radare2/man/rahash2.1
2022-10-12 14:11:32 +02:00

92 lines
3.2 KiB
Groff

.Dd Mar 12, 2022
.Dt RAHASH2 1
.Sh NAME
.Nm rahash2
.Nd block based hashing utility
.Sh SYNOPSIS
.Nm rahash2
.Op Fl BbdDehjrknvq
.Op Fl a Ar algorithm
.Op Fl b Ar size
.Op Fl D Ar algo
.Op Fl E Ar algo
.Op Fl f Ar from
.Op Fl i Ar iterations
.Op Fl I Ar IV
.Op Fl n Ar blocks
.Op Fl s Ar string
.Op Fl S Ar seed
.Op Fl p Ar type
.Op Fl x Ar hexstr
.Op Fl t Ar to
.Op Fl c Ar hash
.Op [file] ...
.Sh DESCRIPTION
This program is part of the radare project.
.Pp
Rahash2 allows you to calculate, check and show the hash values of each block of a target file. The block size is 32768 bytes by default. It's allowed to hash from stdin using '-' as a target file. You can compare against a known hash and get the result in the exit status.
.Pp
You can hash big files by hashing each block and later determine what part of it has been modified. Useful for filesystem analysis.
.Pp
This command can be used to calculate hashes of a certain part of a file or a command line passed string.
.Pp
This is the command used by the 'ph' command of radare.
.Bl -tag -width Fl
.It Fl a Ar algo
Comma separated list of algorithms to use when hashing files or strings. See -L to list the supported hashing algorithms. This flag can be passed multiple times instead of separating them by commas.
.It Fl b Ar blocksize
Define the block size
.It Fl c Ar hash
Compare the computed hash with this one. Allowed only when a single hash is computed.
.It Fl D Ar algo
Decrypt instead of hash using the given algorithm (base64, base91, rc4, aes, xor, blowfish, rot, rol, ror, rc2, rc6, punycode)
.It Fl e
Use little endian to display checksums
.It Fl E Ar algo
Encrypt instead of hash using the given algorithm (base64, base91, rc4, aes, xor, blowfish, rot, rol, ror, rc2, rc6, punycode)
.It Fl i Ar iters
Apply the hash Iters times to itself+seed
.It Fl I Ar [^]s:string|hexstr
Set initialization vector (IV) for the cryptographic functions.
.It Fl j
Show output in JSON (see -r and -J). If passed more than once results in -J
.It Fl J
New simplified JSON output, maybe this format will replace -j, but it's added as a new flag to not break backward compatibility until proper discussion
.It Fl B
Show per-block hash
.It Fl k
Show result using OpenSSH's VisualHostKey randomart algorithm
.It Fl n
Amount of blocks to hash
.It Fl s Ar string
Hash this string instead of using the 'source' and 'hash-file' arguments.
.It Fl S Ar [^]s:string|hexstr
Set seed to hash with, use ^to prefix seed, otherwise it's suffixed. If the seed is just a dash '-' it will read from stdin. This is useful to provide huge XOR payloads or other crypto keys bigger than few bytes.
.It Fl f Ar from
Start hashing at given address
.It Fl t Ar to
Stop hashing at given address
.It Fl p Ar arg
Show vertical entropy/statistical entropy graphs
.It Fl q
Quiet mode (-qq for even quieter!)
.It Fl r
Show output in radare commands
.It Fl x Ar hexstr
Hash the given hexpair string instead of using the 'source' and 'hash-file' arguments.
.It Fl v
Show version information
.It Fl h
Show usage help message.
.El
.Sh DIAGNOSTICS
.Ex -std
.Pp
When -c is used, exit status 0 indicates a match between the expected and computed hashes.
.Sh SEE ALSO
.Pp
.Xr radare2(1)
.Sh AUTHORS
.Pp
pancake <pancake@nopcode.org>