tlsh

README

TLSH

Trend Micro Locality Sensitive Hash lib in Golang

Based on https://github.com/trendmicro/tlsh

See paper here: https://github.com/trendmicro/tlsh/blob/master/TLSH_CTC_final.pdf

TLSH is a fuzzy matching library. Given a byte stream with a minimum length of 256 bytes, TLSH generates a hash value which can be used for similarity comparisons. Similar objects will have similar hash values which allows for the detection of similar objects by comparing their hash values. Note that the byte stream should have a sufficient amount of complexity. For example, a byte stream of identical bytes will not generate a hash value.

The computed hash is 35 bytes long (output as 70 hexidecimal charactes). The first 3 bytes are used to capture the information about the file as a whole (length, ...), while the last 32 bytes are used to capture information about incremental parts of the file.

Documentation

Index

• func DiffFilenames(filenameA, filenameB string) (int, error)
• type FuzzyReader
• type Tlsh
  • func HashBytes(blob []byte) (tlsh *Tlsh, err error)
  • func HashFilename(filename string) (tlsh *Tlsh, err error)
  • func HashReader(r FuzzyReader) (tlsh *Tlsh, err error)
  • func New(checksum, lValue, q1Ratio, q2Ratio, qRatio byte, code [codeSize]byte) *Tlsh
  • func (t *Tlsh) Binary() []byte
  • func (t *Tlsh) Diff(t2 *Tlsh) int
  • func (t *Tlsh) String() string

Functions

func DiffFilenames

func DiffFilenames(filenameA, filenameB string) (int, error)

DiffFilenames calculate distance between two files

Types

type FuzzyReader

type FuzzyReader interface {
	Read([]byte) (int, error)
	ReadByte() (byte, error)
}

FuzzyReader interface

type Tlsh

type Tlsh struct {
	// contains filtered or unexported fields
}

Tlsh holds hash components

func HashBytes

func HashBytes(blob []byte) (tlsh *Tlsh, err error)

HashBytes calculates the TLSH for the input byte slice

func HashFilename

func HashFilename(filename string) (tlsh *Tlsh, err error)

HashFilename calculates the TLSH for the input file

func HashReader

func HashReader(r FuzzyReader) (tlsh *Tlsh, err error)

HashReader calculates the TLSH for the input reader

func New

func New(checksum, lValue, q1Ratio, q2Ratio, qRatio byte, code [codeSize]byte) *Tlsh

New represents type factory for Tlsh

func (*Tlsh) Binary

func (t *Tlsh) Binary() []byte

Binary returns the binary representation of the hash

func (*Tlsh) Diff

func (t *Tlsh) Diff(t2 *Tlsh) int

Diff current hash with other hash

func (*Tlsh) String

func (t *Tlsh) String() string

String returns the string representation of the hash`