# tm_lookup.c File Reference

## Detailed Description

Contains the generic hash database creation and lookup code.

`#include "hashdb_tools_i.h"`

## Defines

#define | base_addr(off, len) ((len) * ( ( ( (off) + (len) - 1) / (len) ) - 1 ) )
| Determine the starting address of the line in the index that contains the offset.

## Functions

uint8_t | tsk_hdb_idxinitialize (TSK_HDB_INFO *hdb_info, TSK_TCHAR *htype)
| Initialize the TSK hash DB index file.
uint8_t | tsk_hdb_idxaddentry (TSK_HDB_INFO *hdb_info, char *hvalue, OFF_T offset)
| Add an entry to the intermediate index file.
uint8_t | tsk_hdb_idxfinalize (TSK_HDB_INFO *hdb_info)
| Finalize index creation process by sorting the index and removing the intermediate temp file.
int8_t | tsk_hdb_lookup (TSK_HDB_INFO *hdb_info, char *hash, TSK_HDB_FLAG_ENUM flags, TSK_HDB_LOOKUP_FN action, void *ptr)
| Perform the binary search in the index for the text/ASCII hash value.
int8_t | tsk_hdb_lookup_raw (TSK_HDB_INFO *hdb_info, uint8_t *hash, uint8_t len, TSK_HDB_FLAG_ENUM flags, TSK_HDB_LOOKUP_FN action, void *ptr)
| Perform the binary search in the index for a hash value given in a raw (non-text) format.
uint8_t | tsk_hdb_hasindex (TSK_HDB_INFO *hdb_info, uint8_t htype)
| Determine if the hash database that is open has an index that has been created.
TSK_HDB_INFO * | tsk_hdb_open (TSK_TCHAR *db_file, TSK_HDB_OPEN_ENUM flags)
| Open a hash database and index for lookup.
void | tsk_hdb_close (TSK_HDB_INFO *hdb_info)
| Close the HDB_INFO structure and free the memory.

## Define Documentation

#define base_addr | ( | off,
|  | len |  | ) | ((len) * ( ( ( (off) + (len) - 1) / (len) ) - 1 ) )

Determine the starting address of the line in the index that contains the offset.

Parameters:

  | off | Byte offset to find start of
  | len | Byte length of each line in index

Returns:
  Byte offset to start of corresponding line

## Function Documentation

void tsk_hdb_close | ( | TSK_HDB_INFO * | hdb_info | ) |

Close the HDB_INFO structure and free the memory.

Parameters:

  | hdb_info | Structure to free.

uint8_t tsk_hdb_hasindex | ( | TSK_HDB_INFO * | hdb_info,
|  | uint8_t | htype
| ) |

Determine if the hash database that is open has an index that has been created.

Parameters:

  | hdb_info | Hash database to consider
  | htype | Hash type that index should be of

Returns:
  1 if index exists and 0 if not

uint8_t tsk_hdb_idxaddentry | ( | TSK_HDB_INFO * | hdb_info,
|  | char * | hvalue,
|  | OFF_T | offset
| ) |

Add an entry to the intermediate index file.

Parameters:

  | hdb_info | Hash database state info
  | hvalue | Hash value to add
  | offset | Byte offset of hash entry in original database.

Returns:
  1 on error and 0 on success

uint8_t tsk_hdb_idxfinalize | ( | TSK_HDB_INFO * | hdb_info | ) |

Finalize index creation process by sorting the index and removing the intermediate temp file.

Parameters:

  | hdb_info | Hash database state info structure.

Returns:
  1 on error and 0 on success

uint8_t tsk_hdb_idxinitialize | ( | TSK_HDB_INFO * | hdb_info,
|  | TSK_TCHAR * | htype
| ) |

Initialize the TSK hash DB index file.

This creates the intermediate file, which will have entries added to it. This file must be sorted before the process is finished.

Parameters:

  | hdb_info | Hash database state structure
  | htype | String of index type to create

Returns:
  1 on error and 0 on success

int8_t tsk_hdb_lookup | ( | TSK_HDB_INFO * | hdb_info,
|  | char * | hash,
|  | TSK_HDB_FLAG_ENUM | flags,
|  | TSK_HDB_LOOKUP_FN | action,
|  | void * | ptr
| ) |

Perform the binary search in the index for the text/ASCII hash value.

Parameters:

  | hdb_info | Hash database state information
  | hash | Hash value to search for
  | flags |
  | action | Callback function to call for each hash db entry (not called if QUICK flag is given)
  | ptr | Pointer to data to pass to each callback

Returns:
  -1 on error, 0 if hash value not found, and 1 if value was found.

int8_t tsk_hdb_lookup_raw | ( | TSK_HDB_INFO * | hdb_info,
|  | uint8_t * | hash,
|  | uint8_t | len,
|  | TSK_HDB_FLAG_ENUM | flags,
|  | TSK_HDB_LOOKUP_FN | action,
|  | void * | ptr
| ) |

Perform the binary search in the index for a hash value given in a raw (non-text) format.

this is a wrapper around the normal lookup function.

Parameters:

  | hdb_info | Hash database state information
  | hash | Array with binary hash value to search for
  | len | Number of bytes in binary hash value
  | flags |
  | action | Callback function to call for each hash db entry (not called if QUICK flag is given)
  | ptr | Pointer to data to pass to each callback

Returns:
  -1 on error, 0 if hash value not found, and 1 if value was found.

TSK_HDB_INFO* tsk_hdb_open | ( | TSK_TCHAR * | db_file,
|  | TSK_HDB_OPEN_ENUM | flags
| ) |

Open a hash database and index for lookup.

Parameters:

  | db_file | Path to database.
  | flags | Flags for opening the database.

Returns:
  Poiner to hash database state structure or NULL on error