SSDEEP(1)

💖 SSDEEP 💖

okay so bestie, we're doing fuzzy hashes today. this is the ssdeep manual, from the SSDEEP command family, and it's genuinely one of the most iconic little tools ever. let's get into it 🦋

✨ NAME ✨

ssdeep — Computes context triggered piecewise hashes (fuzzy hashes)

like. that's the whole personality. it makes fuzzy hashes. not regular "one byte changed, everything changed" hashes. fuzzy ones. we love her for that 💅

🌸 SYNOPSIS 🌸

ssdeep [-m <file>] [-k <file>] [-vdprgsblcxa] [-t val] [FILES]
ssdeep [-V|h]

🎀 DESCRIPTION 🎀

So what it does is, for each input file, it computes a signature based on context triggered piecewise hashes — aka a fuzzy hash. that's the core vibe.

And if you ask it to, the program will match those signatures against a file of known signatures and report any possible matches it finds. It can also go the other way: examine one or more files of signatures and find any matches hiding in those files. 👑

Output goes to standard out, errors go to standard error. classic.

🫶 options, babe

• -m <file> — Loads the specified file of known hashes to use for matching. This file must be a previous output of the program, no cap. Then the program hashes each entry in FILES and compares those signatures to the known signatures. Any matches that score above the threshold get displayed. You can use this flag multiple times to load more known signatures. 🍓 This flag may not be used with the -k or -x flags.
• -k <file> — Load the specified file of known hashes to use for matching. This file must be a previous output of the program. Then the program treats each entry in FILES as a set of known hashes as well. The hashes in those FILES get compared to the known hashes from this file. Matches that score above the threshold are displayed. Both the file you specify here and the input FILES should contain fuzzy hashes. This flag may be used multiple times to load more known signatures. 🌈 This flag may not be used with the -m, -d, or -p flags.
• -v — Verbose mode. The name of each file gets printed to standard error while it's being hashed. so you can watch the little guy work ✨
• -d — Computes a signature for each entry in the FILES and compares it to the set of known signatures. Matches that score above the threshold are displayed. The computed signature then gets added to the set of known signatures. 💀 This flag may not be used with the -k or -x flags.
• -p — Works like the -d flag, but it displays all matches for each file. Like, for two files A and B that match with a score above the threshold, it displays "A matches B" and "B matches A". mutual matching. it's giving soulmates 💖 This flag may not be used with the -k or -x flags.
• -r — Enables recursive mode. All subdirectories get traversed. 🧚 Please note: recursive mode cannot be used to examine all files of a given file extension. For example, invoking the program with -r *.txt will examine all files in directories that end in .txt. If you actually want to process all files in a directory tree with the .txt suffix, try using the find(1) command instead. (this one trips everyone up, fr fr 😭)
• -g — Similar files get grouped together into clusters. This can be handy for finding more similar files. Like, if you're searching for file A which matches B, then anything that matches B will also be included in the cluster. found family trope 🫶
• -s — Silent mode. All error messages are suppressed. 🤫
• -b — Enables bare mode. Strips any leading directory information from displayed filenames. This flag may not be used in conjunction with the -l flag.
• -l — Enables relative file paths. Instead of printing the absolute path for each file, it displays the relative file path as indicated on the command line. This flag may not be used in conjunction with the -b flag.
• -c — Enables comma separated output mode. In any of the matching modes -d, -p, or -m, it displays the results as input file, known file, matching score. csv girlies rise 🍓
• -x — Signature file matching. Each entry in FILES must contain signatures generated by a previous output of the program. Each signature gets loaded and compared against the set of known hashes. Match scores above the threshold are displayed. Each signature is then added to the set of knowns. This flag may not be used with the -m, -d, or -p flags.
• -a — Displays all matches in any of the matching modes, regardless of score. Using -a displays all results, even if the match score is zero. no filtering, we're just showing everything 💅
• -t <val> — In any of the matching modes, only display matches when the match score is greater than the given value. The default threshold value is zero.
• -h — Show a help screen and exit.
• -V — Show the version number and exit.

⭐ RETURN VALUE ⭐

Returns 0 on success, 1 if there's a problem.

and okay, important nuance: read errors, permission denied, and encountering directories while not in recursive mode are still considered successes. yes really. Problems are things like being unable to load the matching file, specifying both bare and relative paths, etc.

👑 AUTHOR 👑

ssdeep was written by Jesse Kornblum of Facebook, research@jessekornblum.com

🌈 COPYRIGHT 🌈

Copyright (C) 2002 Andrew Tridgell
Copyright (C) 2006, 2008, 2010 ManTech International Corporation
Copyright (C) 2012 Kyrus
Copyright (C) 2013 Helmut Grohne
Copyright (C) 2013, 2014 Facebook
Copyright (C) 2014 kikairoya
Copyright (C) 2014 Jesse Kornblum
Copyright (C) 2017 Tsukasa OI

This program is licensed under the terms of the General Public License. See the file COPYING for details.

🦋 SEE ALSO 🦋

This program is based on SpamSum by Dr. Andrews Tridgell.

http://www.samba.org/ftp/unpacked/junkcode/spamsum/

and that's the whole page bestie!! 🎀 this was the ssdeep manual, from the ssdeep Project, Version 2.14.1 — dated 7 Nov 2017. ok love u, go hash something fuzzy 💖✨🦋