Aquileo | Recent changes to feature-requests

Aquileo | Add indexing for known hashes

2013-10-01T14:35:43.415000Z

See the branch 'index'. Modify the code for more efficient n-gram generation.

Aquileo | Generate sdhashes

2012-02-02T13:10:45Z

Add support for generating and matching sdhash hashes, http://roussev.net/sdhash/. The goal is a drop-in replacement for the fuzzy.c API, http://ssdeep.sourceforge.net/api/html/fuzzy_8h.html. All four functions should be supported.

Aquileo | Add modes to cluster all similar files

2012-01-30T15:23:03Z

The program should be able to generate clusters of all similar files. Clusters can be exclusive (each input belongs to only one cluster) or non-exclusive (each input can belong to multiple clusters). These would work like the -d or -p modes.

Aquileo | Multiple thread support

2011-09-22T15:19:57Z

Since the piecewise hashing is computationally expensive, and many computers today have multiple cores, it would be nice if ssdeep supported multiple threads.

Aquileo | Version 3.0 Features

2011-06-15T04:30:43Z

Add support for DC3 style hashes (currently in /branches/dc3), both reading and generating
Add support for sdhash, http://roussev.net/sdhash/, both reading and generating.
Combined file format to include DC3 hashes and sdhashes.

Aquileo | File size threshold

2011-02-02T19:01:59Z

Implement a file size threshold, like those found in md5deep using the -i and -I flags.

Aquileo | Compare unknown signatures to known ones

2010-02-24T22:42:32Z

Develop a method to compare unknown signatures (without computation) to known signatures. Unlike -x mode, this should*not* compare the known signatures to each other. Given a set of known signature k1, k2, k3, ... kn, and a set of unknown signatures u1, u2, u3... um, you would like the program to compare:

u1 vs k1
u1 vs k2
u1 vs k3
...
u1 vs kn

u2 vs k1
u2 vs k2
u2 vs k3
...
u2 vs kn

...

um vs k1
um vs k2
um vs k3
...
um vs kn

Suggested syntax:

The -k flag could be used to specify files of known hashes. The FILES parameters could be used to specify the files of unknown hashes. For example:

$ ssdeep -k known1.txt -k known2.txt -k known3.txt unknown1.txt unknown2.txt

Which should produce results like this:

unknown1.txt:harmless.exe matches known1.txt:EVILEVIL.EXE

Aquileo | Display all match scores

2009-10-19T13:40:57Z

Is it possible to modify the program to use a threshold of zero to display *all* match scores? Here's a patch to make it happen:

- --- ssdeep-2.2/match.c 2009-10-13 16:31:14.000000000 -0700
+++ ssdeep-2.2-local/match.c 2009-10-13 18:11:58.000000000 -0700
@@ -92,7 +92,7 @@
}

score = fuzzy_compare(sum,tmp->hash);
- - if (score > s->threshold)
+ if (score >= s->threshold)
{
if (s->mode & mode_csv)
{

Aquileo | Compare two sig files

2009-04-17T16:55:00Z

Add an option to compare two files of signatures without having to read the actual files from the disk. For example:

$ ssdeep -x sigfile1 sigfile2

sigfile1:/home/jessek/foo.dat matches sigfile2:/usr/bin/bar.dat (98)

Aquileo | Add matching mode

2008-12-30T14:41:23Z

Add functionality to the API to load in a set of known hashes and then match against that set. It would operate like the -m mode in the ssdeep client.