ProcessFuzzyHash computes and compares fuzzy hashes of processes in a Windows memory image. Fuzzy hashes are hashing functions that, contrary to cryptographic hashes such as MD5, SHA-1 or SHA-256, preserve similarity between similar inputs (two similar inputs produce similar outputs). Because of how Windows manages memory, an in-memory instance of an executable is likely to differ from another instance of the same executable, so fuzzy hashing is well suited to cluster and compare them.

The plugin lets you choose which part of the process to hash: the main executable PE, loaded modules (DLLs), individual VAD memory regions, the whole process address space, or kernel drivers; and, within a PE, specific sections or headers.

Available fuzzy hash algorithms:

• ssdeep
• sdhash
• TLSH
• dcfldd (bundled, pure Python)

Volatility 2? This is the Volatility 3 / Python 3 port. The original (fixed) Volatility 2.6 plugin is preserved on the volatility2-latest branch.

Requires Volatility 3 and Python 3. setup.sh installs the system libraries, creates a virtualenv and installs Volatility 3 plus the hashing backends:

./setup.sh                      # uses ~/.venv-vol3 by default
VENV=/path/to/venv ./setup.sh   # or pick the virtualenv location

Dependencies:

• System: build-essential, cmake, libfuzzy-dev, libffi-dev, python3-dev, python3-venv, ssdeep
• Python 3: volatility3, pefile, python-tlsh, ssdeep, and optionally fuzzyhashlib (for sdhash)

The hashing libraries are imported lazily: the plugin still loads if one is missing, and only the affected algorithm is disabled. dcfldd is bundled and needs no external dependency.

Pass the plugin directory with -p and select a --mode:

vol -p /path/to/processfuzzyhash -f memory.dmp processfuzzyhash --mode pe --algorithm ssdeep --name svchost.exe

Notes:

• Supported PE header names: DOS_HEADER, NT_HEADERS, FILE_HEADER, OPTIONAL_HEADER, header.
• Create time is rendered natively by Volatility 3.

# Main executable of every svchost.exe, with ssdeep
vol -p . -f memory.dmp processfuzzyhash --mode pe --algorithm ssdeep --expression svchost

# Executable VAD regions of lsass with TLSH
vol -p . -f memory.dmp processfuzzyhash --mode vad --executable --algorithm tlsh --name lsass.exe

# .text section of loaded DLLs, comparing against a known hash
vol -p . -f memory.dmp processfuzzyhash --mode dll --section .text --algorithm tlsh --compare T1<...>

# Hash kernel drivers
vol -p . -f memory.dmp processfuzzyhash --mode driver --algorithm ssdeep

# List PE sections of the main executables
vol -p . -f memory.dmp processfuzzyhash --mode pe --list-sections

# Write the dumped PEs to ./out while hashing
vol -p . -o ./out -f memory.dmp processfuzzyhash --mode pe --dump --name lsass.exe

Example output (--mode pe --algorithm ssdeep, similar svchost.exe instances produce similar hashes — the point of fuzzy hashing):

Process      PID  PPID  Create Time              Section  Algorithm  Generated Hash
svchost.exe  652  536   2022-10-24 12:09:24 UTC  pe       SSDeep     384:bvvWkXZVq+1t5...EbvKrPK
svchost.exe  768  536   2022-10-24 12:09:28 UTC  pe       SSDeep     384:bvvWkXZVq+1t5...EbvKmPK

Licensed under the GNU AGPLv3 license.