You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
The current Tlsh code is the TLSH-C, which was ported by Avast dev. This version is missing 2 functions
Load the hash value from a string (Add fromTlshStr to the tlsh.h avast/tlshc#2)
Therefore, Tlsh version that Yara is using can do hash matching only. IMO tlsh is a fuzzyhash algorithm so it should has score diffing
Is your feature request related to a problem? Please describe.
The current Tlsh code is the TLSH-C, which was ported by Avast dev. This version is missing 2 functions
diff
score of 2 Tlsh hashes (Add total_diff to tlsh.c and tlsh.h avast/tlshc#1)Therefore, Tlsh version that Yara is using can do hash matching only. IMO tlsh is a fuzzyhash algorithm so it should has score diffing
Describe the solution you'd like
In https://github.com/VirusTotal/yara/blob/master/libyara/tlshc/tlsh.c, Yara can add
And then add a function in ELF module to compare hash (maybe create an other function to compare with diff_len)
The text was updated successfully, but these errors were encountered: