Most visitors online was 17251 , on 24 May 2024
[c++ ][Help] File HashCheck
- Thread starter skywind
- Start date
Checking it in file or memory?
If in memory you will probably need to walk the PE header to find the main mapped code section (usually starting at 401000h).
Also there could be possibly fix ups in the code that you would have to compensate for too.
Again if in memory you could also map in the file on disk and do a direct byte compare from memory vrs the image.
CRC32 is probably the way to go as it's generally faster for checking occasionally in memory.
But then it's more common and thus easier for reverser to locate, bake a fixed code, etc.
MD5 has a lot more bits so there is much less chance of a collusion, but then CRC32 should work fine.
Look on sites like CodeProject, GameDeception, etc., for some sample code to do MD5 and CRC32 hashes.
If in memory you will probably need to walk the PE header to find the main mapped code section (usually starting at 401000h).
Also there could be possibly fix ups in the code that you would have to compensate for too.
Again if in memory you could also map in the file on disk and do a direct byte compare from memory vrs the image.
CRC32 is probably the way to go as it's generally faster for checking occasionally in memory.
But then it's more common and thus easier for reverser to locate, bake a fixed code, etc.
MD5 has a lot more bits so there is much less chance of a collusion, but then CRC32 should work fine.
Look on sites like CodeProject, GameDeception, etc., for some sample code to do MD5 and CRC32 hashes.
RaGEZONE Sponsor
