Hash macro

Index > Macroinstructions > Hash macro

Author

Thread

Sem

Joined: 05 Mar 2005
Posts: 8

Sem 15 Dec 2005, 03:34

Hello, a little question: I want to calculate hash of string with macro, but my experience is poor. Could you help me?

The algo is:

Code:

          xor  eax,eax

.CalcHash:
          ror  eax,7
          xor  edx,eax
          lodsb
          test al,al
          jnz _CalcHash

where ESI - address of string, EDX - hash result.

My wrong (non-working) and stupid variant is:

Code:

macro hash [args] 
 { common local ..result, ..size, ..char 

   virtual at 0 
      db args 
      ..size = $ 
   end virtual

   ..result = 0 

   repeat ..size 

      virtual at 0 
        db args 
        load ..char byte from $ - ..size + % - 1 
      end virtual 
      
      ..char   = ..char shl 25
      ..result = ..result xor ..char 
     
   end repeat 

   dd ..result
 }

15 Dec 2005, 03:34

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20519
Location: In your JS exploiting you and your system

revolution 15 Dec 2005, 07:40

Code:

macro hash [args]  
 { common local ..result, ..char  
 virtual at 0  
   db args  
   ..result = 0  
   repeat $  
      load ..char byte from % - 1  
      ..char   = ..char shl 25 or ..char shr 7
      ..result = ..result xor ..char  
   end repeat  
 end virtual
 dd ..result and 0xffffffff
}

15 Dec 2005, 07:40

Sem

Joined: 05 Mar 2005
Posts: 8

Sem 15 Dec 2005, 09:52

Wow, thanks! But it macro generate BYTE hash, but I want to get DWORD hash value.

I use it:

Code:

 hash "ExitProcess",0

15 Dec 2005, 09:52

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20519
Location: In your JS exploiting you and your system

revolution 15 Dec 2005, 12:47

Quote:

But it macro generate BYTE hash, but I want to get DWORD hash value.

The macro follows the code you posted for "algo". What exactly do you require?

Did you want this:

Code:

db ..result and 0xff

as the last line instead?

15 Dec 2005, 12:47

Sem

Joined: 05 Mar 2005
Posts: 8

Sem 16 Dec 2005, 03:14

OK, exactly:

Code:

          mov   esi, .sStr

          xor   eax, eax

.CalcHash: 
          ror   eax, 7
          xor   edx, eax

          lodsb
          test  al, al

          jnz   .CalcHash

          mov   [.hash], edx
          ret

        .sStr    db "ExitProcess",0

        .hash   dd ?

        hash   "ExitProcess",0

After,

Code:

mov   [.hash], edx

I want [.hash] == hash "ExitProcess",0

Is it possible?

16 Dec 2005, 03:14

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20519
Location: In your JS exploiting you and your system

revolution 16 Dec 2005, 11:25

Code:

macro hash destination,[args]   
 { common local ..result, ..char   
 virtual at 0   
   db args   
   ..result = 0   
   repeat $   
      load ..char byte from % - 1   
      ..char   = ..char shl 25 or ..char shr 7 
      ..result = ..result xor ..char   
   end repeat   
 end virtual 
 store dword ..result and 0xffffffff at destination
}
hash   .hash,"ExitProcess",0

16 Dec 2005, 11:25

Sem

Joined: 05 Mar 2005
Posts: 8

Sem 19 Dec 2005, 03:53

Case 1:

Code:

.hash1        dd 0
hash .hash1, "ExitProcess",0

Result: .hash1 == 0D6000000h

Case 2:

Code:

          mov   esi, .Str

          xor   eax, eax
          cdq

.CalcHash: 
          ror   eax, 7
          xor   edx, eax

          lodsb
          test  al, al

          jnz   .CalcHash
          mov   [.hash], edx
          ret

        .Str    db "ExitProcess",0
        .hash2   dd ?

Result: .hash2 == 0xD66358EC

But, I want that in the first case result must be equal to the result in the second case (.hash1 == .hash2 == 0xD66358EC).

Last edited by Sem on 20 Dec 2005, 04:06; edited 1 time in total

19 Dec 2005, 03:53

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20519
Location: In your JS exploiting you and your system

revolution 19 Dec 2005, 10:12

Code:

macro hash destination,[args]
 { common local ..result, ..char, ..temp
 virtual at 0
   db args
   ..result = 0x7C90EB94
   ..temp = 0
   repeat $
      load ..char byte from % - 1
      if ..char = 0
         break
      end if
      ..temp   = (..temp and 0xffffff00) or ..char
      ..temp   = ..temp shl 25 or ..temp shr 7
      ..result = ..result xor ..temp
   end repeat
 end virtual
 store dword ..result and 0xffffffff at destination
}
hash   .hash,"ExitProcess",0

Okay there was bug in the macro but to get the result you give (0xAAF3B378) your starting value of edx must be 0x7C90EB94. With a starting value of 0x00000000 the hash is 0xD66358EC.

Is this your actual code?

Code:

         mov   edx,0x7C90EB94
         mov   esi, .Str 
          xor   eax, eax 

.CalcHash:  
          ror   eax, 7 
          xor   edx, eax 

          lodsb 
          test  al, al 

          jnz   .CalcHash 
          mov   [.hash], edx 
          ret 

        .Str    db "ExitProcess",0 
        .hash2   dd ?

19 Dec 2005, 10:12

Sem

Joined: 05 Mar 2005
Posts: 8

Sem 20 Dec 2005, 04:05

Great thanks, exactly so!

Of course, I forgot to write "xor edx,edx" in my small code, after previous computation, thanks.

20 Dec 2005, 04:05

shism2

Joined: 14 Sep 2005
Posts: 248

shism2 21 Dec 2005, 21:50

So to use this macro you have to use the given value??

0x7C90EB94

Or can someone give me a better example of how this works?

21 Dec 2005, 21:50

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20519
Location: In your JS exploiting you and your system

revolution 22 Dec 2005, 01:51

Quote:

So to use this macro you have to use the given value??

The values in the macro and the code must be the same, but the actual value can be anything you choose

Code:

  ..result = 0x7C90EB94 ;<-- must match below
  mov   edx,0x7C90EB94 ;<-- must match above

22 Dec 2005, 01:51

shism2

Joined: 14 Sep 2005
Posts: 248

shism2 22 Dec 2005, 01:55

i c ok

22 Dec 2005, 01:55

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum