Recent changes to feature-requests

Add indexing for known hashes

Jesse Kornblum — Tue, 01 Oct 2013 14:35:43 -0000

See the branch 'index'. Modify the code for more efficient n-gram generation.

Generate sdhashes

Jesse Kornblum — Thu, 02 Feb 2012 13:10:45 -0000

Add support for generating and matching sdhash hashes, http://roussev.net/sdhash/. The goal is a drop-in replacement for the fuzzy.c API, http://ssdeep.sourceforge.net/api/html/fuzzy_8h.html. All four functions should be supported.

Add modes to cluster all similar files

Jesse Kornblum — Mon, 30 Jan 2012 15:23:03 -0000

The program should be able to generate clusters of all similar files. Clusters can be exclusive (each input belongs to only one cluster) or non-exclusive (each input can belong to multiple clusters). These would work like the -d or -p modes.

Multiple thread support

Anonymous — Thu, 22 Sep 2011 15:19:57 -0000

Since the piecewise hashing is computationally expensive, and many computers today have multiple cores, it would be nice if ssdeep supported multiple threads.

Version 3.0 Features

Anonymous — Wed, 15 Jun 2011 04:30:43 -0000

Add support for DC3 style hashes (currently in /branches/dc3), both reading and generating
Add support for sdhash, http://roussev.net/sdhash/, both reading and generating.
Combined file format to include DC3 hashes and sdhashes.

File size threshold

Jesse Kornblum — Wed, 02 Feb 2011 19:01:59 -0000

Implement a file size threshold, like those found in md5deep using the -i and -I flags.

Compare unknown signatures to known ones

Jesse Kornblum — Wed, 24 Feb 2010 22:42:32 -0000

Develop a method to compare unknown signatures (without computation) to known signatures. Unlike -x mode, this should*not* compare the known signatures to each other. Given a set of known signature k1, k2, k3, ... kn, and a set of unknown signatures u1, u2, u3... um, you would like the program to compare:

u1 vs k1
u1 vs k2
u1 vs k3
...
u1 vs kn

u2 vs k1
u2 vs k2
u2 vs k3
...
u2 vs kn

...

um vs k1
um vs k2
um vs k3
...
um vs kn

Suggested syntax:

The -k flag could be used to specify files of known hashes. The FILES parameters could be used to specify the files of unknown hashes. For example:

$ ssdeep -k known1.txt -k known2.txt -k known3.txt unknown1.txt unknown2.txt

Which should produce results like this:

unknown1.txt:harmless.exe matches known1.txt:EVILEVIL.EXE

Display all match scores

Jesse Kornblum — Mon, 19 Oct 2009 13:40:57 -0000

Is it possible to modify the program to use a threshold of zero to display *all* match scores? Here's a patch to make it happen:

- --- ssdeep-2.2/match.c 2009-10-13 16:31:14.000000000 -0700
+++ ssdeep-2.2-local/match.c 2009-10-13 18:11:58.000000000 -0700
@@ -92,7 +92,7 @@
}

score = fuzzy_compare(sum,tmp->hash);
- - if (score > s->threshold)
+ if (score >= s->threshold)
{
if (s->mode & mode_csv)
{

Compare two sig files

Jesse Kornblum — Fri, 17 Apr 2009 16:55:00 -0000

Add an option to compare two files of signatures without having to read the actual files from the disk. For example:

$ ssdeep -x sigfile1 sigfile2

sigfile1:/home/jessek/foo.dat matches sigfile2:/usr/bin/bar.dat (98)

Add matching mode

Jesse Kornblum — Tue, 30 Dec 2008 14:41:23 -0000

Add functionality to the API to load in a set of known hashes and then match against that set. It would operate like the -m mode in the ssdeep client.