Most visitors online was 12720 , on 2 May 2024
-
Unfortunately, we have experienced significant hard drive damage that requires urgent maintenance and rebuilding. The forum will be a state of read only until we install our new drives and rebuild all the configurations needed. Please follow our Facebook page for updates, we will be back up shortly! (The forum could go offline at any given time due to the nature of the failed drives whilst awaiting the upgrades.) When you see an Incapsula error, you know we are in the process of migration.
[c++ ][Help] File HashCheck
- Thread starter skywind
- Start date
Checking it in file or memory?
If in memory you will probably need to walk the PE header to find the main mapped code section (usually starting at 401000h).
Also there could be possibly fix ups in the code that you would have to compensate for too.
Again if in memory you could also map in the file on disk and do a direct byte compare from memory vrs the image.
CRC32 is probably the way to go as it's generally faster for checking occasionally in memory.
But then it's more common and thus easier for reverser to locate, bake a fixed code, etc.
MD5 has a lot more bits so there is much less chance of a collusion, but then CRC32 should work fine.
Look on sites like CodeProject, GameDeception, etc., for some sample code to do MD5 and CRC32 hashes.
If in memory you will probably need to walk the PE header to find the main mapped code section (usually starting at 401000h).
Also there could be possibly fix ups in the code that you would have to compensate for too.
Again if in memory you could also map in the file on disk and do a direct byte compare from memory vrs the image.
CRC32 is probably the way to go as it's generally faster for checking occasionally in memory.
But then it's more common and thus easier for reverser to locate, bake a fixed code, etc.
MD5 has a lot more bits so there is much less chance of a collusion, but then CRC32 should work fine.
Look on sites like CodeProject, GameDeception, etc., for some sample code to do MD5 and CRC32 hashes.
RaGEZONE Sponsor
