MySQL User Defined Functions for the ssdeep API -
Shell C++ Python C
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
docs
src
.gitignore
README.markdown
build.sh

README.markdown

lib_mysqludf_ssdeep

Maintenance status

More comprehensive documentation can be found on the lib_mysqludf_ssdeep readthedocs.org page

Functions

ssdeep_fuzzy_hash(STRING to_hash)

  • Param: to_hash string to be hashed using ssdeep.
  • Return: a hash STRING on success and NULL otherwise.

Calculates an ssdeep hash for the supplied string.

ssdeep_fuzzy_hash_filename(STRING file_name)

  • Param: file_name to be hashed using ssdeep.
  • Return: a hash STRING on success and NULL otherwise.

Calculates an ssdeep hash for the supplied filename.

ssdeep_fuzzy_compare(STRING signature1, STRING signature2)

  • Param: signature1 ssdeep hash string to compare.
  • Param: signature2 ssdeep hash string to compare.
  • Return: an INTEGER (0 to 100) on success and NULL otherwise.

Calculates match percentage between two hash strings.

Building

Ubuntu

Move into the lib_mysqludf_ssdeep directory.

MySQL Libraries

sudo apt-get install libmysqlclient-dev

ssdeep Libraries

  1. Get ssdeep from sourceforge
  2. Install with ./configure and then make and then make install
  3. Done

Build It!

  1. mkdir build
  2. ./build.sh
  3. lib_mysqludf_ssdeep.so will now be in the current directory.

Redhat

Move into the lib_mysqludf_ssdeep directory.

MySQL Libraries

yum install gcc-c++ mysql-devel autoconf automake libtool

ssdeep Libraries

  1. Get ssdeep from sourceforge
  2. Install with ./configure and then make and then make install
  3. Done

Build It!

  1. mkdir build
  2. ./build.sh
  3. lib_mysqludf_ssdeep.so will now be in the current directory.

Install

To find your MySQL plugin directory run the following query in MySQL:

show variables like 'plugin_dir';

Mine is /usr/lib/mysql/plugin/ and I have used that in the examples below. It can be changed in your /etc/mysql/my.cnf file with the line in the mysqld section:

[mysqld]
plugin_dir=/usr/lib/mysql/plugin

Ubuntu

  1. sudo cp lib_mysqludf_ssdeep.so /usr/lib/mysql/plugin/
  2. mysql -u root -p < src/installdb.sql
  3. Done.

Uninstall

Ubuntu

  1. sudo rm /usr/lib/mysql/plugin/lib_mysqludf_ssdeep.so
  2. mysql -u root -p < src/uninstalldb.sql
  3. Done.