API documentation - adamliesko/tlsh GitHub Wiki

TLSH's API offers two different approaches for use.

First, there is the option to use the static class functions options to compute a diff between two files, but also to get a hash of a file or a bytes based input.

Computing a diff between two files.

> Tlsh.diff_files('./../fixtures/test_file_1', './../fixtures/test_file_2')
 => 501

Getting a hash of a file.

> tlsh = Tlsh.hash_file('./../fixtures/test_file_1', './../fixtures/test_file_2')
 => 501
> tlsh.string.to_s
 => "b2317c38fac0333c8ff7d3ff31fcf3b7fb3f9a3ef3bf3c880cfc43ebf97f3cc73fbfc"

Getting a hash of bytes.

> Tlsh.hash_bytes([11,4,...2])
 => #<Tlsh::TlshInstance:0x007fddf7cf7f60 @checksum=77, @l_value=13, @q1_ratio=1, @q2_ratio=2, @q_ratio=18, @code=[113, 234, 243, 233, 185, 240, 180, 207, 123, 159, 195, 238, 7, 74, 14, 114, 59, 50, 55, 62, 226, 73, 19, 139, 133, 104, 235, 187, 195, 173, 42, 122]>

The second option involves the exposure of TlshInstance, which can be compared against other instances to compute a diff.

Comparing two Tlsh instances and getting their diff.

> me = Tlsh::TlshInstance.new(checksum: 232, l_value: 13, q1_ratio: 2, q2_ratio: 2, q_ratio: 34, body: [2, 252, 48, 128, 35, 3, 160, 2, 176, 59, 51, 48, 15, 195, 10, 130, 248, 48, 8, 194, 250, 0, 10, 0, 128, 184, 186, 14, 2, 204, 160, 195])
> other = Tlsh::TlshInstance.new(checksum: 23, l_value: 2, q1_ratio: 2, q2_ratio: 2, q_ratio: 34, body: [1, 251, 48, 128, 35, 3, 160, 2, 176, 59, 51, 48, 15, 195, 10, 130, 248, 48, 8, 194, 250, 0, 10, 0, 128, 184, 186, 14, 2, 204, 160, 195])
> me.diff(other)
 => 141