NAME¶

r_hash — Hashing and checksum library for radare2

SYNOPSIS¶

#include <r_hash.h>

RHash *
r_hash_new(bool rst, ut64 flags);

void
r_hash_free(RHash *ctx);

The following are representative function prototypes used throughout the library and examples in this manual page; more prototypes are provided in the header.

DESCRIPTION¶

The r_hash library implements many common hashing and checksum primitives (MD4/MD5/SHA family, CRCs, Adler, SipHash, xxHash, ssdeep, etc.), plus analysis helpers such as entropy and hamming distance.

The main structure is struct r_hash_t, which stores intermediate contexts for several algorithms and an aligned digest buffer.

INITIALIZATION¶

Initialization and cleanup functions handle allocation and freeing of a hash context. The `rst` argument controls whether the context is reset between operations and `flags` selects which algorithms to prepare. RHash * r_hash_new(bool rst, ut64 flags) void r_hash_free(RHash *ctx)

Typical usage in applications: create a context once with the algorithms you need (for example `R_HASH_MD5 | R_HASH_SHA256`) and reuse it for multiple inputs to avoid repeated allocations, calling `r_hash_free` when done.

CORE OPERATIONS¶

Core single-shot and multi-algorithm operations compute digests and expose helpers to map names and sizes. ut8 * r_hash_do_md5(RHash *ctx, const ut8 *input, int len) ut8 * r_hash_do_sha1(RHash *ctx, const ut8 *input, int len) ut8 * r_hash_do_sha256(RHash *ctx, const ut8 *input, int len) int r_hash_calculate(RHash *ctx, ut64 algobit, const ut8 *input, int len) const char * r_hash_name(ut64 bit) int r_hash_size(ut64 bit) char * r_hash_tostring(RHash *ctx, const char *name, const ut8 *data, int len)

Use `r_hash_calculate` when you want to compute several algorithms into the context's `digest` buffer at once; it returns the digest size in bytes for the requested algorithm bit. Use `r_hash_name` and `r_hash_size` to print properly sized hex dumps.

CHECKSUMS AND ANALYSIS¶

The library provides many lightweight checksum and analysis helpers useful when scanning binary buffers or computing features for heuristics (entropy, parity, xor, Adler32, xxhash, ssdeep fingerprinting, etc.). ut32 r_hash_adler32(const ut8 *buf, int len) ut32 r_hash_xxhash(const ut8 *buf, ut64 len) ut8 r_hash_xor(const ut8 *b, ut64 len) double r_hash_entropy(const ut8 *data, ut64 len) char * r_hash_ssdeep(const ut8 *buf, size_t len)

In radare2, these helpers are used for file heuristics (for example computing entropy to detect packed or compressed regions) and for concise diagnostics (e.g., showing a `ssdeep` fuzzy hash for similarity). `r_hash_entropy_fraction` returns a normalized value [0..1] used by UI code.

ADVANCED / INCREMENTAL USAGE¶

For streaming or incremental hashing (hashing a large file chunk-by-chunk), the library exposes begin/end primitives and `r_hash_do_spice` for repeated re-hashing with a seed (used by `rahash2` to perform iterative strengthening). void r_hash_do_begin(RHash *ctx, ut64 flags) void r_hash_do_end(RHash *ctx, ut64 flags) void r_hash_do_spice(RHash *ctx, ut64 algo, int loops, RHashSeed *seed) ut8 * r_hash_do_hmac_sha256(RHash *ctx, const ut8 *input, int len, const ut8 *key, int klen)

A common pattern (see `rahash2` and `r_hash` usage in `libr/main/rahash2.c`) is:

r_hash_do_begin (ctx, R_HASH_SHA256);
// feed chunks with r_hash_calculate or algorithm-specific functions
r_hash_calculate (ctx, R_HASH_SHA256, chunk, chunk_len);
r_hash_do_end (ctx, R_HASH_SHA256);
// result is in ctx->digest

When you need to perform key-based MACs, use `r_hash_do_hmac_sha256` to obtain the HMAC-SHA256 digest in a single call.

PRACTICAL EXAMPLES¶

The examples below show real-life usage patterns found in `libr/main/rahash2.c`, `libr/core/cbin.c` and `libr/core/cmd_print.inc.c`.

Example: compute chunked hashes of a file (adapted from `rahash2`):

// open file and create ctx with the chosen algorithm bit
RHash *ctx = r_hash_new (true, R_HASH_SHA256);
// incremental mode: begin, feed chunks, end
r_hash_do_begin (ctx, R_HASH_SHA256);
for (offset = 0; offset < file_size; offset += block_size) {
    int len = MIN (block_size, file_size - offset);
    r_io_pread_at (io, offset, buf, len); // read into buf
    r_hash_calculate (ctx, R_HASH_SHA256, buf, len);
}
r_hash_do_end (ctx, R_HASH_SHA256);
// ctx->digest contains the SHA-256 result (32 bytes)
char *s = r_hash_tostring (ctx, "sha256", ctx->digest, 32);
printf ("sha256: %s0, s);
free (s);
r_hash_free (ctx);

Example: compute entropy and display as a 0..255 value (used by `cmd_print`):

double ent = r_hash_entropy_fraction (data, data_size);
ut8 visual = (ut8)(ent * 255);
printf ("entropy_frac=%.3f, visual=%u0, ent, visual);

Example: compare a computed digest against an expected one (pattern from `rahash2`):

RHash *ctx = r_hash_new (true, R_HASH_MD5);
r_hash_calculate (ctx, R_HASH_MD5, buf, len);
if (!memcmp (ctx->digest, expected_digest, 16)) {
    puts ("match");
} else {
    puts ("mismatch");
}
r_hash_free (ctx);

Example: produce a `ssdeep` fuzzy hash string for a buffer:

char *fuzzy = r_hash_ssdeep (buf, len);
if (fuzzy) {
    printf ("ssdeep: %s0, fuzzy);
    free (fuzzy);
}

NOTES¶

Function names and bitmasks are declared in `libr/include/r_hash.h`. Pick the exact algorithm using `r_hash_name_to_bits`/`r_hash_name` helpers when mapping user strings to bit flags.

Many radare2 internal users create a single `RHash` and call `r_hash_calculate` repeatedly; prefer incremental `do_begin`/`do_end` when hashing very large streams to avoid copying large buffers into memory.

SEE ALSO¶

r_bin(3), r_core(3), r_util(3)