As I couldn't find any ruby bindings for ssdeep, I decided to write it as my first ruby extension today ... :)

Installation (prerequisites)

You first need to compile/install the ssdeep library. On debian testing:

$ apt-get install ssdeep

On other Linuxes/Unixes:

$ wget http://sourceforge.net/projects/ssdeep/files/ssdeep-2.4/ssdeep-2.4.tar.gz/download
$ tar zxvf ssdeep-2.4.tar.gz
$ cd ssdeep-2.4/
$ ./configure --prefix=/opt
$ make
$ sudo make install

On windows:

$ There is no real shell, and I will not make screen-shots... ;)

Installation (the real one)

To install it using rubygems:

$ gem install ssdeep

To install it using rubygems with a non standard ssdeep installatoin path:

$ gem install ssdeep -- --with-ssdeep-dir=/path/to/ssdeep

Usage

The bindings follow the ssdeep APIs: (for extended information on this functions, check the ssdeep API doc.)

fuzzy_compare("3:qGOvn:qRn", "3:Wv:Wv"): Compare two fuzzy hashes.
fuzzy_hash_buf("data"): return the fuzzy hash of the data buffer.
fuzzy_hash_filename("/path/to/file"): return the fuzzy hash of the file

fuzzy_hash_file isn't implemented. Here is a little usage example :

require 'ssdeep'
# Fuzzy hash a buffer's content
hash1 = Ssdeep.fuzzy_hash_buf("This string contains the data of first file :)")
# Fuzzy hash the content of the file '/path/to/file'
hash2 = Ssdeep.fuzzy_hash_filename("/path/to/file")
# Compare the 2 hashes, a value between 0 (no match) and 100 (full match) is returned
Ssdeep.fuzzy_compare(hash1, hash2)

Et voilà :)

Other articles

Linux kernel 2.6.31 perf_counter_open exploit

Thu 24 September 2009
By xipe

In Exploits.

Well, it has been a while since my last technical post ... More than 1 year ?!? Wow, time runs so fast :)

So let's go for a post about Linux kernel exploitation (yeah, I know, sounds cool). We will exploit a quite recent bug in kernel 2.6.31 (still unpatched ...
read more
There are comments.
Welcome to Denmark !

Sat 29 August 2009
By xipe

In My Life.

For the ones who were wondering, this blog is not dead, I just had some changes in my life ...

After traveling a month in China, I moved to Copenhagen ... And I am still unpacking all my stuff and wondering how I will be able to put everything in our new ...
read more
There are comments.
Intel(r) switches backdoor

Mon 19 May 2008
By xipe

In Cool Stuff.

I recently got an Intel(r) Express 530T switch from eBay. It's a "Manageable" switch, this means that you can connect to the switch through a null modem cable, telnet or a web interface to modify the switch configuration (Change MAC address filtering, create/delete VLANs, change ports speeds ...
read more
There are comments.
Nagios status report in Ion3 statusbar
Thu 08 May 2008
By xipe

In Hacks.

Here is a little script that permits to report one or more nagios servers status in the ion3 status bar:

statusd_nginfo.lua (Download nginfo.lua)
```
--
-- statusd_nginfo.lua
--
-- Made by Raffaello Pelagalli
--
-- Started on  Sun Mar  9 00:22:31 2008 Raffaello Pelagalli
-- Last update Thu May  8 23:29:32 ...
```
read more
There are comments.

Page 1 / 2 »