Bug#863460: hashrat: Seems to produce wrong results on big files

[Andreas Moog]

Package: hashrat
Version: 1.8.3+dfsg-2
Priority: important

Hi there,

there's something wonky going on when using hashtag's sha512 hash for big
files (10 Gig in this case):

$ fallocate -l 10G sha512test
$ sha512sum sha512test 
0a9ed4396868700784918a83a595845d70e582eb0e625c48ace24f4ee94e705247e210339c5f5a55e597f00d2c3217b0c0797e1bfc617161e00de96eaee2d068  sha512test

$ hashrat -sha512 sha512test 
hash='sha512:cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e' type='file' mode='100644' uid='1000' gid='1000' size='10737418240' mtime='1495871799' inode='12058626' path='sha512test'

$ echo 1 >> sha512test 
$ sha512sum sha512test 
ae6565b7a9761d6524262738fe252121393aa3fc4987794f5f10175407e212ca81cf04edca949b0316947342e85eca4902dbd445cd53b703c316e5b2979cc976  sha512test

$ hashrat -sha512 sha512test 
hash='sha512:cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e' type='file' mode='100644' uid='1000' gid='1000' size='10737418242' mtime='1495871852' inode='12058626' path='sha512test'

It looks like some sort of caching is going on, despite the "-cache" option
is not being used.

For small files it works as expected:

$ fallocate -l 1M sha512-1M-test
$ hashrat sha512-1M-test -sha512
hash='sha512:d6292685b380e338e025b3415a90fe8f9d39a46e7bdba8cb78c50a338cefca741f69e4e46411c32de1afdedfb268e579a51f81ff85e56f55b0ee7c33fe8c25c9' type='file' mode='100644' uid='1000' gid='1000' size='1048576' mtime='1495872206' inode='12058627' path='sha512-1M-test'

$ echo 1 >> sha512-1M-test 
$ hashrat sha512-1M-test -sha512
hash='sha512:5fc50c214f3928dcdec8f4e3d7c765aadd08cf6de9d65c64f68d4945d4a9e320bae56437a637ded05788b6aedbf074fdc73969c5f513b3938da72ce0efba3728' type='file' mode='100644' uid='1000' gid='1000' size='1048578' mtime='1495872221' inode='12058627' path='sha512-1M-test'

Let me know if I should provide any more information.

Cheers,
 Andreas

-- 
PGP-encrypted mails preferred
PGP Fingerprint: 74CD D9FE 5BCB FE0D 13EE 8EEA 61F3 4426 74DE 6624
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/forensics-devel/attachments/20170527/005c8205/attachment.sig>