treffynnon/lib_mysqludf_ssdeep

MySQL User Defined Functions for the ssdeep API -

lib_mysqludf_ssdeep

More comprehensive documentation can be found on the lib_mysqludf_ssdeep readthedocs.org page Functions

ssdeep_fuzzy_hash(STRING to_hash)

• Param: to_hash string to be hashed using ssdeep.
• Return: a hash STRING on success and NULL otherwise.

Calculates an ssdeep hash for the supplied string.

ssdeep_fuzzy_hash_filename(STRING file_name)

• Param: file_name to be hashed using ssdeep.
• Return: a hash STRING on success and NULL otherwise.

Calculates an ssdeep hash for the supplied filename.

ssdeep_fuzzy_compare(STRING signature1, STRING signature2)

• Param: signature1 ssdeep hash string to compare.
• Param: signature2 ssdeep hash string to compare.
• Return: an INTEGER (0 to 100) on success and NULL otherwise.

Calculates match percentage between two hash strings.

Building

Ubuntu

Move into the lib_mysqludf_ssdeep directory.

MySQL Libraries

sudo apt-get install libmysqlclient-dev

ssdeep Libraries

1. Get ssdeep from sourceforge
2. Install with ./configure and then make and then make install
3. Done

Build It!

1. mkdir build
2. ./build.sh
3. lib_mysqludf_ssdeep.so will now be in the current directory.

Redhat

Move into the lib_mysqludf_ssdeep directory.

MySQL Libraries

yum install gcc-c++ mysql-devel autoconf automake libtool

ssdeep Libraries

1. Get ssdeep from sourceforge
2. Install with ./configure and then make and then make install
3. Done

Build It!

1. mkdir build
2. ./build.sh
3. lib_mysqludf_ssdeep.so will now be in the current directory.

Install

To find your MySQL plugin directory run the following query in MySQL:

show variables like 'plugin_dir';

Mine is /usr/lib/mysql/plugin/ and I have used that in the examples below. It can be changed in your /etc/mysql/my.cnf file with the line in the mysqld section:

[mysqld]
plugin_dir=/usr/lib/mysql/plugin

Ubuntu

1. sudo cp lib_mysqludf_ssdeep.so /usr/lib/mysql/plugin/
2. mysql -u root -p < src/installdb.sql
3. Done.

Uninstall

Ubuntu

1. sudo rm /usr/lib/mysql/plugin/lib_mysqludf_ssdeep.so
2. mysql -u root -p < src/uninstalldb.sql
3. Done.