From 4b1954df051d715cad3e46065ecf20d177d9e0f7 Mon Sep 17 00:00:00 2001 From: Eric Conrad Date: Thu, 7 Sep 2017 10:32:51 -0400 Subject: [PATCH] Update readme.md --- DeepBlueWhite/readme.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/DeepBlueWhite/readme.md b/DeepBlueWhite/readme.md index 45e2525..87446e6 100644 --- a/DeepBlueWhite/readme.md +++ b/DeepBlueWhite/readme.md @@ -4,7 +4,19 @@ Placeholder, more to come... Install hashdeep: https://github.com/jessek/hashdeep/releases -Generate your own whitelist: +Generate your own whitelist on Windows: ``` -hashdeep.exe -r / -c md5,sha1,sha56 > whitelist.csv +hashdeep.exe -r / -c md5,sha1,sha56 > raw-hashes.csv +``` + +Note that hashdeep, etc., has a dumb recursive design (from the manpage): + +> Enables recursive mode. All subdirectories are traversed. Please note that recursive mode cannot be used to examine all files of a given file extension. For example, calling hashdeep -r *.txt will examine all files in directories that end in .txt. + +Move file to Unix/Linux, remove Windows carriage returns, grab EXEs and DLLs, make CSV. + +CSV format will be: md5,sha1,sha256,full path: + +``` +cat raw-hashes.csv | tr -d '\r' | egrep "\.dll$|\.exe$" | cut -d, -f2- > win10-x64.csv ```