CodeGuru Home VC++ / MFC / C++ .NET / C# Visual Basic VB Forums Developer.com
Results 1 to 4 of 4

Threaded View

  1. #1

    Calculate DLL 4Byte Hash Checksum

    Code:
    // CalcDLLHash.cpp : Defines the entry point for the console application.
    //
    
    #include "stdafx.h"
    #include <stdio.h>
    #include <string.h>
    #include <iostream.h>
    #include <mbstring.h>
    char * CalcHash(unsigned char * MyString)
    {
    	unsigned int h;
    	unsigned char *c=MyString;
    	while(*c) 
    	{
    		h=((h<<5)|(h>>27))+*c++;
    	}
    	printf("Done");
    	return 0;
    }
    
    int main(int argc, char* argv[])
    {
    	//unsigned char* MyStr = new unsigned char [16];
    	//*_mbscpy(MyStr, unsigned char *("LoadLibraryA")); 
    	unsigned char* MyStr = (unsigned char *)"LoadLibraryA";
    	//MyStr = MyStringA;
    	CalcHash(MyStr);
    	printf("Hello World!\n");
    	return 0;
    }
    LoadLibraryA was supposed to come back
    ;LoadLibraryA
    ;db 0x8e
    ;db 0x4e
    ;db 0x0e
    ;db 0xec
    but im getting h = 0xFFE7AAA8 =(

    Anyone know why?

    Edit: I also tryed writing this in MASM
    Code:
    include \masm32\include\masm32rt.inc
    includelib \masm32\lib\masm32rt.lib
    
    .486
    .model flat, stdcall
    option casemap :none
    .const
    LL db "LoadLibraryA", 0
    .code
    start:
    
    xor edi, edi
    xor eax, eax
    cld ;Clear Direction Flags For LoadStringByte
    
    mov esi, OFFSET LL
    
    push esi
    
    compute_hash_again:
    lodsb
    test al, al
    jz compute_hash_finished
    ror edi, 0dh
    add edi, eax
    jmp compute_hash_again
    compute_hash_finished:
    
    pop esi
    
    print hex$([esi])
    
    ;ret
    
    ;DEFINE CONSTANTS
       
    ;locate_kernel32_hashes:
    ;    call locate_kernel32_hashes_return
    
        ;LoadLibraryA
        ;db 0x8e
        ;db 0x4e
        ;db 0x0e
        ;db 0xec
    I created this code to see if I can calculate DLL hashes the same way PE headers do and My results came wrong, The "Correct" Results for LoadLibraryA were supposed be

    ;db 0x8e
    ;db 0x4e
    ;db 0x0e
    ;db 0xec

    I get
    0x64616F4C

    No go =(
    Last edited by AgentSmithers; June 29th, 2009 at 03:29 PM.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  





Click Here to Expand Forum to Full Width

Featured