AutoHotkey Community

[SKAN]

@Laszlo

Dear Sir,

I am experimenting with your Hash().. and full of surprises

I did a test: Hash() Vs Hashes.DLL

File: MPG
Size: 76MB
System: 1.4Ghz Sempron 256 MB Ram
AHK: 1.0.46.16 ( Latest )
OS: Win2k SP4

Result: I am happy to discontinue from using Hashes.DLL

For Hashes.DLL, I timed only the DllCall()

Hashes.DLL
MD5: 2580ms
SHA1: 4100ms

For Hash(). I timed for FileRead + FileGetSize + Hash() call

Hash()
MD5: 2050ms
SHA1: 2420

However I need some clarifications:

1) Can you explain why Hashes.DLL take phenomenally more time for SHA1 ?
2) Would we gain significant performance if Hash() is built-in as a function ?



PS: Hashes_DLL.ZIP (45KB)

[Laszlo]

1) Probably bad code. The work is only 25% more for SHA-1 than for MD5, so anything slower is not justified.

2) The dllcall overhead is just a couple of ms (except loading it in the first place), so no much speedup is expected with built in code.

[SKAN]

Thanks for the clarification!.

[SKAN]

How can a compiled script hash self in order to determine its integrity?

[engunneer]

not sure how to do that skan, but it reminded me of this:
Previous IOCCC winners:
omoikane - 2004 in particular

http://www.ioccc.org/2004/omoikane.hint


I think you have to store the hash in a separate file, or unpack the UPX, and mess with it.
_________________

(Common Answers)

[SKAN]

[Laszlo]

What do you need this MD5 signature checking for?

- If it is detecting random memory-, disk- or transfer errors of the program file, you can store the signature separately (maybe appended to the file). This is not very secure, because many random errors could modify the verification code, such that the program would believe it passed the test, which has not even been performed. Because of these and other weaknesses, a CRC is almost as good.
- If you have a trusted (intact) piece of SW, you are better off with some error correction code attached to the file.
- If it is intended as protection from malicious alterations, you would need trusted SW with the signature also coming from a trusted source (or use public keys). This cannot be done by the program to be checked, because rogue software could also lie about the result of the signature verification.

Consequently, self verification is not very good with MD5.

[SKAN]

Thanks for the valuable info.

[tic]

ok ive tried this hash() method and the hash dll, but then also tried this console based program. it can calculate the md5 and many other forms of cryptography in no time

http://www.dominik-reichl.de/opensource.shtml#rehash

I use at the terminal:
rehash.exe -none -md5 filename

and it managed to output the md5 of a 700mb avi in under 10 secs and it was the same as the one found by hash()

I used:

[computerspazzz]

I am running windows and I tried it and it gives wrong MD5's and sometimes just gives all the same code no matter what. If anyone care to look at my code its below:

[SKAN]

[Laszlo]

When you read a file into a variable with no already assigned value or a small one, the capacity of the variable is set to the size of the file, so you can also use

[computerspazzz]

Thanks for the replies. Yeah i was messing around with the FileGetSize and DataLength and tried both. I also tried the FileMD5()... and the two scripts agree with one another! So i Had previously downloaded a MD5 checker to compare the results against... IT WAS WRONG! I didn't think to flip it around and download several programs as a test, another thing Ive learned. The FileMD5() is very neatly setup and easy to use as an #Include so going to stick with that, but this script also worked once i modified as you said. Thank you all very much.

On another note, I wrote a loop to hash a folder and output the data, its 100% ready to run as is, but has some options that can be configured or made into a GUI which I might do later cause I like GUI's on my stuff.