Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix #23937 - fix rahash2 JSON ssdeep output ##json ##print #23938

Merged

Conversation

mattunleashed
Copy link
Contributor

  • [ x] Mark this if you consider it ready to merge
  • [ x] I've added tests (optional)
  • I wrote some lines in the book (optional)

Description

This should be a straight-forward code change to ensure > rahash2 -a ssdeep -j /path/to/bin actually prints the correct ssdeep hash as expected.

This is my first PR. I believe I followed everything correctly and expect this to be good to go, but I'm happy to learn and make updates if needed. Specifically, I:

  • Recompiled and tested the expected output locally
  • Added a test and reran the r2r test suite. Everything finished and I didn't see my test throw an error but I was unclear on how to specifically confirm that my new test actually ran.

I tracked some of my analysis to identify the fix on my personal fork here.

@trufae
Copy link
Collaborator

trufae commented Jan 31, 2025

[main] CC rahash2.c
rahash2.c: In function ‘do_hash_print’:
rahash2.c:151:23: error: pointer targets in passing argument 3 of ‘pj_ks’ differ in signedness [-Werror=pointer-sign]
  151 |    pj_ks (pj, "hash", c);
      |                       ^
      |                       |
      |                       const uint8_t * {aka const unsigned char *}
In file included from /home/runner/work/radare2/radare2/libr/include/r_cons.h:10,
                 from /home/runner/work/radare2/radare2/libr/include/r_util/r_diff.h:6,
                 from /home/runner/work/radare2/radare2/libr/include/r_util.h:58,
                 from /home/runner/work/radare2/radare2/libr/include/r_io.h:7,
                 from rahash2.c:5:
/home/runner/work/radare2/radare2/libr/include/r_util/pj.h:70:11: note: expected ‘const char *’ but argument is of type ‘const uint8_t *’ {aka ‘const unsigned char *’}
   70 | R_API PJ *pj_ks(PJ *j, const char *k, const char *v);
      |           ^~~~~
cc1: all warnings being treated as errors

@@ -147,7 +147,11 @@ static void do_hash_print(RHash *ctx, RahashOptions *ro, ut64 hash, int dlen, PJ
case 'j':
pj_o (pj);
pj_ks (pj, "name", hname);
do_hash_hexprint (c, dlen, ule, pj, rad);
if (hash & R_HASH_SSDEEP) {
pj_ks (pj, "hash", c);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i would suggest to print the hash as an array of numbers or an hexpair string (that's probably more common representation) you can use the r_hex_bin2strdup function which takes c and dlen and returns a heap allocated string that can be passed instead of c to the pjks

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in that case..for ssdeep. this is actually a binary printable buffer.. so maybe asuming that its null terminated you can just cast it to (const char *)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup - found a similar cast elsewhere so figured that was an acceptable option. I was hoping to wake up this morning and make that code change but thanks for the assist!

libr/main/rahash2.c Outdated Show resolved Hide resolved
@trufae trufae merged commit 5d1ef88 into radareorg:master Jan 31, 2025
45 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants