From 7914291c9828ab9475837cef69c0e7857f4931bd Mon Sep 17 00:00:00 2001 From: Eric Conrad Date: Thu, 7 Sep 2017 19:30:12 -0400 Subject: [PATCH] Update DeepWhite.md --- DeepWhite.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/DeepWhite.md b/DeepWhite.md index f3de92d..f13e52d 100644 --- a/DeepWhite.md +++ b/DeepWhite.md @@ -27,7 +27,7 @@ Install hashdeep: https://github.com/jessek/hashdeep/releases Generate your own whitelist on Windows: ``` -hashdeep.exe -r / -c md5,sha1,sha56 > raw-hashes.csv +C:\> hashdeep.exe -r / -c md5,sha1,sha56 > raw-hashes.csv ``` Note that hashdeep, etc., has a dumb recursive design (from the manpage): @@ -35,7 +35,7 @@ Note that hashdeep, etc., has a dumb recursive design (from the manpage): On Linux/Unix: take the raw CSV, remove the carriage returns, select DLLs, EXEs and SYS files, grab the 2nd field to the end, and create a new whitelist: ```shell -echo "md5,sha1,sha256,path" > file-whitelist.csv -cat raw-hashes.csv | tr -d '\r' | egrep "\.dll$|\.exe$|\.sys$" | cut -d, -f2- >> file-whitelist.csv +$ echo "md5,sha1,sha256,path" > file-whitelist.csv +$ cat raw-hashes.csv | tr -d '\r' | egrep "\.dll$|\.exe$|\.sys$" | cut -d, -f2- >> file-whitelist.csv ```