160 - Used in Bitcoin addresses, PGP, and various cryptocurrency implementations
  • xxHash64 - xxhash32 is already implemented in Rizin
  • CityHash - Google's fast hash, found in many production systems
  • Jenkins - (lookup3, one-at-a-time) - Used in networking code and various applications

Priority 3

  • imphash - PE import hash - standard malware classification metric (Mandiant)
  • TLSH - Trend Micro Locality Sensitive Hash - malware similarity detection
  • Streebog (GOST 34.11) - Russian standard hash

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions