ffuzzy 0.3.9

Library to generate / parse / compare ssdeep Context Triggered Piecewise Hashes (CTPH)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

# Compatibility Policy against ssdeep / libfuzzy

## In General

Everything ssdeep / libfuzzy can generate (as an output) *and* can be accepted
back by ssdeep / libfuzzy is what we need to support on this project.

In specific, the main version to keep compatibility is ssdeep / libfuzzy,
version 2.14.1.

## Input (raw bytes to the fuzzy hash generator)

The input data for the fuzzy hash generator which *must* be supported by this
project exactly matches to ssdeep / libfuzzy.

## Input (fuzzy hashes and related information)

The input data (except that to the fuzzy hash generator) which *must* be
supported by this project must qualify:

1.  The input data is a valid output of ssdeep / libfuzzy functions, and
2.  Feeding the data back to ssdeep / libfuzzy does not cause the problems

On the other hand, this project may support an input data which does not
qualify those conditions, as long as supporting them will not cause serious
compatibility issues.

The input data which is *not* obligated to support in this project includes:

*   Invalid data (obviously)
*   Data which ssdeep / libfuzzy accepts *but*
    cannot be an output of ssdeep / libfuzzy
    *   e.g. a fuzzy hash prefixed by `'0'`  
             (the support for this kind of fuzzy hashes was removed
              in the version 0.2 of the `ffuzzy` crate)
    *   e.g. a fuzzy hash with long block hashes
             (which overflows the maximum block hash size in the raw form) but
             fits in after the normalization process  
             (this is currently supported by the `ffuzzy` crate as of
              the current version but we can remove the support anytime)
        *   The optional feature `strict-parser` now explicitly rejects
            such fuzzy hashes.
*   Data which is an output of ssdeep *but* feeding the data
    back to ssdeep causes serious errors / problems
    *   e.g. a CSV file output from ssdeep but input file names contain special
             characters that confuse the ssdeep's CSV file parser badly.
    *   On such cases, appropriate error handling / mitigation mechanism to
        minimize the data loss should be provided (as possible).

## Output

If a crate in this project generates something and it corresponds with a feature
in ssdeep / libfuzzy, it must qualify either:

1.  The output must be compatible with ssdeep / libfuzzy, version 2.14.1 or
2.  Explicitly stated as "incompatible with ssdeep / libfuzzy"  
    (separate methods or explicit configuration should be provided on such cases)