{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/1498","labels_url":"https://api.github.com/repos/facebook/osquery/issues/1498/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1498/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/1498/events","html_url":"https://github.com/facebook/osquery/issues/1498","id":104843744,"number":1498,"title":"Filesystem hash data results","user":{"login":"headmin","id":46750,"avatar_url":"https://avatars.githubusercontent.com/u/46750?v=3","gravatar_id":"","url":"https://api.github.com/users/headmin","html_url":"https://github.com/headmin","followers_url":"https://api.github.com/users/headmin/followers","following_url":"https://api.github.com/users/headmin/following{/other_user}","gists_url":"https://api.github.com/users/headmin/gists{/gist_id}","starred_url":"https://api.github.com/users/headmin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/headmin/subscriptions","organizations_url":"https://api.github.com/users/headmin/orgs","repos_url":"https://api.github.com/users/headmin/repos","events_url":"https://api.github.com/users/headmin/events{/privacy}","received_events_url":"https://api.github.com/users/headmin/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-09-04T07:43:15Z","updated_at":"2015-09-04T18:15:45Z","closed_at":"2015-09-04T18:15:45Z","body":"I've successfully used the **Filesystem hash data** <https://osquery.io/docs/tables/#hash> to display md5, sha-1, sha-256 for files and .pkg files.\r\n\r\nI wonder I don't get some result back in some cases i.e. I've tried for binary, .dmg or .iso files and get blank results in return - verify with other (non osquery) hash methods works though.\r\nI wonder if I'm missing something here or this could be a bug - if so please confirm? \r\n\r\n```\r\nosqueryi --version                                                 \r\nosqueryi version 1.5.2\r\n```\r\n\r\n#### example1 - working on a .pkg (flat package):\r\n```\r\nosqueryi \"select * from hash where path = '/Users/headmin/Downloads/munkitools-2.3.0.2519.pkg'\"       \r\n+-------------------------------------------------+-----------------------+----------------------------------+------------------------------------------+------------------------------------------------------------------+\r\n| path                                            | directory             | md5                              | sha1                                     | sha256                                                           |\r\n+-------------------------------------------------+-----------------------+----------------------------------+------------------------------------------+------------------------------------------------------------------+\r\n| /Users/headmin/Downloads/munkitools-2.3.0.2519.pkg | /Users/headmin/Downloads | 3cdd7deff2a72ff3e67705be3992dc97 | 63a960452bdc6a7480257d4f4d6cb54aa22e346c | c994fef514948249043ba396de304ccb3e8afdc219ddc91987fc2da2288938de |\r\n+-------------------------------------------------+-----------------------+----------------------------------+------------------------------------------+------------------------------------------------------------------+```\r\n```\r\nverification with weak md5:\r\n```\r\nmd5 /Users/headmin/Downloads/munkitools-2.3.0.2519.pkg\r\nMD5 (/Users/headmin/Downloads/munkitools-2.3.0.2519.pkg) = 3cdd7deff2a72ff3e67705be3992dc97\r\n```\r\n---\r\n#### example2 - working on a file (python):\r\n```\r\nosqueryi \"select * from hash where path = '/usr/local/bin/ansible'\"                         \r\n+------------------------+----------------+----------------------------------+------------------------------------------+------------------------------------------------------------------+\r\n| path                   | directory      | md5                              | sha1                                     | sha256                                                           |\r\n+------------------------+----------------+----------------------------------+------------------------------------------+------------------------------------------------------------------+\r\n| /usr/local/bin/ansible | /usr/local/bin | c0f3a24a702003743a350b1f697902e3 | e4eb63073f793e63d05e79ce5a039317f6d09752 | dae341fdef1166026503341f89d7ad9fd5e5553d6caaadd5de98dffc9ea4841d |\r\n+------------------------+----------------+----------------------------------+------------------------------------------+------------------------------------------------------------------+\r\n```\r\n---\r\n#### example3 - **not working** on a binary:\r\n```\r\nosqueryi \"select * from hash where path = '/usr/local/bin/go'\"\r\n+-------------------+----------------+-----+------+--------+\r\n| path              | directory      | md5 | sha1 | sha256 |\r\n+-------------------+----------------+-----+------+--------+\r\n| /usr/local/bin/go | /usr/local/bin |     |      |        |\r\n+-------------------+----------------+-----+------+--------+\r\n```\r\nverification with weak md5 - of course hashing the binary is possible:\r\n```\r\nmd5 /usr/local/bin/go\r\nMD5 (/usr/local/bin/go) = f6318f78d6c9307f7f15ae2f838b530d\r\n```\r\n---\r\n#### example4 - **not working** on a .dmg:\r\n\r\n```\r\nosqueryi \"select * from hash where path = '/Users/headmin/Downloads/VMware-Fusion-8.0.0-2985594.dmg'\"\r\n+-------------------------------------------------------+-----------------------+-----+------+--------+\r\n| path                                                  | directory             | md5 | sha1 | sha256 |\r\n+-------------------------------------------------------+-----------------------+-----+------+--------+\r\n| /Users/headmin/Downloads/VMware-Fusion-8.0.0-2985594.dmg | /Users/headmin/Downloads |     |      |        |\r\n+-------------------------------------------------------+-----------------------+-----+------+--------+```\r\n```\r\n---\r\n#### example5 - **not working** on a .iso: \r\n```\r\nosqueryi \"select * from hash where path = '/Users/headmin/Downloads/ubuntu-14.04.3-desktop-amd64.iso'\" \r\n+--------------------------------------------------------+-----------------------+-----+------+--------+\r\n| path                                                   | directory             | md5 | sha1 | sha256 |\r\n+--------------------------------------------------------+-----------------------+-----+------+--------+\r\n| /Users/headmin/Downloads/ubuntu-14.04.3-desktop-amd64.iso | /Users/headmin/Downloads |     |      |        |\r\n+--------------------------------------------------------+-----------------------+-----+------+--------+```"},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/137810084","html_url":"https://github.com/facebook/osquery/issues/1498#issuecomment-137810084","issue_url":"https://api.github.com/repos/facebook/osquery/issues/1498","id":137810084,"user":{"login":"marpaia","id":927168,"avatar_url":"https://avatars.githubusercontent.com/u/927168?v=3","gravatar_id":"","url":"https://api.github.com/users/marpaia","html_url":"https://github.com/marpaia","followers_url":"https://api.github.com/users/marpaia/followers","following_url":"https://api.github.com/users/marpaia/following{/other_user}","gists_url":"https://api.github.com/users/marpaia/gists{/gist_id}","starred_url":"https://api.github.com/users/marpaia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marpaia/subscriptions","organizations_url":"https://api.github.com/users/marpaia/orgs","repos_url":"https://api.github.com/users/marpaia/repos","events_url":"https://api.github.com/users/marpaia/events{/privacy}","received_events_url":"https://api.github.com/users/marpaia/received_events","type":"User","site_admin":false},"created_at":"2015-09-04T18:15:45Z","updated_at":"2015-09-04T18:15:45Z","body":"Thanks @sharvilshah!"}}