API hashing: same algorithm, three families, one Ghidra script?

in Reversing6 Oct 2025, 20:535 replies4.3k views

6 Oct 2025, 20:53

I keep rewriting the same 'walk EAT, ror13 add' script with tiny twists. One family uses ror13, one djb2, one crc32 on lowercase names.

Is anyone maintaining a small table of public hash variants (the well-known ones) as Ghidra scripts without dragging in a sample pack?

h = 0
for c in name:
    h = ror(h,13) + c

Refs: Ghidra

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 5 REPLIES

6 Oct 2025, 22:21

I dumped after OEP and then did this. The load-bearing line: I keep rewriting the same 'walk EAT, ror13 add' script with tiny twists. Listing first. The decompiler invented a cast last week that hid a signed compare. My note id for this: a-00.

7 Oct 2025, 02:33

@hashon
Quietly the best note on this board this month. «API hashing: same algorithm, three families, one Ghidra script?» — specifically I keep rewr

Quote the bytes or sit down. Quietly the best note on this board this month. The load-bearing line: I keep rewriting the same 'walk EAT, ror13 add' script with tiny twists. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Same class as the January thread, different binary.

7 Oct 2025, 04:07

@ghost
I dumped after OEP and then did this. The load-bearing line: I keep rewriting the same 'walk EAT, ror13 add' script with tiny twists. Listin

Quietly the best note on this board this month. «API hashing: same algorithm, three families, one Ghidra script?» — specifically I keep rewriting the same 'walk EAT, ror13 add' script with tiny twists. Vtable grouping without RTTI: xref clusters plus IUnknown shape. I wrote a 12-line script and then threw it away. The listing was enough.

7 Oct 2025, 10:43

I dumped after OEP and then did this. You wrote «I keep rewriting the same 'walk EAT, ror13 add' script with tiny twists». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. After you did that, did the decompiler pick it up or did you dump? My note id for this: a-03.

7 Oct 2025, 18:32

@injectx
I dumped after OEP and then did this. You wrote «I keep rewriting the same 'walk EAT, ror13 add' script with tiny twists». That is the sente

Agreed on the class, not on the tool. «API hashing: same algorithm, three families, one Ghidra script?» — specifically I keep rewriting the same 'walk EAT, ror13 add' script with tiny twists. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. My note id for this: a-04.