Adding new hashsets using NSRL format

[tuliorosa]

Estou adicionando novos hash usando o -importkff
Mas percebi que é obrigatório ter o MD5 e o SHA-1

Estou pensando em colocar um hash fake no MD5 e o real no SHA-1, funcionária ?
O IPED usa preferencialmente um dos 2 ? ou faz uso dos 2 ?

Automatic translation:

I'm adding new hashes using -importkff
But I realized that it is mandatory to have MD5 and SHA-1

I'm thinking of putting a fake hash on MD5 and the real one on SHA-1, employee?
Does IPED preferably use one of the 2? or does it use the 2?

[lfcnassif]

Please post in english.

Just one of them is used, the one enabled in IpedConfig.txt. If both are enabled, md5 is used. If you just import sha-1 and use a fake md5, you should disable md5 and enabled sha-1 in that file, or hash look up will not work. Leaving md5 column empty does not work?

[tuliorosa]

There is a validation of the size of MD5 and SHA1.
You need to add both

[tuliorosa]

Imported MD5, and the fake SHA1.
Initially kff.db.p was 1.26 GB, after importing it was 3.71 GB.
When executing IPED, it presented errors.
See the attached LOG.
IPED-2021-02-18-07-54-22.log

[lfcnassif]

Possibly the hashes imported from the second site are with some issue. My guess is that NSRLFile.txt is pointing to some ProductCode not present in NSRLProd.txt, this is not verified when importing currently.

[tuliorosa]

All NSRLFile.txt Product Codes are present in NSRLProd.txt.
I'm going to do some tests.

[lfcnassif]

If you can provide a small hashset in NSRL format that reproduces the error, I can take a look.

[tuliorosa]

The problem was in ProducCode, it cannot be -2.
I changed the ProducCode to 999992, and solved it.

[lfcnassif]

Thanks for digging into it.