Cheat Sheet - jonelo/jacksum GitHub Wiki
This cheat sheet covers the usage of Jacksum on the command line.
It is good practise to explicitly specify the algorithm(s) with option -a, because the default algorithm could change in later releases. You also should specify how the hash value should be encoded for the output, because by default the encoding depends on the algorithm (a checksum usually is encoded in decimal, while one-way hash function is usually encoded in hex). Alternatively you can use a compatibility file which specifies the algorithm, the encoding of the hash value and the output format. A compat file also has regex information for the parser to read checkfiles again. A compat file can set a lot of command line options for you. In this case we use the linux comatibility file and we overwrite the options that are coming from that file with our own algorithm selection. For more information about compatibility files enter jacksum -h -C
jacksum -a sha3-256 -C linux -O checkfile .
If you specify the same folders that you entered while you were calculating the hashes, Jacksum can also detect files that have been added after the checkfile was created.
jacksum -a sha3-256 -C linux -c checkfile .
On Debian there are precalculated hash files located in /var/lib/dpkg/info/. MD5 hashes are used, and the paths are stored relatively to the root folder. With Jacksum you can verify those packages by using the linux style for reading, and making the paths absolute by specifying the option --path-relative-to /. Example to verify files from the sudo package:
jacksum --check-file /var/lib/dpkg/info/sudo.md5sums --style linux -a md5 --path-relative-to /
If you want to verfiy packages including all their dependencies you could install the debsums package and call rdebsums.
Jacksum supports algorithm filtering. Since all algorithms have the "sha" in the name, you can simply search for that string by using -a all:sha.
By default all algorithms that have been found are concatenated togeter by a + sign. You can get the full list by entering jacksum -a all:sha --list or jacksum -a all:sha --info. By default also all message digests are concatenated together as bytes, because it is very easy to perform integrity checks on single hashes only. If you want to list the hashes for each algorithm separately you can use option -F. To get more information about the format option, enter jacksum -h -F. The dot at the end of the command represents the current working directory. In order to output all hashes in the BSD-format from all files in and below the current working directory, the full command would be:
jacksum -a all:sha -F "#ALGONAME{i}(#FILENAME) = #HASH{i}" .
If you don't want to see the obsolete SHA-0, and also not the SHAKE-algorithms which are also part of the result of the search, you have to enter all algorithms explicitly, separated by a comma. Again, to make things easier you can use jacksum -a all:sha --info and copy and adjust the long algorithm identifier. So the following command would calculate all SHA-1, SHA-2-, and SHA-3 hahses from all files recursively starting in the current directory.
jacksum -a sha1+sha224+sha256+sha384+sha512+sha512/224+sha512/256+sha3-224+sha3-256+sha3-384+sha3-512 -F "#ALGONAME{i}(#FILENAME) = #HASH{i}" .
We want to create a csv with fields "name,input data (as hex),hash (as hex)", input data should be the string "0123456789".
jacksum -a all:crc -F "#ALGONAME{i},#SEQUENCE,#HASH{i,hex}" -q txt:0123456789
Result (for Jacksum 3.3.0)
crc8,30313233343536373839,45
crc16,30313233343536373839,443d
crc16_minix,30313233343536373839,f833
crc24,30313233343536373839,d08ea3
crc32,30313233343536373839,a684c7c6
crc32_mpeg2,30313233343536373839,694f1b1f
crc32_bzip2,30313233343536373839,96b0e4e0
crc32_fddi,30313233343536373839,9d14a594
crc32_ubi,30313233343536373839,597b3839
crc32_php,30313233343536373839,e0e4b096
crc32c,30313233343536373839,280c069e
crc64,30313233343536373839,469959388a5beffe
crc64_ecma,30313233343536373839,2a71ab4164c3bbe8
crc64_go-iso,30313233343536373839,b966f5c775a41001
crc64_xz,30313233343536373839,2765cf2c7f12731e
fcs16,30313233343536373839,3c16
In this example we are gathering hashes from all log4j*.jar files that are vulnerable to CVE-2021-44832 and store the hases in Linux style to log4j.hashes. We use the SHA3-256 hash function, because it is a modern, non-broken cryptographic hash function which minimizes hash collisions resp. false positives.
jacksum --header -a sha3-256 --style linux -O log4j.hashes --no-path .
Content of the file called log4j.hashes ...
#
# created by: Jacksum (https://jacksum.net, version: 3.4.0)
# invoked on JVM: OpenJDK 64-Bit Server VM (vendor: Eclipse Adoptium, version: 11.0.14.1+1)
# invoked on OS: Windows 10 (arch: amd64, version: 10.0)
# invoked on date: 2022-06-22T21:55:28.273+02:00
#
# invoked from: X:\log4j\CVE-2021-44228
# invocation args: --header -a sha3-256 --style linux -O log4j.hashes --no-path .
#__________________________________________________________________________________________
df6b2529d9c3de4ad32e5adc798faaf6165fbd2f701eda7897eea5cfe2791c51 *log4j-api-2.10.0.jar
848eb8989417cf96cabb5038913705cc95e8304e3c7df2f5394d5ec15d99ac1b *log4j-api-2.11.1.jar
d82d35aae99b11d7873127014043f992d62f56947f7898ca0b0f0f06ea2e10d7 *log4j-core-2.0-beta9.jar
d65893e3bc37718b47e722cb5aa01934b7a66668a4817c9cf436a216b5ff3d99 *log4j-core-2.0-rc1.jar
a6fa4ac90b50b07e19c9db597f23bf804145e5a84737e91e3a149b495d554b0c *log4j-core-2.0-rc2.jar
955da4ec2c54503cb9d126bb90174b9d4a8f65a60c03f6d637552b8bc2fef7a7 *log4j-core-2.0.1.jar
b2ef74c8ebb7ee6b3221624955f1ed20bf6c1e6d3f2683b67eb00dd5be47f5cb *log4j-core-2.0.2.jar
691c19abd32c46f193ed3287833c863caf247f2fe64341d2a5e562c0c3426587 *log4j-core-2.0.jar
80037efc5d633086779ca6cc7da536bb7749480b7e5a77c6feadcadc36df5382 *log4j-core-2.1.jar
858bd59969e1c64819c35bfb069ff1993d1b2d398c0f87f3fea8416aef2dea33 *log4j-core-2.11.0.jar
690f8ad7ee5adc76fe40675ecc7e53087ce247a3a1cd62dc9cf07a2757d5d00f *log4j-core-2.11.2.jar
27505ffbe23b56842e3a3d86f4693227fc3317900d18585ea380327aaf7350d3 *log4j-core-2.12.0.jar
367caa655a59472f6a3861480d9b99514433d8b1fd1953551f1ad08869750109 *log4j-core-2.12.1.jar
48ceffa2f5cb234c61e82ebaf57545ff8ec5533825b80dfad4d2a6a8906a6d50 *log4j-core-2.13.0.jar
5c7c616827030182d4c6fdaacd9a5d2fb404a3618092100d92a37f2bcd46c68f *log4j-core-2.13.1.jar
ca717afc2f1e9e9d44b2a00f3a5a6a88e6678d4fd9dbd78563cf9efb733e525a *log4j-core-2.13.2.jar
4239b4eba17707c6c79f01db81f9b7471ef9219f89fd1aff188b236eaf4c11c5 *log4j-core-2.13.3.jar
0b26d2565d086dbdfd174ba18bb6d90f68272917938110f8d51195d90d22f8fd *log4j-core-2.14.0.jar
f7f790e89c2fc92996c518e9f1705a7aadc9c21caecfd4ac8cb44574118a2ed3 *log4j-core-2.14.1.jar
574e817f7bded7f5fadaf1fb8ac2dad37bb316e023dcb6ae4dff884ab222e653 *log4j-core-2.2.jar
ce53977055fe2a2490b7a122ced30e007ca5cf1857f2b3fd80b3bbc6b18863b2 *log4j-core-2.3.jar
600bf903ca1fa3abe0040b47885e1e55d358068a16581f910d470be5969c94da *log4j-core-2.4.1.jar
0e0fa79d6281a70577b662b0ef276569a745796bf9ed8be5bce4b7875e568995 *log4j-core-2.4.jar
f2f51dba05c976cace911a0dd4a748051acfc1a52a5de7a4a663afa890c79c24 *log4j-core-2.5.jar
c0ed39397f308807bc53c7dd6958745dff16b90f044c2639ad98da78c85746aa *log4j-core-2.6.1.jar
8146d62443ed4b64dd0ebc91864a1a375f2e3123a83685f571de02ec9293573b *log4j-core-2.6.2.jar
48f064dbfc48bac0bcc3a2e1f4c9b72b2da62d82b0f248459a3c26a121db5d62 *log4j-core-2.6.jar
85b00d65e5bdc0373cfa48f710ab02a9527e6c4e232415ac204ea652b4032954 *log4j-core-2.7.jar
8c41f9773ba79a48716225a7ec560184cacfbc20d09012ea5187262d05e63b4f *log4j-core-2.8.1.jar
751fcac9bfb014e18c9c05bf5d070c1485cfe4c676eedd8281ab1b1564a90304 *log4j-core-2.8.2.jar
6dd7790aece8119e5b2ad6a489e9b622d10e9e24973d9fc3683f7dc464b5d60a *log4j-core-2.8.jar
62b4af8260d4a21c529674661e0e66c65707b17b09a97ec3ff6bdf237092b21b *log4j-core-2.9.0.jar
2eebdfdffdf1c62fc3cd6dba2626ee102f71416b409a40cfac5ccdf40ad1199f *log4j-core-2.9.1.jar
We take the log4j.hashes from above and search the entire server for those hashes. The log4j.hashes file has been stored in linux style so we specify that - although we don't need to, because the default parser also understands the Linux style format. Since we are only interested in the matches, we can rely on the default filter settings, but if you like you can specify the filter explicitly by setting --wanted-list-filter match. Since the files on that system have been stored on a SSD we will benefit from increasing the number of threads while reading files in parallel. This can be done by setting --threads-reading to a reasonable value.
jacksum --wanted-list log4j.hashes --style linux --threads-reading 8 /
standard output ...
MATCH \log4j\CVE-2021-44228\log4j-api-2.10.0.jar (log4j-api-2.10.0.jar)
MATCH \log4j\CVE-2021-44228\log4j-api-2.11.1.jar (log4j-api-2.11.1.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.0-beta9.jar (log4j-core-2.0-beta9.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.0-rc2.jar (log4j-core-2.0-rc2.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.0-rc1.jar (log4j-core-2.0-rc1.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.0.1.jar (log4j-core-2.0.1.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.0.jar (log4j-core-2.0.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.0.2.jar (log4j-core-2.0.2.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.1.jar (log4j-core-2.1.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.11.0.jar (log4j-core-2.11.0.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.12.0.jar (log4j-core-2.12.0.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.11.2.jar (log4j-core-2.11.2.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.12.1.jar (log4j-core-2.12.1.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.13.0.jar (log4j-core-2.13.0.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.13.1.jar (log4j-core-2.13.1.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.13.2.jar (log4j-core-2.13.2.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.13.3.jar (log4j-core-2.13.3.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.14.0.jar (log4j-core-2.14.0.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.2.jar (log4j-core-2.2.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.3.jar (log4j-core-2.3.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.4.1.jar (log4j-core-2.4.1.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.14.1.jar (log4j-core-2.14.1.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.4.jar (log4j-core-2.4.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.5.jar (log4j-core-2.5.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.6.1.jar (log4j-core-2.6.1.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.6.2.jar (log4j-core-2.6.2.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.6.jar (log4j-core-2.6.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.7.jar (log4j-core-2.7.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.8.1.jar (log4j-core-2.8.1.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.8.2.jar (log4j-core-2.8.2.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.8.jar (log4j-core-2.8.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.9.0.jar (log4j-core-2.9.0.jar)
MATCH \log4j\CVE-2021-44228\log4j-core-2.9.1.jar (log4j-core-2.9.1.jar)
Jacksum: total lines in check file: 42
Jacksum: improperly formatted lines in check file: 0
Jacksum: properly formatted lines in check file: 33
Jacksum: ignored lines (empty lines and comments): 9
Jacksum: correctness of check file: 100.00 %
Jacksum: files read successfully: 252299
Jacksum: files read with errors: 3
Jacksum: total bytes read: 117670015750
Jacksum: total bytes read (human readable): 109 GiB, 602 MiB, 892 KiB, 774 bytes
Jacksum: files matching wanted hashes: 33
Jacksum: files not matching wanted hashes: 252266
Jacksum: elapsed time: 8 min, 38 s, 215 ms
See also CVE-2021-44832: Find vulnerable .jar files using Jacksum
jacksum -a unknown:16 -q hex:050000 -E hex -e d893
Finds all algorithms with a digest width of 16 bits that produces the hex output d893 for the hex input 050000.
Result
Trying 13 algorithms with a width of 16 bits that are supported by Jacksum 3.0.0 ...
Trying 30 CRC algorithms with a width of 16 bits by testing against well known CRCs ...
crc:16,1021,FFFF,false,false,FFFF
--> CRC-16/GENIBUS
Trying all CRC algorithms with a width of 16 bits by brute force (be patient!) ...
crc:16,1021,FFFF,false,false,FFFF
crc:16,37D2,FFFF,true,false,FFFF
crc:16,3E2D,0000,true,false,FFFF
crc:16,4175,FFFF,true,false,FFFF
crc:16,4A5B,FFFF,true,true,0000
crc:16,5A41,FFFF,true,false,FFFF
crc:16,5C63,FFFF,true,true,0000
crc:16,6287,FFFF,true,true,0000
crc:16,649C,0000,false,true,FFFF
crc:16,6D55,FFFF,true,true,0000
crc:16,75AC,FFFF,true,false,FFFF
crc:16,7D64,FFFF,false,false,FFFF
crc:16,81A6,FFFF,true,false,FFFF
crc:16,B9F9,FFFF,true,true,0000
crc:16,C3D6,FFFF,false,false,FFFF
crc:16,D436,0000,true,false,FFFF
crc:16,D6D2,0000,false,true,FFFF
crc:16,DA9C,FFFF,true,false,FFFF
crc:16,E03E,FFFF,false,false,FFFF
crc:16,F701,FFFF,true,false,FFFF
Jacksum: algorithms tested: 1048620
Jacksum: algorithms found: 21
Jacksum: elapsed time: 6 s, 460 ms
Means Jacksum has tested more than one million algorithms in about 7 seconds and it found 21 matching algorithms. Each of those returns the same CRC value. Test with more input/output sequences and/or longer input sequences in order to find the right algorithm. The most likely algorithm is printed with a name if it is a well known CRC. In this example it has been identified as the CRC-16/GENIBUS.
Once you have identified the correct algorithm, you can calculate your own input data using the CRC definitions that have been found.
jacksum -a crc:16,1021,FFFF,false,false,FFFF -E hex -q txt:"Hello World"
jacksum --version
jacksum --info
or
jacksum -a all --list
Result
adler32
blake224
blake256
blake384
blake512
blake2b-8
blake2b-16
blake2b-24
blake2b-32
blake2b-40
blake2b-48
blake2b-56
blake2b-64
blake2b-72
blake2b-80
blake2b-88
blake2b-96
blake2b-104
blake2b-112
blake2b-120
blake2b-128
blake2b-136
blake2b-144
blake2b-152
blake2b-160
blake2b-168
blake2b-176
blake2b-184
blake2b-192
blake2b-200
blake2b-208
blake2b-216
blake2b-224
blake2b-232
blake2b-240
blake2b-248
blake2b-256
blake2b-264
blake2b-272
blake2b-280
blake2b-288
blake2b-296
blake2b-304
blake2b-312
blake2b-320
blake2b-328
blake2b-336
blake2b-344
blake2b-352
blake2b-360
blake2b-368
blake2b-376
blake2b-384
blake2b-392
blake2b-400
blake2b-408
blake2b-416
blake2b-424
blake2b-432
blake2b-440
blake2b-448
blake2b-456
blake2b-464
blake2b-472
blake2b-480
blake2b-488
blake2b-496
blake2b-504
blake2b-512
blake2s-8
blake2s-16
blake2s-24
blake2s-32
blake2s-40
blake2s-48
blake2s-56
blake2s-64
blake2s-72
blake2s-80
blake2s-88
blake2s-96
blake2s-104
blake2s-112
blake2s-120
blake2s-128
blake2s-136
blake2s-144
blake2s-152
blake2s-160
blake2s-168
blake2s-176
blake2s-184
blake2s-192
blake2s-200
blake2s-208
blake2s-216
blake2s-224
blake2s-232
blake2s-240
blake2s-248
blake2s-256
blake3
cksum_minix
cksum
crc8
crc16
crc16_minix
crc24
crc32
crc32_mpeg2
crc32_bzip2
crc32_fddi
crc32_ubi
crc32_php
crc64
crc64_ecma
crc64_go-iso
crc64_xz
dha256
echo224
echo256
echo384
echo512
ed2k
elf
fcs16
fletcher16
fnv-0_32
fnv-0_64
fnv-0_128
fnv-0_256
fnv-0_512
fnv-0_1024
fnv-1_32
fnv-1_64
fnv-1_128
fnv-1_256
fnv-1_512
fnv-1_1024
fnv-1a_32
fnv-1a_64
fnv-1a_128
fnv-1a_256
fnv-1a_512
fnv-1a_1024
fork256
fugue224
fugue256
fugue384
fugue512
groestl-224
groestl-256
groestl-384
groestl-512
gost
gost:crypto-pro
has160
haval_128_3
haval_128_4
haval_128_5
haval_160_3
haval_160_4
haval_160_5
haval_192_3
haval_192_4
haval_192_5
haval_224_3
haval_224_4
haval_224_5
haval_256_3
haval_256_4
haval_256_5
jh224
jh256
jh384
jh512
joaat
kangarootwelve
keccak224
keccak256
keccak288
keccak384
keccak512
kupyna-256
kupyna-384
kupyna-512
lsh-256-224
lsh-256-256
lsh-512-224
lsh-512-256
lsh-512-384
lsh-512-512
luffa224
luffa256
luffa384
luffa512
marsupilamifourteen
md2
md4
md5
mdc2
panama
radiogatun:32
radiogatun:64
ripemd128
ripemd160
ripemd256
ripemd320
sha0
sha1
sha224
sha256
sha384
sha512
sha512/224
sha512/256
sha3-224
sha3-256
sha3-384
sha3-512
shake128
shake256
skein-256-8
skein-256-16
skein-256-24
skein-256-32
skein-256-40
skein-256-48
skein-256-56
skein-256-64
skein-256-72
skein-256-80
skein-256-88
skein-256-96
skein-256-104
skein-256-112
skein-256-120
skein-256-128
skein-256-136
skein-256-144
skein-256-152
skein-256-160
skein-256-168
skein-256-176
skein-256-184
skein-256-192
skein-256-200
skein-256-208
skein-256-216
skein-256-224
skein-256-232
skein-256-240
skein-256-248
skein-256-256
skein-512-8
skein-512-16
skein-512-24
skein-512-32
skein-512-40
skein-512-48
skein-512-56
skein-512-64
skein-512-72
skein-512-80
skein-512-88
skein-512-96
skein-512-104
skein-512-112
skein-512-120
skein-512-128
skein-512-136
skein-512-144
skein-512-152
skein-512-160
skein-512-168
skein-512-176
skein-512-184
skein-512-192
skein-512-200
skein-512-208
skein-512-216
skein-512-224
skein-512-232
skein-512-240
skein-512-248
skein-512-256
skein-512-264
skein-512-272
skein-512-280
skein-512-288
skein-512-296
skein-512-304
skein-512-312
skein-512-320
skein-512-328
skein-512-336
skein-512-344
skein-512-352
skein-512-360
skein-512-368
skein-512-376
skein-512-384
skein-512-392
skein-512-400
skein-512-408
skein-512-416
skein-512-424
skein-512-432
skein-512-440
skein-512-448
skein-512-456
skein-512-464
skein-512-472
skein-512-480
skein-512-488
skein-512-496
skein-512-504
skein-512-512
skein-1024-8
skein-1024-16
skein-1024-24
skein-1024-32
skein-1024-40
skein-1024-48
skein-1024-56
skein-1024-64
skein-1024-72
skein-1024-80
skein-1024-88
skein-1024-96
skein-1024-104
skein-1024-112
skein-1024-120
skein-1024-128
skein-1024-136
skein-1024-144
skein-1024-152
skein-1024-160
skein-1024-168
skein-1024-176
skein-1024-184
skein-1024-192
skein-1024-200
skein-1024-208
skein-1024-216
skein-1024-224
skein-1024-232
skein-1024-240
skein-1024-248
skein-1024-256
skein-1024-264
skein-1024-272
skein-1024-280
skein-1024-288
skein-1024-296
skein-1024-304
skein-1024-312
skein-1024-320
skein-1024-328
skein-1024-336
skein-1024-344
skein-1024-352
skein-1024-360
skein-1024-368
skein-1024-376
skein-1024-384
skein-1024-392
skein-1024-400
skein-1024-408
skein-1024-416
skein-1024-424
skein-1024-432
skein-1024-440
skein-1024-448
skein-1024-456
skein-1024-464
skein-1024-472
skein-1024-480
skein-1024-488
skein-1024-496
skein-1024-504
skein-1024-512
skein-1024-520
skein-1024-528
skein-1024-536
skein-1024-544
skein-1024-552
skein-1024-560
skein-1024-568
skein-1024-576
skein-1024-584
skein-1024-592
skein-1024-600
skein-1024-608
skein-1024-616
skein-1024-624
skein-1024-632
skein-1024-640
skein-1024-648
skein-1024-656
skein-1024-664
skein-1024-672
skein-1024-680
skein-1024-688
skein-1024-696
skein-1024-704
skein-1024-712
skein-1024-720
skein-1024-728
skein-1024-736
skein-1024-744
skein-1024-752
skein-1024-760
skein-1024-768
skein-1024-776
skein-1024-784
skein-1024-792
skein-1024-800
skein-1024-808
skein-1024-816
skein-1024-824
skein-1024-832
skein-1024-840
skein-1024-848
skein-1024-856
skein-1024-864
skein-1024-872
skein-1024-880
skein-1024-888
skein-1024-896
skein-1024-904
skein-1024-912
skein-1024-920
skein-1024-928
skein-1024-936
skein-1024-944
skein-1024-952
skein-1024-960
skein-1024-968
skein-1024-976
skein-1024-984
skein-1024-992
skein-1024-1000
skein-1024-1008
skein-1024-1016
skein-1024-1024
sm3
streebog256
streebog512
sum_bsd
sum_minix
sum_sysv
sum8
sum16
sum24
sum32
sum40
sum48
sum56
tiger128
tiger160
tiger
tiger2
tree:tiger
tree:tiger2
vsh
whirlpool0
whirlpool1
whirlpool2
xor8
xxhash32