--- name: "r_hash" section: "3" platform: "linux" package: "radare2" version: "6.2.2-1" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/r_hash" --- # r\_hash(3) Hashing and checksum library for radare2 ## NAME **r\_hash** – Hashing and checksum library for radare2 ## SYNOPSIS **#include \** *RHash* *\**\ **r\_hash\_new**(*bool rst*, *ut64 flags*); *void*\ **r\_hash\_free**(*RHash \*ctx*); The following are representative function prototypes used throughout the library and examples in this manual page; more prototypes are provided in the header. ## DESCRIPTION The **r\_hash** library implements many common hashing and checksum primitives (MD4/MD5/SHA family, CRCs, Adler, SipHash, xxHash, ssdeep, etc.), plus analysis helpers such as entropy and hamming distance. The main structure is *struct* *r\_hash\_t*, which stores intermediate contexts for several algorithms and an aligned digest buffer. ## INITIALIZATION Initialization and cleanup functions handle allocation and freeing of a hash context. The \`rst\` argument controls whether the context is reset between operations and \`flags\` selects which algorithms to prepare. *RHash* *\** **r\_hash\_new**(*bool rst*, *ut64 flags*) *void* **r\_hash\_free**(*RHash \*ctx*) Typical usage in applications: create a context once with the algorithms you need (for example \`R\_HASH\_MD5 \| R\_HASH\_SHA256\`) and reuse it for multiple inputs to avoid repeated allocations, calling \`r\_hash\_free\` when done. ## CORE OPERATIONS Core single-shot and multi-algorithm operations compute digests and expose helpers to map names and sizes. *ut8* *\** **r\_hash\_do\_md5**(*RHash \*ctx*, *const ut8 \*input*, *int len*) *ut8* *\** **r\_hash\_do\_sha1**(*RHash \*ctx*, *const ut8 \*input*, *int len*) *ut8* *\** **r\_hash\_do\_sha256**(*RHash \*ctx*, *const ut8 \*input*, *int len*) *int* **r\_hash\_calculate**(*RHash \*ctx*, *ut64 algobit*, *const ut8 \*input*, *int len*) *const* *char* *\** **r\_hash\_name**(*ut64 bit*) *int* **r\_hash\_size**(*ut64 bit*) *char* *\** **r\_hash\_tostring**(*RHash \*ctx*, *const char \*name*, *const ut8 \*data*, *int len*) Use \`r\_hash\_calculate\` when you want to compute several algorithms into the context's \`digest\` buffer at once; it returns the digest size in bytes for the requested algorithm bit. Use \`r\_hash\_name\` and \`r\_hash\_size\` to print properly sized hex dumps. ## CHECKSUMS AND ANALYSIS The library provides many lightweight checksum and analysis helpers useful when scanning binary buffers or computing features for heuristics (entropy, parity, xor, Adler32, xxhash, ssdeep fingerprinting, etc.). *ut32* **r\_hash\_adler32**(*const ut8 \*buf*, *int len*) *ut32* **r\_hash\_xxhash**(*const ut8 \*buf*, *ut64 len*) *ut8* **r\_hash\_xor**(*const ut8 \*b*, *ut64 len*) *double* **r\_hash\_entropy**(*const ut8 \*data*, *ut64 len*) *char* *\** **r\_hash\_ssdeep**(*const ut8 \*buf*, *size\_t len*) In radare2, these helpers are used for file heuristics (for example computing entropy to detect packed or compressed regions) and for concise diagnostics (e.g., showing a \`ssdeep\` fuzzy hash for similarity). \`r\_hash\_entropy\_fraction\` returns a normalized value \[0..1\] used by UI code. ## ADVANCED / INCREMENTAL USAGE For streaming or incremental hashing (hashing a large file chunk-by-chunk), the library exposes begin/end primitives and \`r\_hash\_do\_spice\` for repeated re-hashing with a seed (used by \`rahash2\` to perform iterative strengthening). *void* **r\_hash\_do\_begin**(*RHash \*ctx*, *ut64 flags*) *void* **r\_hash\_do\_end**(*RHash \*ctx*, *ut64 flags*) *void* **r\_hash\_do\_spice**(*RHash \*ctx*, *ut64 algo*, *int loops*, *RHashSeed \*seed*) *ut8* *\** **r\_hash\_do\_hmac\_sha256**(*RHash \*ctx*, *const ut8 \*input*, *int len*, *const ut8 \*key*, *int klen*) A common pattern (see \`rahash2\` and \`r\_hash\` usage in \`libr/main/rahash2.c\`) is: ``` r_hash_do_begin (ctx, R_HASH_SHA256); // feed chunks with r_hash_calculate or algorithm-specific functions r_hash_calculate (ctx, R_HASH_SHA256, chunk, chunk_len); r_hash_do_end (ctx, R_HASH_SHA256); // result is in ctx->digest ``` When you need to perform key-based MACs, use \`r\_hash\_do\_hmac\_sha256\` to obtain the HMAC-SHA256 digest in a single call. ## PRACTICAL EXAMPLES The examples below show real-life usage patterns found in \`libr/main/rahash2.c\`, \`libr/core/cbin.c\` and \`libr/core/cmd\_print.inc.c\`. Example: compute chunked hashes of a file (adapted from \`rahash2\`): ``` // open file and create ctx with the chosen algorithm bit RHash *ctx = r_hash_new (true, R_HASH_SHA256); // incremental mode: begin, feed chunks, end r_hash_do_begin (ctx, R_HASH_SHA256); for (offset = 0; offset < file_size; offset += block_size) { int len = MIN (block_size, file_size - offset); r_io_pread_at (io, offset, buf, len); // read into buf r_hash_calculate (ctx, R_HASH_SHA256, buf, len); } r_hash_do_end (ctx, R_HASH_SHA256); // ctx->digest contains the SHA-256 result (32 bytes) char *s = r_hash_tostring (ctx, "sha256", ctx->digest, 32); printf ("sha256: %s0, s); free (s); r_hash_free (ctx); ``` Example: compute entropy and display as a 0..255 value (used by \`cmd\_print\`): ``` double ent = r_hash_entropy_fraction (data, data_size); ut8 visual = (ut8)(ent * 255); printf ("entropy_frac=%.3f, visual=%u0, ent, visual); ``` Example: compare a computed digest against an expected one (pattern from \`rahash2\`): ``` RHash *ctx = r_hash_new (true, R_HASH_MD5); r_hash_calculate (ctx, R_HASH_MD5, buf, len); if (!memcmp (ctx->digest, expected_digest, 16)) { puts ("match"); } else { puts ("mismatch"); } r_hash_free (ctx); ``` Example: produce a \`ssdeep\` fuzzy hash string for a buffer: ``` char *fuzzy = r_hash_ssdeep (buf, len); if (fuzzy) { printf ("ssdeep: %s0, fuzzy); free (fuzzy); } ``` ## NOTES Function names and bitmasks are declared in \`libr/include/r\_hash.h\`. Pick the exact algorithm using \`r\_hash\_name\_to\_bits\`/\`r\_hash\_name\` helpers when mapping user strings to bit flags. Many radare2 internal users create a single \`RHash\` and call \`r\_hash\_calculate\` repeatedly; prefer incremental \`do\_begin\`/\`do\_end\` when hashing very large streams to avoid copying large buffers into memory. ## SEE ALSO [r\_bin(3)](/r_bin/3.md), [r\_core(3)](/r_core/3.md), [r\_util(3)](/r_util/3.md)