Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Exphash from sha256 to md5 to match imphash #377

Merged
merged 1 commit into from
Jan 11, 2024

Conversation

N0fix
Copy link
Contributor

@N0fix N0fix commented Jul 7, 2023

PR #354 added exphash using the sha256 function instead of md5, which creates two issues:

This PR proposes using md5 instead of sha256 for exphash to maintain consistency.

Note: I believe this confusion stems from a discrepancy between the original blog post about exphash, which mentions the usage of sha256, and its integration into public community projects.

@erocarrera
Copy link
Owner

I'm a bit torn in this case: I see the rationale in staying consistent with imphash, even more in the case that yara is also using md5.
Ideally all these methods would be using sha256, but one can't update imphash without causing major issues, I'd say it's not worth the pain.
Hence I'm leaning towards merging and using md5 and hoping not many people have started relying on the sha256 results.

@erocarrera erocarrera merged commit b20afc5 into erocarrera:master Jan 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants