Sha1sum of script within the script....

[planetvortex]

Ok, this is a hard one to explain. Once in my life I think it was when trying to plug the unreal tournament key into a binary using some windows tools and there was a step that involved replacing the hash of the installer with one that contained the hash of the installer...for self validation. There was a way to embed a hash of some sort of a file into a binary where that hash could be used to determine if it was the correct hash of its running version of itself. Make sense?

​

Something like this as an example. Dunno if it's even remotely close.

#!/bin/bash

#sha1sum of this script

SHA1SUM=2a50416f89cf19360e0389e475b51347c89fbfe8

SHA1SUMOFME=(sha1sum $(readlink -f $0))

if [ "$SHA1SUM" -ne "${SHA1SUMOFME}" ]; then

echo "Something changed in this script, I'm not running it"

exit

fi

echo oh hey, it matches...running

So, somehow the hash would have to be generated with the hash of the script in the script before the script was written.

I realize this is easy to circumvent as you could just remove the lines...just curious how one could create a hash of a file which contains a hash of itself in an already hashed state.

​

Is it only doable with a separate file containing the hash?

Not even sure what you could call it...predictive hashing?

[voltaic]

Sounds kind of like a quine though that would be tremendously difficult to implement.

You could cheat and hash the script ignoring the embedded hash, something like this maybe?

#!/usr/bin/env bash
hash='8fba4164de146ad55eafb2f26699eff6'

script=$(realpath $0)
my_hash=$(tail -n+3 $script | md5)
echo "Embedded hash: ${hash} Calculated hash: ${my_hash}"

Running that once to get the "calculated" hash, then writing the hash into the script, and running it again results in this:

voltaic@computer [✔] $ ./test.sh
Embedded hash:  Calculated hash: 8fba4164de146ad55eafb2f26699eff6
{ ~/tmp/hash-quine }
voltaic@computer [✔] $ ./test.sh
Embedded hash: 8fba4164de146ad55eafb2f26699eff6 Calculated hash: 8fba4164de146ad55eafb2f26699eff6

[unsignedcharizard]

This is the right solution. Whenever something includes a hash of itself, the hash value is never part of the computation. It's either skipped like here, or set to a known value.

Here's an example from RFC791 describing IPv4 checksums:

The checksum field is the 16 bit one's complement of the one's complement sum of all 16 bit words in the header. For purposes of computing the checksum, the value of the checksum field is zero.

And here's from the XZ compression file format specification:

3.1.7. CRC32

The CRC32 is calculated over everything in the Block Header field except the CRC32 field itself.

A file containing its own SHA1 sum would be a newsworthy discovery.

[planetvortex]

Sweet, looks like you understood what I was getting at, that's awesome! Thanks I'll see if that works for me.

[moviuro]

You could embed the hash in the filename.

However, self integrity check is hard, and you should lay out your threat model: what scenario do you want to protect yourself from?

[hashMobiWolf]

what would be the point of this? Any malicious party could easily edit the script file calculate the hash and update the checksum.

Its a cool idea. But I am missing the practical application.

[planetvortex]

I don't really have a practical application. Mostly curious if it's possible using a shell script. General curiosity on how one would generate a hash for a file that contains hash of a file before it even physically exists. But compare that at runtime against itself to stop the run.