Skip to content

Conversation

@msuhanov
Copy link

The checksum algorithm is not a plain XOR-32, there are two edge cases:

  • when the final XOR-32 result is 0, the checksum is set to 1;
  • when the final XOR-32 result is -1, the checksum is set to -2.

@williballenthin
Copy link
Owner

whoa, very cool. thanks for sharing. do you happen to have documentation of this, or discovered via testing?

@williballenthin williballenthin merged commit 20f3ebe into williballenthin:master Apr 13, 2016
@NiKiZe
Copy link
Contributor

NiKiZe commented Apr 13, 2016

I'd argue that this is not true, but will try to test, @williballenthin whrw you able to confirm/reproduce ?

Would it be possible to get a test case for this?

@msuhanov
Copy link
Author

Hello.

whoa, very cool. thanks for sharing. do you happen to have documentation of this, or discovered via testing?

This was discovered by disassembling a Windows kernel. You can also find the same algorithm in WRK and ReactOS. The test case (for the null XOR-32 result) is attached to this message: v-SOFTWARE - checksum.gz (Windows will mount this hive without an error, but an invalid checksum with a missing transaction log file will produce an error message). Also, this issue is documented here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants