Question

在使用fuzzy_compare函数返回正确的比较值时遇到问题。它应该返回0~100但总是返回0.

from ctypes import *
fuzzy = CDLL('fuzzy.dll')
out1 = create_string_buffer('\x00'*512)
out2 = create_string_buffer('\x00'*512)
print fuzzy.fuzzy_hash_buf('hashme', len('hashme'), out1)
print fuzzy.fuzzy_hash_buf('hashme2', len('hashme2'), out2)
print out1.value
print out2.value
print fuzzy.fuzzy_compare(out1, out2)
# output
#    0
#    0
#    3:cA:x <-- correct hash
#    3:cy:R <-- correct hash
#    0      <-- fuzzy_compare returning 0...

我尝试使用out1.value调用模糊比较，转换为c_char_p（）和create_string_buffer（）但它总是返回0.我在调试器中查看它（在fuzzy_compare函数上设置bp并且它正在传递正确的值，我只是不知道为什么它总是返回0.我是否正确使用该函数？

Answer 1

我编译了包含的sample.c，它似乎有效。所以我在Python中尝试了类似的东西。请注意，它使用非常大的输入缓冲区（0x50000）并且仅修改16个字节，产生99的紧密匹配。

import ctypes
from random import randrange, seed

seed(42)

SPAMSUM_LENGTH = 64
FUZZY_MAX_RESULT = SPAMSUM_LENGTH + SPAMSUM_LENGTH // 2 + 20
SIZE = 0x50000

fuzzy = ctypes.CDLL('fuzzy.dll')

fuzzy_hash_buf = fuzzy.fuzzy_hash_buf
fuzzy_hash_buf.restype = ctypes.c_int
fuzzy_hash_buf.argtypes = [
    ctypes.c_char_p, #buf
    ctypes.c_uint32, #buf_len
    ctypes.c_char_p, #result
]
fuzzy_compare = fuzzy.fuzzy_compare
fuzzy_compare.restype = ctypes.c_int
fuzzy_compare.argtypes = [
    ctypes.c_char_p, #sig1
    ctypes.c_char_p, #sig2
]

out1 = ctypes.create_string_buffer('\x00' * FUZZY_MAX_RESULT)
out2 = ctypes.create_string_buffer('\x00' * FUZZY_MAX_RESULT)

in1 = ''.join(chr(randrange(256)) for x in xrange(SIZE))
in2 = ''.join(c if (i < 0x100 or i >= 0x110) else '\x25'
              for i, c in enumerate(in1))

print fuzzy_hash_buf(in1, len(in1), out1)
print fuzzy_hash_buf(in2, len(in2), out2)
print out1.value
print out2.value
print fuzzy_compare(out1, out2)

输出：

0
0
6144:rR1yoHH0XI3VFNdCRXmg0BqMFKDLA6sPaVujZAQhO5HQXNHtQyr4zgytywlfj:qYFF5CRXmg9IK4ouqQAHu+y8zgS7
6144:LR1yoHH0XI3VFNdCRXmg0BqMFKDLA6sPaVujZAQhO5HQXNHtQyr4zgytywlfj:KYFF5CRXmg9IK4ouqQAHu+y8zgS7
99

ssdeep的fuzzy_compare总是返回从ctypes python加载的0

1 个答案: