Skip to content

Fix bug that leads to ~23.3% miss rate on kernel32.dll (among others) - #71

Open
humpty-tony wants to merge 2 commits into
OALabs:mainfrom
humpty-tony:fix-murmur2_lummas_v3.py
Open

Fix bug that leads to ~23.3% miss rate on kernel32.dll (among others)#71
humpty-tony wants to merge 2 commits into
OALabs:mainfrom
humpty-tony:fix-murmur2_lummas_v3.py

Conversation

@humpty-tony

@humpty-tony humpty-tony commented Apr 7, 2025

Copy link
Copy Markdown
Contributor

Hey folks, after working on a Lumma v3 sample I realized the current Murmur2 implementation was giving the wrong hash roughly 23.4% of the time. After a bit of investigation, 72Ghoul on the OALab discord server figured out hashdb's current implementation gives the wrong hash when there is one byte remaining after processing the 4 byte chunks.

You can find a diff of kernel32 with the old and new algo (respectively) here: https://www.diffchecker.com/V717U9Cf/

The new implementation is based off https://github.com/Orochimarufan/cdev/blob/master/cdev/murmurhash2.py and has a 0% miss rate. I tested it locally on kernel32.dll, sqlite3.dll and wininet.dll.

@humpty-tony humpty-tony changed the title Fix bug that lead to ~23.3% miss rate on kernel32.dll (among others) Fix bug that leads to ~23.3% miss rate on kernel32.dll (among others) Apr 7, 2025
@herrcore

herrcore commented Apr 7, 2025

Copy link
Copy Markdown
Member

just going to double check the original sample first 277d7f450268aeb4e7fe942f70a9df63aa429d703e9400370f0621a438e918bf

@humpty-tony

Copy link
Copy Markdown
Contributor Author

I can give it a run and post the results here if it can help 👀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants