short long Note
===== ==== ====
/h -h --help Display this help
/r -r --recursive Search sub-directories as well. Default = NO
/f -f --file Calculate the file's (or files under the folder) hash
/p -p --pid Calculate the process' hash (user space)
/b -b --begin Start address of the process, used with pid, default 0x01000000
/e -e --end End address of the process, used with pid, default 0x7FFF0000
/c -c --CRC16
/0 -0 --CRCIIT16
/1 -1 --CRC32
/2 -2 --MD2
/3 -3 --MD4
/4 -4 --MD5
/5 -5 --SHA0
/6 -6 --SHA1
Examples:
<this EXE> -f C:\ntdetect.com -c01 Calculate CRC16/CRCIIT16/CRC32 hash of the file
<this EXE> -012345f6 C:\ntdetect.com Calculate all the hashes of the file
<this EXE> -012345 C:\windows Calculate hashes on all files under the folder
<this EXE> -012345r C:\windows Save as above, and recursive to all its sub-folders
<this EXE> -p 1234 -b 0x01000000 -e x02000000 -4 Get MD5 hash of the memory chunk
in process with PID=1234
<this EXE> -p 1234 -4be 0x02000000 x01000000 Same as above
