Merge pull request #31 from danielmoder/main

Added Conti hashing algorithm with seed 0xB801FCDA
2026-06-08 12:05:11 +00:00 · 2022-09-18 19:39:01 -04:00
parent 2b34605a2e 2690629bf0
commit 3bf73802ca
1 changed files with 97 additions and 0 deletions
@@ -0,0 +1,97 @@
+#!/usr/bin/env python
+
+DESCRIPTION = "Conti ransomware api hash with seed 0xB801FCDA"
+TYPE = 'unsigned_int'
+TEST_1 = 384343055
+
+
+def hash(data):
+    API_buffer = []
+
+    i = len(data) >> 3
+
+    count = 0
+    while i != 0:
+        for index in range(0, 8):
+            API_buffer.append(data[index + count])
+        count += 8
+        i -= 1
+
+    if len(data) & 7 != 0:
+        v8 = len(data) & 7
+
+        while v8 != 0:
+            API_buffer.append(data[count])
+            count += 1
+            v8 -= 1
+
+    hash_val = 0
+
+    for i in range(0, len(API_buffer)):
+        API_buffer[i] = ord(chr(API_buffer[i]))
+
+    v15 = 0xB801FCDA
+    string_length_2 = len(data)
+    API_buffer_count = 0
+    if len(data) >= 4:
+        count = string_length_2 >> 2
+        string_length_2 = (string_length_2 - 4 *
+                           (string_length_2 >> 2)) & 0xFFFFFFFF
+
+        while True:
+            temp_buffer_val = API_buffer[API_buffer_count +
+                                         3] << 24 | API_buffer[API_buffer_count +
+                                                               2] << 16 | API_buffer[API_buffer_count +
+                                                                                     1] << 8 | API_buffer[API_buffer_count]
+
+            temp = (0x5BD1E995 * temp_buffer_val) & 0xFFFFFFFF
+            API_buffer_count += 4
+            v15 = ((0x5BD1E995 * (temp ^
+                                  (temp >> 0x18))) & 0xFFFFFFFF) ^ ((0x5BD1E995 * v15) & 0xFFFFFFFF)
+            count -= 1
+            if count == 0:
+                break
+
+    v18 = string_length_2 - 1
+
+    v19 = v18 - 1
+
+    if v18 == 0:
+        hash_val ^= API_buffer[API_buffer_count]
+    elif v19 == 0:
+        hash_val ^= API_buffer[API_buffer_count + 1] << 8
+        hash_val ^= API_buffer[API_buffer_count]
+    elif v19 == 1:
+        hash_val ^= API_buffer[API_buffer_count + 2] << 16
+        hash_val ^= API_buffer[API_buffer_count + 1] << 8
+        hash_val ^= API_buffer[API_buffer_count]
+
+    v20 = (0x5BD1E995 * hash_val) & 0xFFFFFFFF
+    edi = (0x5BD1E995 * len(data)) & 0xFFFFFFFF
+
+    eax = v20 >> 0x18
+    eax ^= v20
+
+    ecx = (0x5BD1E995 * eax) & 0xFFFFFFFF
+    eax = (0x5BD1E995 * v15) & 0xFFFFFFFF
+
+    ecx ^= eax
+
+    eax = edi
+    eax >>= 0x18
+    eax ^= edi
+
+    edx = (0x5BD1E995 * ecx) & 0xFFFFFFFF
+    eax = (0x5BD1E995 * eax) & 0xFFFFFFFF
+    edx ^= eax
+    eax = edx
+
+    eax >>= 0xD
+    eax ^= edx
+
+    ecx = (0x5BD1E995 * eax) & 0xFFFFFFFF
+    eax = ecx
+    eax >>= 0xF
+    eax ^= ecx
+
+    return eax