MD5,SHA1,CRC32,RC4,BASE64,XXTEA machine code version

[ancp]

Fantastic! CRC32 is really very fast! Many many thanks to Lazycat and Ward!

Please, would it be possible to create the function for calculate CRC8 (8-bit)?

[jennico]

brilliant ! thank you !!! *****

j.

[pDanil2006]

so...

I get md5 with help this UDF and with other software.

hashs:

AutoIT UDF 0x3c0b27e96a095d9d4494ef9e531c1e45

Olther program: 3c0b27e96a095d9d4494ef9e531c1e45

What is 0x? How remove it from hash result?

[Authenticity]

StringTrimLeft by 2 characters I believe.

Edit: It's for the Binary functions to indicate a binary string.

Edited March 8, 2009 by Authenticity

[pDanil2006]

Can you write code?

[trancexx]

$MD5 = Hex($MD5)

[rajeshontheweb]

i have found this utility very very useful, mates. i had used MD5File.exe and similar utiilties earlier and used batch scripting etc to struggle deleting viruses in my network . this was very useful

but i have one suggestion. i am using this algorithm but i got lost some time ago. i had a tough time to find u to thank you. because ur script MD5.au3 doesnt have author info :-(

can u add a couple of lines of author info so that it would be very very useful.

[Armand]

@KaFu

Mate, As my comment was mentioning ... don't let the DLLCall run on empty data and that's all!

[KaFu]

don't let the DLLCall run on empty data and that's all!

Right, now I've read it ... nevertheless I myself ran into problems trying to obfuscate the code... which can be resolved with the method I mentioned , just didn't want to let this tip go to waste.

Best Regards

[Jango]

Thanks to Lazycat's great idea. He told us how to use the CallWindowProc API to run machine code.

So I wrote some codes in Sphinx C--, and run them in AutoIt.

Hello,

Can you provide a link to get the Sphinx C-- compiler ? i can't find it doing search with google ...

[Ward]

Hello,

Can you provide a link to get the Sphinx C-- compiler ? i can't find it doing search with google ...

http://c--sphinx.narod.ru/indexe.htm

[ynbIpb]

You can add the MD5 hash to the end of the exe. When you check the hash, omit the last 16 bytes.

If you worry about it is too easy to be broken, maybe RC4 or XXTEA can be use to encrypt the hash.

Please show an example on how to implement it, given that the file can be of large size.

Thank you.

[Melba23]

ynbIpb,

First take an .exe file - it will not be changed by the script, but I would use a copy if I were you! :-)

Then run this code - you will have to amend the file paths and names to suit your system:

#include <md5.au3>

Global $iBufferSize = 0x20000
$sFilename = "M:\Program\Au3 Scripts\HashTest.exe"
$iRemaining = FileGetSize($sFilename)
Global $hFileHandle = FileOpen($sFilename, 16)
$iTotal = 0
$MD5CTX = _MD5Init()

For $i = 1 To Ceiling($iRemaining / $iBufferSize)
    If $iRemaining > $iBufferSize Then 
        _MD5Input($MD5CTX, FileRead($hFileHandle, $iBufferSize))
        $iRemaining -= $iBufferSize
        $iTotal += $iBufferSize
    Else
        _MD5Input($MD5CTX, FileRead($hFileHandle, $iRemaining))
        $iTotal += $iRemaining
    EndIf
Next
$vHash = _MD5Result($MD5CTX)

$sOrg_File_Contents = FileRead($sFilename)
FileClose($hFileHandle)

$hFileHandle = FileOpen("M:\Program\Au3 Scripts\HashAdded.exe", 18)
FileWrite($hFileHandle, $sOrg_File_Contents & StringTrimLeft($vHash , 2))
FileClose($hFileHandle)

MsgBox(0,"Hash",$vHash)

You should now have 2 .exe files, one 32 bytes bigger than the other because of the added hash.

Now run this code. Again you should amend the file paths and names to suit your system:

expandcollapse popup

#include <md5.au3>
#Include <String.au3>
#include <WinAPI.au3>

Global $iBufferSize = 0x20000

; Org file

$sFilename = "M:\Program\Au3 Scripts\HashTest.exe"
$iRemaining = FileGetSize($sFilename)
Global $hFileHandle = FileOpen($sFilename, 16)
$iTotal = 0
$MD5CTX = _MD5Init()
For $i = 1 To Ceiling($iRemaining / $iBufferSize)
    If $iRemaining > $iBufferSize Then 
        _MD5Input($MD5CTX, FileRead($hFileHandle, $iBufferSize))
        $iRemaining -= $iBufferSize
        $iTotal += $iBufferSize
    Else
        _MD5Input($MD5CTX, FileRead($hFileHandle, $iRemaining))
        $iTotal += $iRemaining
    EndIf
Next
$vHash1 = _MD5Result($MD5CTX)
FileClose($hFileHandle)
ConsoleWrite("Original file total bytes read      : " & $iTotal & @CRLF)

; File with 32 byte hash added to end

$sFilename = "M:\Program\Au3 Scripts\HashAdded.exe"
$iRemaining = FileGetSize($sFilename) - 32
Global $hFileHandle = FileOpen($sFilename, 16)
$iTotal = 0
$MD5CTX = _MD5Init()
For $i = 1 To Ceiling($iRemaining / $iBufferSize)
    If $iRemaining > $iBufferSize Then 
        _MD5Input($MD5CTX, FileRead($hFileHandle, $iBufferSize))
        $iRemaining -= $iBufferSize
        $iTotal += $iBufferSize
    Else
        _MD5Input($MD5CTX, FileRead($hFileHandle, $iRemaining))
        $iTotal += $iRemaining
    EndIf
Next
$vHash2 = _MD5Result($MD5CTX)
FileClose($hFileHandle)
ConsoleWrite("Exe less added hash total bytes read: " & $iTotal & @CRLF)

; Now read original hash added to the file
$iRemaining = FileGetSize($sFilename)
Global $hFileHandle = FileOpen($sFilename, 16)
$iTotal = 0
For $i = 1 To Ceiling($iRemaining / $iBufferSize)
    If $iRemaining > $iBufferSize Then 
        FileRead($hFileHandle, $iBufferSize)
        $iRemaining -= $iBufferSize
        $iTotal += $iBufferSize
    Else
        $sHash_Section = FileRead($hFileHandle, $iRemaining)
        $iTotal += $iRemaining
    EndIf
Next
FileClose($hFileHandle)
ConsoleWrite("Exe with added hash total bytes read: " & $iTotal & @CRLF)
$sHash_Bytes = StringRight($sHash_Section, 64)
$sHash_Chars = ""
For $i = 1 To 64 Step 2
    $sHash_Chars &= Chr(Dec(StringMid($sHash_Bytes, $i, 2)))
Next

; Or use Win_API functions
Global $nBytes
$iRemaining = FileGetSize($sFilename)
$tBuffer = DllStructCreate("byte[32]")
$hFile = _WinAPI_CreateFile($sFilename, 2, 2)
_WinAPI_SetFilePointer($hFile, $iRemaining - 32)
_WinAPI_ReadFile($hFile, DllStructGetPtr($tBuffer), 32, $nBytes)
_WinAPI_CloseHandle($hFile)
$sHash_API = BinaryToString(DllStructGetData($tBuffer, 1))

MsgBox(0, "Hashes", $vHash1 & @CRLF & $vHash2 & @CRLF & "0x" & $sHash_Chars & @CRLF & "0x" & $sHash_API)

The final MsgBox gives me 4 identical hashes - for the original file, for the new file once stripped of the added hash, and the twice the actual hash that was added to the new file. All 4 match the hash that was shown at the end of the first script.

I hope you find this useful.

M23

Edit 1: Changed second script so the whole file does not have to be read into memory to get at the added hash - as requested by ynbIpb. :-)

Edit 2: Added the Win API method as suggested by crashdemons.

Edited May 20, 2009 by Melba23

[ynbIpb]

Thank you for the example.

But now I wonder:

; Now read original hash added to the file

$sContents_Plus_Hash = FileRead($hFileHandle)

$sHash_Bytes = StringRight($sContents_Plus_Hash, 64)

This step reads the whole file in memory?

and if my file is very big?

[Melba23]

ynbIpb,

If you are concerned about the size of the file, then use a similar trick to that used in the code to hash the files. Set a $iBufferSize variable and read the file in sections until you get to the last section which includes the hash. I am sure you can code that for yourself! ;-)

M23

Edit: But if you do not want to I have amended the example above. :-)

Edited May 19, 2009 by Melba23

[ynbIpb]

thank you very much! I will try ...

[crashdemons]

ynbIpb,

If you are concerned about the size of the file, then use a similar trick to that used in the code to hash the files. Set a $iBufferSize variable and read the file in sections until you get to the last section which includes the hash. I am sure you can code that for yourself! ;-)

If you use _WinAPI_SetFilePointer you can read/write data from specific positions in a file, instead of starting at the first character.

See the _WinAPI_SetFilePointer examples in the Help File.

[Melba23]

crashdemons,

Thanks for that memory jog - completely forgot about the API call. I have added code for it to the example above.

M23

[crashdemons]

Not to be picky, but can this line be removed from _MD5Init() and _MD5Result()

$CodeBuffer = 0

$Codebuffer is only actually used, locally, in _MD5()

Depending upon Au3Check settings, both of these can generate 2 warnings:

...\MD5.au3(21,17) : WARNING: $CodeBuffer possibly not declared/created yet
    $CodeBuffer = 0
    ~~~~~~~~~~~~~~~^
...\MD5.au3(21,17) : WARNING: $CodeBuffer: declared, but not used in func.
    $CodeBuffer = 0
    ~~~~~~~~~~~~~~~^
...\MD5.au3(58,17) : WARNING: $CodeBuffer possibly not declared/created yet
    $CodeBuffer = 0
    ~~~~~~~~~~~~~~~^
...\MD5.au3(58,17) : WARNING: $CodeBuffer: declared, but not used in func.
    $CodeBuffer = 0
    ~~~~~~~~~~~~~~~^

These issues aren't really critical and you can handle them how you like, if you like - I thought I'd just point them out.

Edited May 24, 2009 by crashdemons

[nht3004]

Really nice, now I get a way to interact between Web browser and AutoIT